fix memory leak in case handle_request fails (some illegal requests)

Mon, 12 Aug 2024 21:20:17 +0200

author
Olaf Wintermann <olaf.wintermann@gmail.com>
date
Mon, 12 Aug 2024 21:20:17 +0200
changeset 544
27684460629f
parent 543
3335f431a91b
child 545
720893ec7d48

fix memory leak in case handle_request fails (some illegal requests)

src/server/daemon/httprequest.c file | annotate | diff | comparison | revisions
src/server/daemon/httprequest.h file | annotate | diff | comparison | revisions
src/server/daemon/sessionhandler.c file | annotate | diff | comparison | revisions
--- a/src/server/daemon/httprequest.c	Mon Aug 12 00:22:37 2024 +0200
+++ b/src/server/daemon/httprequest.c	Mon Aug 12 21:20:17 2024 +0200
@@ -133,16 +133,30 @@
      
     // create pool
     pool_handle_t *pool = pool_create();
+    if(!pool) {
+        log_ereport(LOG_FAILURE, "cannot create new memory pool for http request");
+        return 1;
+    }
+    
+    int ret = nsapi_start_request(request, thrpool, ev, pool);
+    if(ret) {
+        pool_destroy(pool);
+    }
+    return ret;
+}
 
+int nsapi_start_request(HTTPRequest *request, threadpool_t *thrpool, EventHandler *ev, pool_handle_t *pool) {
     // create nsapi data structures
     NSAPISession *sn = nsapisession_create(pool);
     if(sn == NULL) {
         /* TODO: error */
+        return 1;
     }
     
     NSAPIRequest *rq = pool_malloc(pool, sizeof(NSAPIRequest));
     if(rq == NULL) {
         /* TODO: error */
+        return 1;
     }
     ZERO(rq, sizeof(NSAPIRequest));
     rq->rq.req_start = request->req_start;
@@ -152,6 +166,7 @@
     IOStream *io = NULL;
     if(nsapisession_setconnection(sn, request->connection, request->netbuf, &io)) {
         // TODO: error
+        return 1;
     }
     
     if(!ev) {
@@ -188,7 +203,6 @@
     // init NSAPI request structure
     if(request_initialize(pool, request, rq) != 0) {
         log_ereport(LOG_FAILURE, "Cannot initialize request structure");
-        pool_destroy(pool);
         return 1;
     }
 
@@ -235,7 +249,6 @@
                 "invalid protocol version: %.*s",
                 (int)request->httpv.length,
                 request->httpv.ptr);
-        pool_destroy(pool);
         return 1;
     }
 
@@ -291,7 +304,6 @@
                 "invalid request path: {%.*s}",
                 (int)orig_path.length,
                 orig_path.ptr);
-        pool_destroy(pool);
         // TODO: 400 bad request
         return 1;
     }
@@ -426,7 +438,6 @@
             // a separate buffer is required for reading chunked transfer enc
             sn->buffer = pool_malloc(pool, nb->maxsize);
             if(!sn->buffer) {
-                pool_destroy(pool);
                 // TODO: error 500 
                 return 1;
             }
@@ -444,7 +455,6 @@
             nb->cursize = 0;
             
             if(httpstream_enable_chunked_read(sn->sn.csd, sn->buffer, nb->maxsize, &sn->cursize, &sn->pos)) {
-                pool_destroy(pool);
                 // TODO: error 500 
                 return 1;
             }
--- a/src/server/daemon/httprequest.h	Mon Aug 12 00:22:37 2024 +0200
+++ b/src/server/daemon/httprequest.h	Mon Aug 12 21:20:17 2024 +0200
@@ -81,10 +81,18 @@
  * starts request processing after reading the request header
  * 
  * request: request object
- * pool:    current thread pool or NULL
+ * thrpool: current thread pool or NULL
  */
-int handle_request(HTTPRequest *request, threadpool_t *pool, EventHandler *ev);
+int handle_request(HTTPRequest *request, threadpool_t *thrpool, EventHandler *ev);
 
+/*
+ * called by handle_request
+ */
+int nsapi_start_request(
+        HTTPRequest *request,
+        threadpool_t *thrpool,
+        EventHandler *ev,
+        pool_handle_t *pool);
 
 
 void header_add(HeaderArray *hd, cxmutstr name, cxmutstr value);
--- a/src/server/daemon/sessionhandler.c	Mon Aug 12 00:22:37 2024 +0200
+++ b/src/server/daemon/sessionhandler.c	Mon Aug 12 21:20:17 2024 +0200
@@ -450,6 +450,8 @@
     int r = handle_request(request, NULL, h);
     if(r != 0) {
         connection_destroy(request->connection);
+        free(request->netbuf->inbuf);
+        free(request->netbuf);
     }
     
     /*

mercurial