external/uhub
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix potential memory leaks and crashes.

Browse Source
This commit is contained in:
Jan Vidar Krey 2009-11-18 17:41:28 +01:00
parent f4e82ef503
commit 00995a1946
12 changed files with 97 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
src/adc/message.c
View File

@ -26,8 +26,7 @@
uhub_assert(X->capacity); \
uhub_assert(X->length); \
uhub_assert(X->length <= X->capacity); \
uhub_assert(X->length == strlen(X->cache)); \
uhub_assert(X->references >= 0);
uhub_assert(X->length == strlen(X->cache));
#else
#define ADC_MSG_ASSERT(X) do { } while(0)
#endif /* DEBUG */
@ -111,12 +110,12 @@ static int adc_msg_grow(struct adc_message* msg, size_t size)
if (msg->capacity > size)
return 1;
/* Make sure we align our data */
newsize = size;
newsize += 2; /* termination */
newsize += (newsize % sizeof(size_t)); /* alignment padding */
buf = msg_malloc_zero(newsize);
if (!buf)
return 0;
@ -126,7 +125,7 @@ static int adc_msg_grow(struct adc_message* msg, size_t size)
memcpy(buf, msg->cache, msg->length);
msg_free(msg->cache);
}
msg->cache = buf;
msg->capacity = newsize;
@ -144,7 +143,7 @@ static int adc_msg_cache_append(struct adc_message* msg, const char* string, siz
memcpy(&msg->cache[msg->length], string, len);
adc_msg_set_length(msg, msg->length + len);
assert(msg->capacity > msg->length);
msg->cache[msg->length] = 0;
return 1;
@ -777,16 +776,15 @@ char* adc_msg_get_argument(struct adc_message* cmd, int offset)
char* end;
char* argument;
int count = 0;
ADC_MSG_ASSERT(cmd);
adc_msg_unterminate(cmd);
start = strchr(&cmd->cache[adc_msg_get_arg_offset(cmd)-1], ' ');
while (start)
{
end = strchr(&start[1], ' ');
if (count == offset)
{
if (end)
@ -796,21 +794,27 @@ char* adc_msg_get_argument(struct adc_message* cmd, int offset)
else
{
argument = hub_strdup(&start[1]);
if (argument[strlen(argument)-1] == '\n')
if (argument && argument[strlen(argument)-1] == '\n')
argument[strlen(argument)-1] = 0;
}
if (!argument)
return 0; // FIXME: OOM
if (*argument)
{
adc_msg_terminate(cmd);
return argument;
}
else
{
hub_free(argument);
}
}
count++;
start = end;
}
adc_msg_terminate(cmd);
return 0;
}

8
src/adc/sid.c
View File

@ -88,10 +88,18 @@ struct sid_pool
struct sid_pool* sid_pool_create(sid_t max)
{
struct sid_pool* pool = hub_malloc(sizeof(struct sid_pool));
if (!pool)
return 0;
pool->min = 1;
pool->max = max + 1;
pool->count = 0;
pool->map = hub_malloc_zero(sizeof(struct hub_user*) * pool->max);
if (!pool->map)
{
hub_free(pool);
return 0;
}
pool->map[0] = (struct hub_user*) pool; /* hack to reserve the first sid. */
#ifdef DEBUG_SID

