Skip to content

Memory management bugs #6

@faisalmemon

Description

@faisalmemon

First off, remarkable software -- much appreciated!

I've experimented with the software and saw some crashes so I enabled Address Sanitizer (new Xcode 7 feature). This has found some heap memory bugs. I made a start on it but could not get through to the end. I'd like to share with you the changes I've seen are required:

diff --git a/libairfloat/settings.c b/libairfloat/settings.c
index 099698b..bb9d39d 100644
--- a/libairfloat/settings.c
+++ b/libairfloat/settings.c
@@ -75,7 +75,7 @@ void settings_set_name(struct settings_t* s, const char* new_name) {
     if (new_name == NULL || strlen(new_name) == 0)
         s_name = "AirFloat";

-    s->name = (char*)malloc(strlen(s_name + 1));
+    s->name = (char*)malloc(strlen(s_name) + 1);
     strcpy(s->name, s_name);

 }
diff --git a/libairfloat/webrequest.c b/libairfloat/webrequest.c
index d60b15c..219ff79 100644
--- a/libairfloat/webrequest.c
+++ b/libairfloat/webrequest.c
@@ -137,7 +137,7 @@ ssize_t web_request_parse(struct web_request_t* wr, const void* data, size_t dat
             strcpy(wr->command, cmd);
             wr->path = (char*)malloc(strlen(path) + 1);
             strcpy(wr->path, path);
-            wr->protocol = (char*)malloc(strlen(path) + 1);
+            wr->protocol = (char*)malloc(strlen(protocol) + 1);
             strcpy(wr->protocol, protocol);

             web_headers_destroy(wr->headers);
diff --git a/libairfloat/webserver.c b/libairfloat/webserver.c
index fa79a58..bc384bd 100644
--- a/libairfloat/webserver.c
+++ b/libairfloat/webserver.c
@@ -66,7 +66,7 @@ void _web_server_socket_closed(socket_p socket, void* ctx) {
         if (ws->connections[i].socket == socket) {

             web_server_connection_destroy(ws->connections[i].web_connection);
-            socket_destroy(ws->connections[i].socket);
+            //socket_destroy(ws->connections[i].socket);

             for (uint32_t x = i ; x < ws->connection_count - 1 ; x++)
                 ws->connections[x] = ws->connections[x + 1];

I've commented out the last socket_destroy because I found there to be a double release of the socket which is hit later.

I hope the above changes are helpful for you.

Best regards,
faz.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions