Bug#446104: nstxd leaks like a sieve

[Matthew William Solloway Bell]

Package: nstx
Version: 1.1-beta6
Severity: Grave
tags: patch

nstxd leaks like a sieve. As it is intended as a long running service
this makes it mostly unusable (and has caused a server of mine to lockup
and lose unrelated data).

This patch appears to ccorrect the problem in my case, and twiddles a
few trivial things. I have not checked for leaks in nstxcd.

Matthew W. S. Bell

diff -ruN nstx-1.1-beta6/nstxd.c nstx-1.1-beta6.new/nstxd.c
--- nstx-1.1-beta6/nstxd.c	2007-10-10 15:14:39.000000000 +0100
+++ nstx-1.1-beta6.new/nstxd.c	2007-10-10 00:58:48.000000000 +0100
@@ -179,7 +179,8 @@
 
 void nstx_getpacket (void) {
    int len, link;
-   const char *name, *buf, *data;
+   const char *name, *inbuf, *data;
+   char *outbuf = NULL;
    struct nstxmsg *msg;
    struct nstxqueue *qitem;
    struct dnspkt *pkt;
@@ -198,9 +199,9 @@
 			name);
 		  queueitem(pkt->id, name, &msg->peer);
 		  if ((data = dns_fqdn2data(name)) &&
-		      (buf = nstx_decode((unsigned char*)data, &len)))
+		      (inbuf = nstx_decode((unsigned char*)data, &len)))
 		    {
-		       nstx_handlepacket(buf, len, &sendtun);
+		       nstx_handlepacket(inbuf, len, &sendtun);
 		    }
 	       }
 	     dns_free(pkt);
@@ -218,10 +219,12 @@
       dns_settype(pkt, DNS_RESPONSE);
       link = dns_addquery(pkt, qitem->name);
       len = dns_getfreespace(pkt, DNS_RESPONSE);
-      buf = dequeue_senditem(&len);
-      dns_addanswer(pkt, buf, len, link);
-      buf = (char*)dns_constructpacket(pkt, &len);
-      sendns(buf, len, &qitem->peer);
+      outbuf = dequeue_senditem(&len);
+      dns_addanswer(pkt, outbuf, len, link);
+      outbuf = (char*)dns_constructpacket(pkt, &len);
+      sendns(outbuf, len, &qitem->peer);
+      free(outbuf);
+      free(qitem);
    }
    timeoutqueue(do_timeout);
 }
diff -ruN nstx-1.1-beta6/nstx_dns.c nstx-1.1-beta6.new/nstx_dns.c
--- nstx-1.1-beta6/nstx_dns.c	2007-10-10 15:14:39.000000000 +0100
+++ nstx-1.1-beta6.new/nstx_dns.c	2007-10-09 23:24:09.000000000 +0100
@@ -450,7 +450,7 @@
       ptr += list->len;
    }
    *l = len;
-   dns_free (pkt);
+   dns_free(pkt);
    return buf;
 }
 
@@ -505,7 +505,7 @@
      {
 	if (remain < 12)
 	  {
-	     syslog(LOG_ERR, "dns_extractpkt: too less bytes in an\n");
+	     syslog(LOG_ERR, "dns_extractpkt: too few bytes in an\n");
 	     free(offsets);
 	     dns_free(pkt);
 	     return NULL;
@@ -530,6 +530,7 @@
 	  {
 	     syslog(LOG_ERR, "dns_extractpkt: record too long in an (%d->%d)\n",
 		    remain, rrp->len);
+	     free(offsets);
 	     dns_free(pkt);
 	     return NULL;
 	  }
@@ -538,6 +539,7 @@
 	ptr += rrp->len;
 	remain -= rrp->len;
      }
+   free(offsets);
    return pkt;
 }
 
diff -ruN nstx-1.1-beta6/nstx_queue.c nstx-1.1-beta6.new/nstx_queue.c
--- nstx-1.1-beta6/nstx_queue.c	2004-06-27 22:43:34.000000000 +0100
+++ nstx-1.1-beta6.new/nstx_queue.c	2007-10-10 00:35:22.000000000 +0100
@@ -59,8 +59,6 @@
 
    if (!qhead)
      return NULL;
-   if (tmp)
-     free(tmp);
 
    if ((id < 0) || (qhead->id == id))
      {

signature.asc
Description: This is a digitally signed message part