29
src/core/auth.c
View File

@ -355,25 +355,46 @@ int acl_is_user_denied(struct acl_handle* handle, const char* data)
int acl_user_ban_nick(struct acl_handle* handle, const char* nick)
{
char* data = 0;
struct hub_user_access_info* info = hub_malloc_zero(sizeof(struct hub_user_access_info));
if (!info)
{
LOG_ERROR("ACL error: Out of memory!");
return -1;
}
list_append(handle->users_banned, hub_strdup(nick));
data = hub_strdup(nick);
if (!data)
{
LOG_ERROR("ACL error: Out of memory!");
hub_free(info);
return -1;
}
list_append(handle->users_banned, data);
return 0;
}
int acl_user_ban_cid(struct acl_handle* handle, const char* cid)
{
char* data;
struct hub_user_access_info* info = hub_malloc_zero(sizeof(struct hub_user_access_info));
if (!info)
{
LOG_ERROR("ACL error: Out of memory!");
return -1;
}
list_append(handle->cids, hub_strdup(cid));
data = hub_strdup(cid);
if (!data)
{
LOG_ERROR("ACL error: Out of memory!");
hub_free(info);
return -1;
}
list_append(handle->cids, data);
return 0;
}
@ -431,12 +452,12 @@ int acl_is_ip_nat_override(struct acl_handle* handle, const char* ip_address)
*/
const char* acl_password_generate_challenge(struct acl_handle* acl, struct hub_user* user)
{
char buf[32];
char buf[64];
uint64_t tiger_res[3];
static char tiger_buf[MAX_CID_LEN+1];
// FIXME: Generate a better nonce scheme.
snprintf(buf, 32, "%p%d%d", user, (int) user->id.sid, (int) user->connection->sd);
snprintf(buf, 64, "%p%d%d", user, (int) user->id.sid, (int) user->connection->sd);
tiger((uint64_t*) buf, strlen(buf), (uint64_t*) tiger_res);
base32_encode((unsigned char*) tiger_res, TIGERSIZE, tiger_buf);

24
src/core/commands.c
View File

@ -77,7 +77,7 @@ static struct hub_command* command_create(const char* message)
}
char* prefix = list_get_first(cmd->args);
if (prefix[0] && prefix[1])
if (prefix && prefix[0] && prefix[1])
{
cmd->prefix = hub_strdup(&prefix[1]);
cmd->prefix_len = strlen(cmd->prefix);
@ -235,6 +235,9 @@ static int command_uptime(struct hub_info* hub, struct hub_user* user, struct hu
static int command_kick(struct hub_info* hub, struct hub_user* user, struct hub_command* cmd)
{
char* nick = list_get_first(cmd->args);
if (!nick)
return -1; // FIXME: bad syntax.
struct hub_user* target = uman_get_user_by_nick(hub, nick);
if (!target)
@ -250,6 +253,9 @@ static int command_kick(struct hub_info* hub, struct hub_user* user, struct hub_
static int command_ban(struct hub_info* hub, struct hub_user* user, struct hub_command* cmd)
{
char* nick = list_get_first(cmd->args);
if (!nick)
return -1; // FIXME: bad syntax.
struct hub_user* target = uman_get_user_by_nick(hub, nick);
if (!target)
@ -299,6 +305,9 @@ static int command_getip(struct hub_info* hub, struct hub_user* user, struct hub
char tmp[128];
char* nick = list_get_first(cmd->args);
if (!nick);
return -1; // FIXME: bad syntax/OOM
struct hub_user* target = uman_get_user_by_nick(hub, nick);
if (!target)
@ -316,11 +325,17 @@ static int command_whoip(struct hub_info* hub, struct hub_user* user, struct hub
struct hub_user* u;
int ret = 0;
if (!address)
return -1; // FIXME: bad syntax.
ret = ip_convert_address_to_range(address, &range);
if (!ret)
return command_status(hub, user, cmd, "Invalid IP address/range/mask");
users = (struct linked_list*) list_create();
if (!users)
return -1; // FIXME: OOM
ret = uman_get_user_by_addr(hub, users, &range);
if (!ret)
@ -333,6 +348,12 @@ static int command_whoip(struct hub_info* hub, struct hub_user* user, struct hub
snprintf(tmp, 128, "*** %s: Found %d match%s:", cmd->prefix, ret, ((ret != 1) ? "es" : ""));
char* buffer = hub_malloc(((MAX_NICK_LEN + INET6_ADDRSTRLEN + 5) * ret) + strlen(tmp) + 3);
if (!buffer)
{
list_destroy(users);
return -1; // FIXME: OOM
}
buffer[0] = 0;
strcat(buffer, tmp);
strcat(buffer, "\n");
@ -350,6 +371,7 @@ static int command_whoip(struct hub_info* hub, struct hub_user* user, struct hub
send_message(hub, user, buffer);
hub_free(buffer);
list_destroy(users);
return 0;
}

