Memory leak in handle_unsubscribe.c

Reason: In line 70, the memory allocation for the pointer reasons_codes may result to a memory leak due to the many returns (e.g as the one in line 78) occuring in the program's path until reaching the mosquitto__free at line 122. Fix: I added a mosquitto__free(reason_codes) statement before each return statement that could result to a memory leak Signed-off-by: Panagiotis Vasilikos <[email protected]>
eclipse · Jan 28, 2020 · 49bf788 · 49bf788
1 parent caeb211
commit 49bf788
Showing 1 changed file with 12 additions and 6 deletions.
diff --git a/src/handle_unsubscribe.c b/src/handle_unsubscribe.c
@@ -66,9 +66,16 @@ int handle__unsubscribe(struct mosquitto_db *db, struct mosquitto *context)
  }
  }
 
+ reason_code_max = 10;
+ reason_codes = mosquitto__malloc(reason_code_max);
+ if(!reason_codes){
+ return MOSQ_ERR_NOMEM;
+ }
+
  while(context->in_packet.pos < context->in_packet.remaining_length){
  sub = NULL;
  if(packet__read_string(&context->in_packet, &sub, &slen)){
+ mosquitto__free(reason_codes);
  return 1;
  }
 
@@ -77,26 +84,25 @@ int handle__unsubscribe(struct mosquitto_db *db, struct mosquitto *context)
  "Empty unsubscription string from %s, disconnecting.",
  context->id);
  mosquitto__free(sub);
+ mosquitto_free(reason_codes);
  return 1;
  }
  if(mosquitto_sub_topic_check(sub)){
  log__printf(NULL, MOSQ_LOG_INFO,
  "Invalid unsubscription string from %s, disconnecting.",
  context->id);
  mosquitto__free(sub);
+ mosquitto__free(reason_codes);
  return 1;
  }
 
  log__printf(NULL, MOSQ_LOG_DEBUG, "\t%s", sub);
  rc = sub__remove(db, context, sub, db->subs, &reason);
  log__printf(NULL, MOSQ_LOG_UNSUBSCRIBE, "%s %s", context->id, sub);
  mosquitto__free(sub);
- if(rc) return rc;
-
- reason_code_max = 10;
- reason_codes = mosquitto__malloc(reason_code_max);
- if(!reason_codes){
- return MOSQ_ERR_NOMEM;
+ if(rc){
+ mosquitto_fee(reason_codes);
+ return rc;
  }
 
  reason_codes[reason_code_count] = reason;