Fix memory leaks when when calling ThreadPoolAdd() or ThreadPoolAddPersistent()

Hi,

I had found some bugs about memory leak on libupnp-1.6.18.

It may lead to memory leak  when calling ThreadPoolAdd() or
ThreadPoolAddPersistent() which does not return 0.

See the attachment for patch.
This commit is contained in:
zexian chen 2013-09-10 17:27:07 -03:00 committed by Marcelo Roberto Jimenez
parent 72c29ef1f6
commit 8e3a71905b
6 changed files with 44 additions and 11 deletions

View File

@ -2,6 +2,17 @@
Version 1.6.19 Version 1.6.19
******************************************************************************* *******************************************************************************
2013-09-10 zexian chen <chenzexian88(at)gmail.com>
Hi,
I had found some bugs about memory leak on libupnp-1.6.18.
It may lead to memory leak when calling ThreadPoolAdd() or
ThreadPoolAddPersistent() which does not return 0.
See the attachment for patch.
2013-09-03 Peng <howtofly(at)gmail.com> 2013-09-03 Peng <howtofly(at)gmail.com>
Fix return value of config_description_doc. Fix return value of config_description_doc.

1
THANKS
View File

@ -71,5 +71,6 @@ exempt of errors.
- Tom (tomdev2) - Tom (tomdev2)
- Yoichi Nakayama (yoichi) - Yoichi Nakayama (yoichi)
- zephyrus (zephyrus00jp) - zephyrus (zephyrus00jp)
- zexian chen
- Zheng Peng (darkelf2010) - Zheng Peng (darkelf2010)

View File

@ -96,10 +96,17 @@ static void *TimerThreadWorker(
/* If time has elapsed, schedule job. */ /* If time has elapsed, schedule job. */
if (nextEvent && currentTime >= nextEventTime) { if (nextEvent && currentTime >= nextEventTime) {
if( nextEvent->persistent ) { if( nextEvent->persistent ) {
ThreadPoolAddPersistent( timer->tp, &nextEvent->job, if (ThreadPoolAddPersistent( timer->tp, &nextEvent->job, &tempId ) != 0) {
&tempId ); if (nextEvent->job.arg != NULL && nextEvent->job.free_func != NULL) {
nextEvent->job.free_func(nextEvent->job.arg);
}
}
} else { } else {
ThreadPoolAdd( timer->tp, &nextEvent->job, &tempId ); if (ThreadPoolAdd( timer->tp, &nextEvent->job, &tempId ) != 0) {
if (nextEvent->job.arg != NULL && nextEvent->job.free_func != NULL) {
nextEvent->job.free_func(nextEvent->job.arg);
}
}
} }
ListDelNode( &timer->eventQ, head, 0 ); ListDelNode( &timer->eventQ, head, 0 );
FreeTimerEvent( timer, nextEvent ); FreeTimerEvent( timer, nextEvent );

