[PATCH 0/3] fix memory leaks in PPP

[PATCH 0/3] fix memory leaks in PPP

[Kristen Carlson Accardi]

[-- Attachment #1: Type: text/plain, Size: 339 bytes --]

Fix a few memory leaks in PPP

Kristen Carlson Accardi (3):
  fix memory leaks in option handling
  fix memory leaks after ppp_transmit
  fix memory leak in ppp_auth

 gatchat/ppp_auth.c |    1 +
 gatchat/ppp_cp.c   |   51 +++++++++++++++++++++++++++++++++++++++++----------
 2 files changed, 42 insertions(+), 10 deletions(-)

[PATCH 1/3] fix memory leaks in option handling

[Kristen Carlson Accardi]

[-- Attachment #1: Type: text/plain, Size: 1589 bytes --]

free the data as well as the link when deleting options lists.
---
 gatchat/ppp_cp.c |   15 ++++++++++++++-
 1 files changed, 14 insertions(+), 1 deletions(-)

diff --git a/gatchat/ppp_cp.c b/gatchat/ppp_cp.c
index e8d6e30..0f04fa1 100644
--- a/gatchat/ppp_cp.c
+++ b/gatchat/ppp_cp.c
@@ -201,6 +201,16 @@ static void pppcp_clear_options(struct pppcp_data *data)
 	data->rejected_options = NULL;
 }
 
+static void pppcp_free_options(struct pppcp_data *data)
+{
+	/* remove all config options */
+	pppcp_clear_options(data);
+
+	/* remove default option list */
+	g_list_foreach(data->config_options, pppcp_free_option, NULL);
+	g_list_free(data->config_options);
+}
+
 /*
  * set the restart counter to either max-terminate
  * or max-configure.  The counter is decremented for
@@ -1103,6 +1113,7 @@ static void remove_config_option(gpointer elem, gpointer user_data)
 	if (!list)
 		return;
 
+	g_free(list->data);
 	data->config_options = g_list_delete_link(data->config_options, list);
 }
 
@@ -1226,6 +1237,8 @@ static guint8 pppcp_process_configure_ack(struct pppcp_data *data,
 			if (action->option_process)
 				action->option_process(acked_option,
 							data->priv);
+
+			g_free(list->data);
 			data->config_options =
 				g_list_delete_link(data->config_options, list);
 		} else
@@ -1440,7 +1453,7 @@ void pppcp_free(struct pppcp_data *data)
 	g_queue_free(data->event_queue);
 
 	/* remove all config options */
-	pppcp_clear_options(data);
+	pppcp_free_options(data);
 
 	/* free self */
 	g_free(data);
-- 
1.6.6.1

[PATCH 2/3] fix memory leaks after ppp_transmit

[Kristen Carlson Accardi]

[-- Attachment #1: Type: text/plain, Size: 4129 bytes --]

Free packets in ppp_cp after calling ppp_transmit()
---
 gatchat/ppp_cp.c |   36 +++++++++++++++++++++++++++---------
 1 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/gatchat/ppp_cp.c b/gatchat/ppp_cp.c
index 0f04fa1..b02f4ba 100644
--- a/gatchat/ppp_cp.c
+++ b/gatchat/ppp_cp.c
@@ -48,7 +48,7 @@ static const char *pppcp_state_strings[] =
 #endif
 
 #define pppcp_to_ppp_packet(p) \
-	(p-PPP_HEADROOM)
+	(((guint8 *) p) - PPP_HEADROOM)
 
 struct pppcp_event {
 	enum pppcp_event_type type;
@@ -62,6 +62,11 @@ struct pppcp_event {
 #define MAX_FAILURE		5
 #define CP_HEADER_SZ		4
 
+static void pppcp_packet_free(struct pppcp_packet *packet)
+{
+	g_free(pppcp_to_ppp_packet(packet));
+}
+
 static struct pppcp_packet *pppcp_packet_new(struct pppcp_data *data,
 						guint type, guint bufferlen)
 {
@@ -291,9 +296,11 @@ static void pppcp_send_configure_request(struct pppcp_data *data)
 			new_identity(data, data->config_identifier);
 	packet->identifier = data->config_identifier;
 