1
src/core/hub.c
View File

@ -102,6 +102,7 @@ int hub_handle_support(struct hub_info* hub, struct hub_user* u, struct adc_mess
if (hub->status == hub_status_disabled && u->state == state_protocol)
{
on_login_failure(hub, u, status_msg_hub_disabled);
hub_free(arg);
return -1;
}

5
src/core/inf.c
View File

@ -46,8 +46,11 @@ static int set_feature_cast_supports(struct hub_user* u, struct adc_message* cmd
if (adc_msg_has_named_argument(cmd, ADC_INF_FLAG_SUPPORT))
{
tmp = adc_msg_get_named_argument(cmd, ADC_INF_FLAG_SUPPORT);
if (!tmp)
return -1; // FIXME: OOM
user_clear_feature_cast_support(u);
it = tmp;
while (strlen(it) > 4)
{

1
src/core/netevent.c
View File

@ -111,7 +111,6 @@ int handle_net_read(struct hub_user* user)
if (hub_handle_message(g_hub, user, start, (pos - start)) == -1)
{
return quit_protocol_error;
break;
}
}
}

2
src/core/route.c
View File

@ -86,7 +86,7 @@ static inline int check_send_queue(struct hub_info* hub, struct hub_user* user,
return -1;
}
if (user->send_queue->size > get_max_send_queue_soft(hub) && msg->priority < 0)
if (user->send_queue->size > get_max_send_queue_soft(hub))
{
LOG_WARN("send queue soft overflowed.");
return 0;

3
src/core/usermanager.c
View File

@ -101,9 +101,10 @@ int uman_init(struct hub_info* hub)
if (!users->list)
{
list_destroy(users->list);
hub_free(users);
return -1;
}
hub->users = users;
#ifdef USERMANAGER_TIMER

3
src/network/network.c
View File

@ -303,7 +303,7 @@ int net_close(int fd)
}
else
{
if (fd != -1)
if (ret != -1)
{
net_stats_add_error();
}
@ -474,6 +474,7 @@ int net_socket_create(int af, int type, int protocol)
if (sd == -1)
{
net_error_out(sd, "net_socket_create");
return -1;
}
#ifdef SOCK_DUAL_STACK_OPT

5
src/util/list.c
View File

@ -54,6 +54,11 @@ void list_clear(struct linked_list* list, void (*free_handle)(void* ptr))
void list_append(struct linked_list* list, void* data_ptr)
{
struct node* new_node = (struct node*) hub_malloc_zero(sizeof(struct node));
if (!new_node)
{
LOG_FATAL("Unable to allocate memory");
return;
}
new_node->ptr = data_ptr;
if (list->last)

11
src/util/tiger.c
View File

@ -47,10 +47,13 @@ extern uint64_t tiger_sboxes[4*256];
ROUND(b, c, a, x7, mul)
void tiger_compress(uint64_t* str, uint64_t state[3]) {
uint64_t a, b, c, swap;
uint64_t a, b, c;
uint64_t x0, x1, x2, x3, x4, x5, x6, x7;
uint64_t aa, bb, cc;
#if PASSES > 3
uint64_t swap;
size_t pass_no;
#endif
a = state[0];
b = state[1];
c = state[2];
@ -107,7 +110,8 @@ void tiger_compress(uint64_t* str, uint64_t state[3]) {
x7 -= x6 ^ 0x0123456789ABCDEFULL;
PASS(b, c, a, 9);
#if PASSES > 3
for (pass_no = 3; pass_no < PASSES; pass_no++)
{
x0 -= x7 ^ 0xA5A5A5A5A5A5A5A5ULL;
@ -134,7 +138,8 @@ void tiger_compress(uint64_t* str, uint64_t state[3]) {
c = b;
b = swap;
}
#endif
a ^= aa;
b -= bb;
c += cc;