Skip to contentSkip to conversation

fix memory leaks in PPP

PATCH In review Kristen Carlson Accardi 2 participants 5 messages Mar 24, 2010

lore
Share & tools
lore

Kristen Carlson Accardi

author
#0 lore raw

cover fix memory leaks in PPP

Fix a few memory leaks in PPP

Kristen Carlson Accardi (3):
fix memory leaks in option handling
fix memory leaks after ppp_transmit
fix memory leak in ppp_auth

 gatchat/ppp_auth.c |    1 +
 gatchat/ppp_cp.c   |   51 +++++++++++++++++++++++++++++++++++++++++----------
 2 files changed, 42 insertions(+), 10 deletions(-)
author
#1 lore raw

PATCH 1/3 fix memory leaks in option handling

free the data as well as the link when deleting options lists.

---
 gatchat/ppp_cp.c |   15 ++++++++++++++-
 1 files changed, 14 insertions(+), 1 deletions(-)
gatchat/ppp_cp.c +14 -1
index e8d6e30..0f04fa1 100644
@@ -201,6 +201,16 @@ static void pppcp_clear_options(struct pppcp_data *data)
 	data->rejected_options = NULL;
 }
 
+static void pppcp_free_options(struct pppcp_data *data)
+{
+	/* remove all config options */
+	pppcp_clear_options(data);
+
+	/* remove default option list */
+	g_list_foreach(data->config_options, pppcp_free_option, NULL);
+	g_list_free(data->config_options);
+}
+
 /*
  * set the restart counter to either max-terminate
  * or max-configure.  The counter is decremented for

@@ -1103,6 +1113,7 @@ static void remove_config_option(gpointer elem, gpointer user_data)
 	if (!list)
 		return;
 
+	g_free(list->data);
 	data->config_options = g_list_delete_link(data->config_options, list);
 }
 

@@ -1226,6 +1237,8 @@ static guint8 pppcp_process_configure_ack(struct pppcp_data *data,
 			if (action->option_process)
 				action->option_process(acked_option,
 							data->priv);
+
+			g_free(list->data);
 			data->config_options =
 				g_list_delete_link(data->config_options, list);
 		} else

@@ -1440,7 +1453,7 @@ void pppcp_free(struct pppcp_data *data)
 	g_queue_free(data->event_queue);
 
 	/* remove all config options */
-	pppcp_clear_options(data);
+	pppcp_free_options(data);
 
 	/* free self */
 	g_free(data);
Signature · 1 line
1.6.6.1
author
#2 lore raw

PATCH 2/3 fix memory leaks after ppp_transmit

In reply to Kristen Carlson Accardi

Free packets in ppp_cp after calling ppp_transmit()

---
 gatchat/ppp_cp.c |   36 +++++++++++++++++++++++++++---------
 1 files changed, 27 insertions(+), 9 deletions(-)
gatchat/ppp_cp.c +27 -9
index 0f04fa1..b02f4ba 100644
@@ -48,7 +48,7 @@ static const char *pppcp_state_strings[] =
 #endif
 
 #define pppcp_to_ppp_packet(p) \
-	(p-PPP_HEADROOM)
+	(((guint8 *) p) - PPP_HEADROOM)
 
 struct pppcp_event {
 	enum pppcp_event_type type;

@@ -62,6 +62,11 @@ struct pppcp_event {
 #define MAX_FAILURE		5
 #define CP_HEADER_SZ		4
 
+static void pppcp_packet_free(struct pppcp_packet *packet)
+{
+	g_free(pppcp_to_ppp_packet(packet));
+}
+
 static struct pppcp_packet *pppcp_packet_new(struct pppcp_data *data,
 						guint type, guint bufferlen)
 {

@@ -291,9 +296,11 @@ static void pppcp_send_configure_request(struct pppcp_data *data)
 			new_identity(data, data->config_identifier);
 	packet->identifier = data->config_identifier;
 
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
 
+	pppcp_packet_free(packet);
+
 	/* XXX don't retransmit right now */
 #if 0
 	data->restart_counter--;

@@ -327,8 +334,9 @@ static void pppcp_send_configure_ack(struct pppcp_data *data,
 	/* match identifier of the request */
 	packet->identifier = pppcp_header->identifier;
 
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
+	pppcp_packet_free(packet);
 }
 
 /*

@@ -357,9 +365,10 @@ static void pppcp_send_configure_nak(struct pppcp_data *data,
 				&odata);
 
 		packet->identifier = pppcp_header->identifier;
-		ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+		ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
 
+		pppcp_packet_free(packet);
 	}
 	/* if we have any unacceptable options, send a config-nak */
 	if (g_list_length(data->unacceptable_options)) {

@@ -377,8 +386,10 @@ static void pppcp_send_configure_nak(struct pppcp_data *data,
 				&odata);
 
 		packet->identifier = pppcp_header->identifier;
-		ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+		ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 				ntohs(packet->length));
+
+		pppcp_packet_free(packet);
 	}
 }
 

@@ -405,8 +416,10 @@ static void pppcp_send_terminate_request(struct pppcp_data *data)
 		data->terminate_identifier =
 			new_identity(data, data->terminate_identifier);
 	packet->identifier = data->terminate_identifier;
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
+
+	pppcp_packet_free(packet);
 	data->restart_counter--;
 	pppcp_start_timer(data);
 }

@@ -425,8 +438,10 @@ static void pppcp_send_terminate_ack(struct pppcp_data *data,
 	/* match identifier of the request */
 	packet->identifier = pppcp_header->identifier;
 
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(pppcp_header->length));
+
+	pppcp_packet_free(packet);
 }
 
 /*

@@ -454,8 +469,10 @@ static void pppcp_send_code_reject(struct pppcp_data *data,
 	memcpy(packet->data, rejected_packet,
 			ntohs(packet->length - CP_HEADER_SZ));
 
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
+
+	pppcp_packet_free(packet);
 }
 
 /*

@@ -478,9 +495,10 @@ static void pppcp_send_echo_reply(struct pppcp_data *data,
 	packet->identifier = header->identifier;
 
 	/* magic number? */
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
 
+	pppcp_packet_free(packet);
 }
 
 static void pppcp_transition_state(enum pppcp_state new_state,
Signature · 1 line
1.6.6.1
author
#3 lore raw

PATCH 3/3 fix memory leak in ppp_auth

In reply to Kristen Carlson Accardi

Free packet after calling ppp_transmit()

---
 gatchat/ppp_auth.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
gatchat/ppp_auth.c +1 -0
index 2270436..6c3913e 100644
@@ -112,6 +112,7 @@ static void chap_process_challenge(struct auth_data *auth, guint8 *packet)
 
 	/* transmit the packet */
 	ppp_transmit(auth->ppp, (guint8 *) ppp_packet, response_length);
+	g_free(ppp_packet);
 
 challenge_out:
 	g_checksum_free(checksum);
Signature · 1 line
1.6.6.1
#4 lore raw
In reply to Kristen Carlson Accardi

Hi Kristen,

Quoted 10 lines

Fix a few memory leaks in PPP

Kristen Carlson Accardi (3):
fix memory leaks in option handling
fix memory leaks after ppp_transmit
fix memory leak in ppp_auth

 gatchat/ppp_auth.c |    1 +
 gatchat/ppp_cp.c   |   51 +++++++++++++++++++++++++++++++++++++++++----------
 2 files changed, 42 insertions(+), 10 deletions(-)

all three patches have been applied. Thanks.

Regards

Marcel