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
 
+	pppcp_packet_free(packet);
+
 	/* XXX don't retransmit right now */
 #if 0
 	data->restart_counter--;
@@ -327,8 +334,9 @@ static void pppcp_send_configure_ack(struct pppcp_data *data,
 	/* match identifier of the request */
 	packet->identifier = pppcp_header->identifier;
 
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
+	pppcp_packet_free(packet);
 }
 
 /*
@@ -357,9 +365,10 @@ static void pppcp_send_configure_nak(struct pppcp_data *data,
 				&odata);
 
 		packet->identifier = pppcp_header->identifier;
-		ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+		ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
 
+		pppcp_packet_free(packet);
 	}
 	/* if we have any unacceptable options, send a config-nak */
 	if (g_list_length(data->unacceptable_options)) {
@@ -377,8 +386,10 @@ static void pppcp_send_configure_nak(struct pppcp_data *data,
 				&odata);
 
 		packet->identifier = pppcp_header->identifier;
-		ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+		ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 				ntohs(packet->length));
+
+		pppcp_packet_free(packet);
 	}
 }
 
@@ -405,8 +416,10 @@ static void pppcp_send_terminate_request(struct pppcp_data *data)
 		data->terminate_identifier =
 			new_identity(data, data->terminate_identifier);
 	packet->identifier = data->terminate_identifier;
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
+
+	pppcp_packet_free(packet);
 	data->restart_counter--;
 	pppcp_start_timer(data);
 }
@@ -425,8 +438,10 @@ static void pppcp_send_terminate_ack(struct pppcp_data *data,
 	/* match identifier of the request */
 	packet->identifier = pppcp_header->identifier;
 
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(pppcp_header->length));
+
+	pppcp_packet_free(packet);
 }
 
 /*
@@ -454,8 +469,10 @@ static void pppcp_send_code_reject(struct pppcp_data *data,
 	memcpy(packet->data, rejected_packet,
 			ntohs(packet->length - CP_HEADER_SZ));
 
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
+
+	pppcp_packet_free(packet);
 }
 
 /*
@@ -478,9 +495,10 @@ static void pppcp_send_echo_reply(struct pppcp_data *data,
 	packet->identifier = header->identifier;
 
 	/* magic number? */
-	ppp_transmit(data->ppp, pppcp_to_ppp_packet((guint8 *) packet),
+	ppp_transmit(data->ppp, pppcp_to_ppp_packet(packet),
 			ntohs(packet->length));
 
+	pppcp_packet_free(packet);
 }
 
 static void pppcp_transition_state(enum pppcp_state new_state,
-- 
1.6.6.1

[PATCH 3/3] fix memory leak in ppp_auth

[Kristen Carlson Accardi]

[-- Attachment #1: Type: text/plain, Size: 552 bytes --]

Free packet after calling ppp_transmit()
---
 gatchat/ppp_auth.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/gatchat/ppp_auth.c b/gatchat/ppp_auth.c
index 2270436..6c3913e 100644
--- a/gatchat/ppp_auth.c
+++ b/gatchat/ppp_auth.c
@@ -112,6 +112,7 @@ static void chap_process_challenge(struct auth_data *auth, guint8 *packet)
 
 	/* transmit the packet */
 	ppp_transmit(auth->ppp, (guint8 *) ppp_packet, response_length);
+	g_free(ppp_packet);
 
 challenge_out:
 	g_checksum_free(checksum);
-- 
1.6.6.1

Re: [PATCH 0/3] fix memory leaks in PPP

[Marcel Holtmann]

[-- Attachment #1: Type: text/plain, Size: 445 bytes --]

Hi Kristen,

> Fix a few memory leaks in PPP
> 
> Kristen Carlson Accardi (3):
>   fix memory leaks in option handling
>   fix memory leaks after ppp_transmit
>   fix memory leak in ppp_auth
> 
>  gatchat/ppp_auth.c |    1 +
>  gatchat/ppp_cp.c   |   51 +++++++++++++++++++++++++++++++++++++++++----------
>  2 files changed, 42 insertions(+), 10 deletions(-)

all three patches have been applied. Thanks.

Regards

Marcel