Possible memory leak

[stasos24]

syslog-ng

Version of syslog-ng

3.35.1

Memory leak

modules/afstomp/stomp.c:105
modules/afstomp/stomp.c:111

int
stomp_connect(stomp_connection **connection_ref, char *hostname, int port)
{
  stomp_connection *conn;
  conn = g_new0(stomp_connection, 1);  //Memory is allocated
  conn->socket = socket(AF_INET, SOCK_STREAM, 0);
  if (conn->socket == -1)
    {
      msg_error("Failed to create socket!"); // conn is not freed, memory leak
      return FALSE;
    }
  if (!resolve_hostname_to_sockaddr(&conn->remote_sa, AF_INET, hostname))
    {
      msg_error("Failed to resolve hostname in stomp driver", 
                evt_tag_str("hostname", hostname)); // conn is not freed, memory leak

      return FALSE;
    }
  g_sockaddr_set_port(conn->remote_sa, port);
  if (!g_connect(conn->socket, conn->remote_sa))
    {
      msg_error("Stomp connection failed",
                evt_tag_str("host", hostname));
      _stomp_connection_free(conn);
      return FALSE;
    }
  (*connection_ref) = conn;
  return TRUE;
};

[stasos24]

Use-after-free

/modules/disq/dqtool.c:446

static void
_relocate_qfile(PersistState *state, const gchar *name)
{
  if (_is_persist_entry_holds_diskq_file(state, name))
    {
      gchar *qfile = persist_state_lookup_string(state, name, NULL, NULL);
      printf("found qfile, key: %s, path: %s\n", name, qfile);
      gchar *base = g_path_get_basename(qfile);
      gchar *relocated_qfile = g_build_filename(new_diskq_path, base, NULL);
      if (!relocated_qfile)
        {
          fprintf(stderr, "Invalid path. new_diskq_dir: %s, qfile: %s\n", new_diskq_path, qfile);
          g_free(qfile); // pointer is released
        }

      if (_move_file(qfile, relocated_qfile)) // use-after-free
        {
          printf("new qfile_path: %s\n", relocated_qfile);
          persist_state_alloc_string(state, name, relocated_qfile, -1);
        }
      else
        {
          fprintf(stderr, "Failed to move file to new qfile_path: %s\n", relocated_qfile);
        }
      g_free(base);
      g_free(qfile);
      g_free(relocated_qfile);
    }
}

[MrAnno]

Hi @stasos24,

Would you like to open a pull request that fixes these findings?