osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

wslua: fix memleak of unregistered ProtoField field 

If a ProtoField object was created, but not linked to a Proto, then some
fields (name, abbrev, blob) could leak. Fixes ASAN test failures for
four wslua tests.

Change-Id: I570ea154153b505ba81edb2bbf538e6dc1438728
Reviewed-on: https://code.wireshark.org/review/31750
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
This commit is contained in:
Peter Wu 2019-01-26 15:06:15 +01:00
parent 03e13a6a9f
commit 79fef2ae50
2 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
epan/wslua/wslua_proto.c
View File

@ -634,6 +634,12 @@ int wslua_deregister_protocols(lua_State* L) {
lua_rawgeti(L, LUA_REGISTRYINDEX, proto->fields);
for (lua_pushnil(L); lua_next(L, -2); lua_pop(L, 1)) {
ProtoField f = checkProtoField(L, -1);
/* Memory ownership was previously transferred to epan in Proto_commit */
f->name = NULL;
f->abbrev = NULL;
f->blob = NULL;
f->hfid = -2; /* Deregister ProtoField, freed in ProtoField__gc */
}
lua_pop(L, 1);
@ -713,6 +719,7 @@ int Proto_commit(lua_State* L) {
hfri.hfinfo.bitmask = f->mask;
hfri.hfinfo.blurb = f->blob;
// XXX this will leak resources.
if (f->hfid != -2) {
return luaL_error(L,"fields can be registered only once");
}

16
epan/wslua/wslua_proto_field.c
View File

@ -1413,11 +1413,23 @@ WSLUA_METAMETHOD ProtoField__tostring(lua_State* L) {
static int ProtoField__gc(lua_State* L) {
ProtoField f = toProtoField(L,1);
if (f->hfid == -2) {
/*
* Initialized to -2 in ProtoField_new,
* changed to -1 in Proto_commit and subsequently replaced by
* an allocated number in proto_register_field_array.
* Reset to -2 again in wslua_deregister_protocols.
*/
if (f->hfid != -2) {
/* Only free unregistered and deregistered ProtoField */
g_free(f);
return 0;
}
/* Note: name, abbrev and blob will be NULL after Proto deregistration. */
g_free(f->name);
g_free(f->abbrev);
g_free(f->blob);
g_free(f);
return 0;
}