From naab at net.in.tum.de  Thu Sep  4 18:42:46 2014
From: naab at net.in.tum.de (Johannes Naab)
Date: Thu, 4 Sep 2014 20:42:46 +0200
Subject: [ldns-users] [Patch] Memory leak in ldns_pkt_rr_list_by_name()
Message-ID: <2014-09-04.5cc4dcb6c02d2b238fe5875c9295fd19@localhost>

Hi,

ldns_pkt_rr_list_by_name() is as found by valgrind leaking memory by
first copying the necessary sections and never freeing the resulting
list.

ldns_pkt_rr_list_by_type() and ldns_pkt_rr_list_by_name_and_type() do
properly free the intermediate copy.

The patch fixes the problem the same way as ldns_pkt_rr_list_by_type()
and ldns_pkt_rr_list_by_name_and_type() are dealing with it.


An alternative approach avoiding some ldns_rr_clone() calls would be to
free all non-matching RR already in the for loop and using only
ldns_rr_list_free() at the end.


Regards,
Johannes
-------------- next part --------------
>From dd64bfe840755d18c675bb2cc13c1adaaec8205e Mon Sep 17 00:00:00 2001
From: Johannes Naab <naab at net.in.tum.de>
Date: Thu, 4 Sep 2014 19:49:36 +0200
Subject: [PATCH] Fix memory leak in ldns_pkt_rr_list_by_name()

The intermediate copy for section selection wasn't freed.
---
 packet.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/packet.c b/packet.c
index 0ac64c5..659156a 100644
--- a/packet.c
+++ b/packet.c
@@ -273,9 +273,15 @@ ldns_pkt_rr_list_by_name(ldns_pkt *packet,
 			if (ret == NULL) {
 				ret = ldns_rr_list_new();
 			}
-			ldns_rr_list_push_rr(ret, ldns_rr_list_rr(rrs, i));
+			ldns_rr_list_push_rr(ret,
+					     ldns_rr_clone(
+						ldns_rr_list_rr(rrs, i))
+					    );
 		}
 	}
+
+	ldns_rr_list_deep_free(rrs);
+
 	return ret;
 }
 
-- 
1.7.10.4


From willem at nlnetlabs.nl  Fri Sep  5 09:15:19 2014
From: willem at nlnetlabs.nl (Willem Toorop)
Date: Fri, 05 Sep 2014 11:15:19 +0200
Subject: [ldns-users] [Patch] Memory leak in ldns_pkt_rr_list_by_name()
In-Reply-To: <2014-09-04.5cc4dcb6c02d2b238fe5875c9295fd19@localhost>
References: <2014-09-04.5cc4dcb6c02d2b238fe5875c9295fd19@localhost>
Message-ID: <54097F27.1010003@nlnetlabs.nl>

A clear bug.  Patch applied.  Thanks!


Op 04-09-14 om 20:42 schreef Johannes Naab:
> Hi,
> 
> ldns_pkt_rr_list_by_name() is as found by valgrind leaking memory by
> first copying the necessary sections and never freeing the resulting
> list.
> 
> ldns_pkt_rr_list_by_type() and ldns_pkt_rr_list_by_name_and_type() do
> properly free the intermediate copy.
> 
> The patch fixes the problem the same way as ldns_pkt_rr_list_by_type()
> and ldns_pkt_rr_list_by_name_and_type() are dealing with it.
> 
> 
> An alternative approach avoiding some ldns_rr_clone() calls would be to
> free all non-matching RR already in the for loop and using only
> ldns_rr_list_free() at the end.
> 
> 
> Regards,
> Johannes
> 
> 
> 
> _______________________________________________
> ldns-users mailing list
> ldns-users at open.nlnetlabs.nl
> http://open.nlnetlabs.nl/mailman/listinfo/ldns-users
> 



From mail at maxliebkies.de  Fri Sep  5 16:19:56 2014
From: mail at maxliebkies.de (Max Liebkies)
Date: Fri, 5 Sep 2014 16:19:56 +0000
Subject: [ldns-users] [PATCH] Fix memory leak in
	ldns_dname2buffer_wire_compress
Message-ID: <1409933999.24156.5.camel@maxliebkies.de>

Hi,

to keep up with Johannes' post from yesterday, here's another patch to
fix a memory leak in ldns. 

In host2wire.c:ldns_dname2buffer_wire_compress() label and rest are both
created by memcpy'ing the data contained in name, via ldns_dname_label()
and ldns_dname_left_chop() respectively. On return (or recursion) they
get freed but not deep freed. This leaves the data contained therein
laying around. 

I tested the patch and it seems to fix the issue, altough I'm not 100%
sure I understood the recursive nature of the function correctly. ;-)

Cheers,
Max
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Fix-memory-leak-in-ldns_dname2buffer_wire_compress.patch
Type: text/x-patch
Size: 977 bytes
Desc: 0001-Fix-memory-leak-in-ldns_dname2buffer_wire_compress.patch
URL: <http://lists.nlnetlabs.nl/pipermail/ldns-users/attachments/20140905/74bc037a/attachment.bin>

From willem at nlnetlabs.nl  Thu Sep 11 09:57:56 2014
From: willem at nlnetlabs.nl (Willem Toorop)
Date: Thu, 11 Sep 2014 11:57:56 +0200
Subject: [ldns-users] [PATCH] Fix memory leak in
	ldns_dname2buffer_wire_compress
In-Reply-To: <1409933999.24156.5.camel@maxliebkies.de>
References: <1409933999.24156.5.camel@maxliebkies.de>
Message-ID: <54117224.9080205@nlnetlabs.nl>

Absolutely.  Also a clear bug.  Committed.  Thanks!


Op 05-09-14 om 18:19 schreef Max Liebkies:
> Hi,
> 
> to keep up with Johannes' post from yesterday, here's another patch to
> fix a memory leak in ldns. 
> 
> In host2wire.c:ldns_dname2buffer_wire_compress() label and rest are both
> created by memcpy'ing the data contained in name, via ldns_dname_label()
> and ldns_dname_left_chop() respectively. On return (or recursion) they
> get freed but not deep freed. This leaves the data contained therein
> laying around. 
> 
> I tested the patch and it seems to fix the issue, altough I'm not 100%
> sure I understood the recursive nature of the function correctly. ;-)
> 
> Cheers,
> Max
> 
> 
> 
> _______________________________________________
> ldns-users mailing list
> ldns-users at open.nlnetlabs.nl
> http://open.nlnetlabs.nl/mailman/listinfo/ldns-users
>