buglwIP - A Lightweight TCP/IP stack - Bugs: bug #56806, Mem Leak in http_post_request

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #56806: Mem Leak in http_post_request

Submitter:  schraubenkarl <schraubenkarl>
Submitted:  Mon 26 Aug 2019 08:03:59 AM UTC
   
 
Category:  apps Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  Invalid
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  2.1.1

Mon 26 Aug 2019 08:23:37 AM UTC, comment #1: 

http_post_rxpbuf sends the pbuf to http_post_get_response_uri


/**
 * @ingroup httpd
 * Called for each pbuf of data that has been received for a POST.
 * ATTENTION: The application is responsible for freeing the pbufs passed in!
 *
 * @param connection Unique connection identifier.
 * @param p Received data.
 * @return ERR_OK: Data accepted.
 *         another err_t: Data denied, http_post_get_response_uri will be called.
 */
err_t httpd_post_receive_data(void *connection, struct pbuf *p);


So, your callback is responsible for doing a pbuf_unref.

Your fix is a workaround for your callback not doing its job, in one of the code-paths. Take a look at the top two lines in your patch too:


              pbuf_ref(q);     // <------ this would be a problem too if your httpd_post_receive_data doesn't do the pbuf_unref it is suppose to do
              return http_post_rxpbuf(hs, q);
            } else if (hs->post_content_len_left == 0) {
              q = pbuf_alloc(PBUF_RAW, 0, PBUF_REF);
              err_t err;
              err = http_post_rxpbuf(hs, q);
              pbuf_free (q);
              return err;
            } else {
              return ERR_OK;


Stian Sebastian Skjelstad <mywave>
Mon 26 Aug 2019 08:03:59 AM UTC, original submission:  

After about 16 http POST requests pbuf_alloc returned NULL.

I figured out that in function http_post_request at line 1845

            pbuf_ref(q);
              return http_post_rxpbuf(hs, q);
            } else if (hs->post_content_len_left == 0) {
              q = pbuf_alloc(PBUF_RAW, 0, PBUF_REF);
              return http_post_rxpbuf(hs, q);
            } else {
              return ERR_OK;

the  memory allocated by  
  
    q = pbuf_alloc(PBUF_RAW, 0, PBUF_REF);

is never been deallocated.

After changing the code to:

    pbuf_ref(q);
              return http_post_rxpbuf(hs, q);
            } else if (hs->post_content_len_left == 0) {
              q = pbuf_alloc(PBUF_RAW, 0, PBUF_REF);
              err_t err;
              err = http_post_rxpbuf(hs, q);
              pbuf_free (q);
              return err;
            } else {
              return ERR_OK;

no memory leak is seen further.

Can somebody confirm the issue and also the solution?
thx

schraubenkarl <schraubenkarl>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gradator (Updated the item)
  • -email is unavailable- added by mywave (Posted a comment)
  • -email is unavailable- added by schraubenkarl (Submitted the item)
  • -email is unavailable- added by schraubenkarl
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-08-26 gradator StatusNone Invalid
        Open/ClosedOpen Closed
    2019-08-26 schraubenkarl Carbon-Copy- Added schraubenkarl

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code