Opened 3 years ago

Closed 3 years ago

#19555 closed defect (fixed)

Memleaks in shared rand code

Reported by: asn Owned by:
Priority: High Milestone: Tor: 0.2.9.x-final
Component: Core Tor/Tor Version:
Severity: Normal Keywords: tor-sr
Cc: Actual Points:
Parent ID: Points: 0.2
Reviewer: Sponsor: SponsorR-must

Description (last modified by asn)

Two memleaks:


There is a memleak in disk_state_reset():

/* Reset disk state that is free allocated memory and zeroed the object. */
static void
disk_state_reset(void)
{
  config_free_lines(sr_disk_state->Commit);
  config_free_lines(sr_disk_state->SharedRandValues);
  config_free_lines(sr_disk_state->ExtraLines);
  memset(sr_disk_state, 0, sizeof(*sr_disk_state));
  sr_disk_state->magic_ = SR_DISK_STATE_MAGIC;
  sr_disk_state->TorVersion = tor_strdup(get_version());
}

See how the TorVersion ptr is never freed before being overwritten with a new alloced ptr.

This function is called everytime we save the state to disk (which should happen a few times every hour).

I think the fix might be as simple as freeing sr_disk_state->TorVersion before overwriting the pointer. But we should make sure we don't double free.


A second memleak in sr_act_post_consensus():

/* Update our internal state with the next voting interval starting time. */
  interval_starts = get_voting_schedule(options, time(NULL),
                                        LOG_NOTICE)->interval_starts;
  sr_state_update(interval_starts);
}

voting_schedule_t returned from get_voting_schedule() is never freed.

Code quality wise, we would have probably noticed this bug if we did the operation in two steps (first get struct, then access element), instead of trying to do two things at once. Something like this:

  /* Update our internal state with the next voting interval starting time. */
  {
    voting_schedule_t voting_schedule = get_voting_schedule(options, time(NULL), LOG_NOTICE);
    time_t interval_starts = voting_schedule->interval_starts;
    sr_state_update(interval_starts);
    tor_free(voting_schedule);
  }

Child Tickets

Change History (6)

comment:1 Changed 3 years ago by asn

Cc: dgoulet added

comment:2 Changed 3 years ago by asn

Description: modified (diff)
Summary: Memleak in shared rand state keepingMemleaks in shared rand code

comment:3 Changed 3 years ago by asn

Status: newneeds_review

Hello, please review my branch bug19555 for fixes to the above issues.

comment:4 Changed 3 years ago by asn

Ugh, re-pushed my branch because of a small mistake.

BTW, David, should we also free TorVersion at disk_state_free()?

comment:5 Changed 3 years ago by dgoulet

Cc: dgoulet removed
Keywords: tor-sr added; tor-prop250 removed
Status: needs_reviewmerge_ready

ACK on the branch bug19555.

As for disk_state_free(), I believe config_free() will free TorVersion which is considered a CONFIG_TYPE_STRING and finally freed in config_clear().

comment:6 Changed 3 years ago by nickm

Resolution: fixed
Status: merge_readyclosed

merged!

Note: See TracTickets for help on using tickets.