View File

@ -1980,7 +1980,9 @@ int UpnpSubscribeAsync(
TPJobInit(&job, (start_routine)UpnpThreadDistribution, Param); TPJobInit(&job, (start_routine)UpnpThreadDistribution, Param);
TPJobSetFreeFunction(&job, (free_routine)free); TPJobSetFreeFunction(&job, (free_routine)free);
TPJobSetPriority(&job, MED_PRIORITY); TPJobSetPriority(&job, MED_PRIORITY);
ThreadPoolAdd(&gSendThreadPool, &job, NULL); if (ThreadPoolAdd(&gSendThreadPool, &job, NULL) != 0) {
free(Param);
}
UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__, UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__,
"Exiting UpnpSubscribeAsync\n"); "Exiting UpnpSubscribeAsync\n");
@ -2166,7 +2168,9 @@ int UpnpUnSubscribeAsync(
TPJobInit( &job, ( start_routine ) UpnpThreadDistribution, Param ); TPJobInit( &job, ( start_routine ) UpnpThreadDistribution, Param );
TPJobSetFreeFunction( &job, ( free_routine ) free ); TPJobSetFreeFunction( &job, ( free_routine ) free );
TPJobSetPriority( &job, MED_PRIORITY ); TPJobSetPriority( &job, MED_PRIORITY );
ThreadPoolAdd( &gSendThreadPool, &job, NULL ); if (ThreadPoolAdd( &gSendThreadPool, &job, NULL ) != 0) {
free(Param);
}
exit_function: exit_function:
UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__, "Exiting UpnpUnSubscribeAsync\n"); UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__, "Exiting UpnpUnSubscribeAsync\n");
@ -2292,7 +2296,9 @@ int UpnpRenewSubscriptionAsync(
TPJobInit( &job, ( start_routine ) UpnpThreadDistribution, Param ); TPJobInit( &job, ( start_routine ) UpnpThreadDistribution, Param );
TPJobSetFreeFunction( &job, ( free_routine ) free ); TPJobSetFreeFunction( &job, ( free_routine ) free );
TPJobSetPriority( &job, MED_PRIORITY ); TPJobSetPriority( &job, MED_PRIORITY );
ThreadPoolAdd( &gSendThreadPool, &job, NULL ); if (ThreadPoolAdd( &gSendThreadPool, &job, NULL ) != 0) {
free(Param);
}
UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__, UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__,
"Exiting UpnpRenewSubscriptionAsync\n"); "Exiting UpnpRenewSubscriptionAsync\n");
@ -2764,7 +2770,9 @@ int UpnpSendActionAsync(
TPJobSetFreeFunction( &job, ( free_routine ) free ); TPJobSetFreeFunction( &job, ( free_routine ) free );
TPJobSetPriority( &job, MED_PRIORITY ); TPJobSetPriority( &job, MED_PRIORITY );
ThreadPoolAdd( &gSendThreadPool, &job, NULL ); if (ThreadPoolAdd( &gSendThreadPool, &job, NULL ) != 0) {
free(Param);
}
UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__, UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__,
"Exiting UpnpSendActionAsync \n"); "Exiting UpnpSendActionAsync \n");
@ -2884,7 +2892,9 @@ int UpnpSendActionExAsync(
TPJobSetFreeFunction( &job, ( free_routine ) free ); TPJobSetFreeFunction( &job, ( free_routine ) free );
TPJobSetPriority( &job, MED_PRIORITY ); TPJobSetPriority( &job, MED_PRIORITY );
ThreadPoolAdd( &gSendThreadPool, &job, NULL ); if (ThreadPoolAdd( &gSendThreadPool, &job, NULL ) != 0) {
free(Param);
}
UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__, UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__,
"Exiting UpnpSendActionAsync\n"); "Exiting UpnpSendActionAsync\n");
@ -2951,7 +2961,9 @@ int UpnpGetServiceVarStatusAsync(
TPJobSetPriority( &job, MED_PRIORITY ); TPJobSetPriority( &job, MED_PRIORITY );
ThreadPoolAdd( &gSendThreadPool, &job, NULL ); if (ThreadPoolAdd( &gSendThreadPool, &job, NULL ) != 0) {
free(Param);
}
UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__, UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__,
"Exiting UpnpGetServiceVarStatusAsync\n"); "Exiting UpnpGetServiceVarStatusAsync\n");

View File

@ -910,6 +910,7 @@ int StartMiniServer(
sock_close(miniSocket->ssdpReqSock4); sock_close(miniSocket->ssdpReqSock4);
sock_close(miniSocket->ssdpReqSock6); sock_close(miniSocket->ssdpReqSock6);
#endif /* INCLUDE_CLIENT_APIS */ #endif /* INCLUDE_CLIENT_APIS */
free(miniSocket);
return UPNP_E_OUTOF_MEMORY; return UPNP_E_OUTOF_MEMORY;
} }
/* Wait for miniserver to start. */ /* Wait for miniserver to start. */

View File

@ -291,8 +291,9 @@ void ssdp_handle_ctrlpt_msg(http_message_t *hmsg, struct sockaddr_storage *dest_
TPJobSetFreeFunction(&job, TPJobSetFreeFunction(&job,
(free_routine) (free_routine)
free); free);
ThreadPoolAdd(&gRecvThreadPool, &job, if (ThreadPoolAdd(&gRecvThreadPool, &job, NULL) != 0) {
NULL); free(threadData);
}
} }
} }
node = ListNext(&ctrlpt_info->SsdpSearchList, node); node = ListNext(&ctrlpt_info->SsdpSearchList, node);