Skip to content

Commit

Permalink
mdns: fix memory free issue when repeating the query in reply
Browse files Browse the repository at this point in the history
The repeated query will be copied in the next event loop while the
memory is freed instantly. Delay the free to fix this issue.
  • Loading branch information
gjc13 committed Jun 4, 2021
1 parent 2aa48c9 commit 5f244c8
Show file tree
Hide file tree
Showing 2 changed files with 47 additions and 6 deletions.
52 changes: 46 additions & 6 deletions components/mdns/mdns.c
Expand Up @@ -1057,7 +1057,26 @@ static void _mdns_free_tx_packet(mdns_tx_packet_t * packet)
if (!packet) {
return;
}
queueFree(mdns_out_question_t, packet->questions);
mdns_out_question_t *q = packet->questions;
while (q) {
mdns_out_question_t *next = q->next;
if (q->own_dynamic_memory) {
if (q->host) {
free((char *)q->host);
}
if (q->service) {
free((char *)q->service);
}
if (q->proto) {
free((char *)q->proto);
}
if (q->domain) {
free((char *)q->domain);
}
}
free(q);
q = next;
}
queueFree(mdns_out_answer_t, packet->answers);
queueFree(mdns_out_answer_t, packet->servers);
queueFree(mdns_out_answer_t, packet->additional);
Expand Down Expand Up @@ -1341,8 +1360,18 @@ static void _mdns_create_answer_from_parsed_packet(mdns_parsed_packet_t * parsed
_mdns_free_tx_packet(packet);
return;
}
memcpy(out_question, q, sizeof(mdns_out_question_t));
out_question->type = q->type;
out_question->unicast = q->unicast;
out_question->host = q->host;
q->host = NULL;
out_question->service = q->service;
q->service = NULL;
out_question->proto = q->proto;
q->proto = NULL;
out_question->domain = q->domain;
q->domain = NULL;
out_question->next = NULL;
out_question->own_dynamic_memory = true;
queueToEnd(mdns_out_question_t, packet->questions, out_question);
#endif // MDNS_REPEAT_QUERY_IN_RESPONSE
} else if (!_mdns_alloc_answer(&packet->answers, q->type, NULL, send_flush, false)) {
Expand Down Expand Up @@ -1409,6 +1438,7 @@ static mdns_tx_packet_t * _mdns_create_probe_packet(mdns_if_t tcpip_if, mdns_ip_
q->service = services[i]->service->service;
q->proto = services[i]->service->proto;
q->domain = MDNS_DEFAULT_DOMAIN;
q->own_dynamic_memory = false;
if (!q->host || _mdns_question_exists(q, packet->questions)) {
free(q);
continue;
Expand Down Expand Up @@ -1436,6 +1466,7 @@ static mdns_tx_packet_t * _mdns_create_probe_packet(mdns_if_t tcpip_if, mdns_ip_
q->service = NULL;
q->proto = NULL;
q->domain = MDNS_DEFAULT_DOMAIN;
q->own_dynamic_memory = false;
if (_mdns_question_exists(q, packet->questions)) {
free(q);
} else {
Expand Down Expand Up @@ -3117,10 +3148,18 @@ void mdns_parse_packet(mdns_rx_packet_t * packet)
while (parsed_packet->questions) {
mdns_parsed_question_t * question = parsed_packet->questions;
parsed_packet->questions = parsed_packet->questions->next;
free(question->host);
free(question->service);
free(question->proto);
free(question->domain);
if (question->host) {
free(question->host);
}
if (question->service) {
free(question->service);
}
if (question->proto) {
free(question->proto);
}
if (question->domain) {
free(question->domain);
}
free(question);
}
free(parsed_packet);
Expand Down Expand Up @@ -3650,6 +3689,7 @@ static mdns_tx_packet_t * _mdns_create_search_packet(mdns_search_once_t * search
q->service = search->service;
q->proto = search->proto;
q->domain = MDNS_DEFAULT_DOMAIN;
q->own_dynamic_memory = false;
queueToEnd(mdns_out_question_t, packet->questions, q);

if (search->type == MDNS_TYPE_PTR) {
Expand Down
1 change: 1 addition & 0 deletions components/mdns/private_include/mdns_private.h
Expand Up @@ -299,6 +299,7 @@ typedef struct mdns_out_question_s {
const char * service;
const char * proto;
const char * domain;
bool own_dynamic_memory;
} mdns_out_question_t;

typedef struct mdns_out_answer_s {
Expand Down

0 comments on commit 5f244c8

Please sign in to comment.