welterde/l2tpns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

processudp: fix memory leak

Browse source 
send/recvchalresponse should be freed before early returns in the function,
as there are code paths where they would be allocated before these.

Note free is no-op on null pointer so checking for non-null value is useless.

Reported-by: Coverity#375342
This commit is contained in:
Dominique Martinet 2022-11-05 21:18:36 +09:00
parent 4d906e595d
commit af92de5eeb
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
l2tpns.c
View file

@ -2705,6 +2705,8 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr, uint16_t indexu
{ {
LOG(1, s, t, "Invalid length in AVP\n"); LOG(1, s, t, "Invalid length in AVP\n");
STAT(tunnel_rx_errors); STAT(tunnel_rx_errors);
free(sendchalresponse);
free(recvchalresponse);
return; return;
} }
p += n; // next p += n; // next
@ -3250,6 +3252,8 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr, uint16_t indexu
controladd(c, asession, t); // send the message controladd(c, asession, t); // send the message
} }
free(sendchalresponse);
free(recvchalresponse);
return; return;
case 11: // ICRP case 11: // ICRP
LOG(3, s, t, "Received ICRP\n"); LOG(3, s, t, "Received ICRP\n");
@ -3304,8 +3308,8 @@ void processudp(uint8_t *buf, int len, struct sockaddr_in *addr, uint16_t indexu
LOG(1, s, t, "Unknown message type %u\n", message); LOG(1, s, t, "Unknown message type %u\n", message);
break; break;
} }
if (sendchalresponse) free(sendchalresponse); free(sendchalresponse);
if (recvchalresponse) free(recvchalresponse); free(recvchalresponse);
cluster_send_tunnel(t); cluster_send_tunnel(t);
} }
else else