Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

memory leak in security_get_public_id and security_get_secret_key api's #171

Closed
boria8 opened this issue Jun 10, 2016 · 2 comments
Closed

Comments

@boria8
Copy link

boria8 commented Jun 10, 2016

security_get_public_id API and security_get_secret_key are not freeing dataP structure.

see my fix code:

char * security_get_public_id(lwm2m_object_t * obj, int instanceId, int * length){
int size = 1;
lwm2m_data_t * dataP = lwm2m_data_new(size);
dataP->id = 3; // public key or id

obj->readFunc(instanceId, &size, &dataP, obj);
if (dataP != NULL &&
        dataP->type == LWM2M_TYPE_OPAQUE)
{
        *length = dataP->value.asBuffer.length;
     char *buff=(char*)lwm2m_malloc(dataP->value.asBuffer.length);
        if(buff!=0)
        {
            memcpy(buff,dataP->value.asBuffer.buffer,dataP->value.asBuffer.length);
            *length = dataP->value.asBuffer.length;
        }
    lwm2m_data_free(size,dataP);
        return buff;
}else{
    return NULL;
}

}

char * security_get_secret_key(lwm2m_object_t * obj, int instanceId, int * length){
int size = 1;
lwm2m_data_t * dataP = lwm2m_data_new(size);
dataP->id = 5; // secret key

obj->readFunc(instanceId, &size, &dataP, obj);
if (dataP != NULL &&
        dataP->type == LWM2M_TYPE_OPAQUE)
{
        *length = dataP->value.asBuffer.length;
     char *buff=(char*)lwm2m_malloc(dataP->value.asBuffer.length);
        if(buff!=0)
        {
            memcpy(buff,dataP->value.asBuffer.buffer,dataP->value.asBuffer.length);
            *length = dataP->value.asBuffer.length;
        }
    lwm2m_data_free(size,dataP);
        return buff;
}else{
    return NULL;
}

}

static int
get_psk_info(struct dtls_context_t *ctx,
const session_t *session,
dtls_credentials_type_t type,
const unsigned char *id, size_t id_len,
unsigned char *result, size_t result_length) {

// find connection
dtls_connection_t* cnx = connection_find((dtls_connection_t *) ctx->app, &(session->addr.st),session->size);
if (cnx == NULL)
{
    printf("GET PSK session not found\n");
    return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR);
}

switch (type) {
    case DTLS_PSK_IDENTITY:
    {
        int idLen;
        char * id;
        id = security_get_public_id(cnx->securityObj, cnx->securityInstId, &idLen);
        if (result_length < idLen)
        {
            if(idLen) lwm2m_free(id);
             printf("cannot set psk_identity -- buffer too small\n");
            return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR);
        }

        memcpy(result, id,idLen);
         lwm2m_free(id);
        return idLen;
    }
    case DTLS_PSK_KEY:
    {
        int keyLen;
        char * key;
        key = security_get_secret_key(cnx->securityObj, cnx->securityInstId, &keyLen);

        if (result_length < keyLen)
        {
             if(idLen) lwm2m_free(key);
            printf("cannot set psk -- buffer too small\n");
            return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR);
        }

        memcpy(result, key,keyLen);
         lwm2m_free(key);
        return keyLen;
    }
    default:
        printf("unsupported request type: %d\n", type);
}

return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR);

}

@dnav
Copy link
Contributor

dnav commented Jun 13, 2016

Thank you for spotting this.
Could you propose your fix as a Pull Request ?

Thanks,

@dnav dnav mentioned this issue Jul 22, 2016
@dnav
Copy link
Contributor

dnav commented Jul 22, 2016

Changes made in #195

@dnav dnav closed this as completed Jul 22, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants