devs/libstrophe-gh
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

parser: fix memory leak in error path for depth more than 1

Browse Source 
If parser has an unfinished stanza with depth > 1, it can happen that
parser->stanza points to a child. Releasing the child doesn't free the
parent stanza.

Instead of releasing parser->stanza in parser_reset() and parser_free(),
find the top most parent and release the whole tree. Also add a test
case for this memory leak.
This commit is contained in:
Dmitry Podgorny
2021-06-27 03:24:42 +03:00
parent 05620ab506
commit 2bf1988b3c
3 changed files with 30 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/parser_libxml2.c
View File

@@ -262,13 +262,22 @@ char *parser_attr_name(xmpp_ctx_t *ctx, char *nsname)
return xmpp_strdup(ctx, nsname);
}
static void _free_parent_stanza(xmpp_stanza_t *stanza)
{
xmpp_stanza_t *parent;
for (parent = stanza; parent->parent != NULL; parent = parent->parent)
;
xmpp_stanza_release(parent);
}
/* free a parser */
void parser_free(parser_t *parser)
{
if (parser->xmlctx)
xmlFreeParserCtxt(parser->xmlctx);
if (parser->stanza)
xmpp_stanza_release(parser->stanza);
_free_parent_stanza(parser->stanza);
xmpp_free(parser->ctx, parser);
}
@@ -278,7 +287,7 @@ int parser_reset(parser_t *parser)
if (parser->xmlctx)
xmlFreeParserCtxt(parser->xmlctx);
if (parser->stanza)
xmpp_stanza_release(parser->stanza);
_free_parent_stanza(parser->stanza);
parser->stanza = NULL;
parser->depth = 0;