+memory check module
fix double free @routing
This commit is contained in:
1 parent
15c7968c8c
commit
066a9aa89e
13 files changed
+218
-229
No files matched your search
+3
-2
@@ -25,7 +25,7 @@ utun_CORE_SOURCES = \
|
||||
# Platform-specific TUN sources
|
||||
if OS_WINDOWS
|
||||
utun_TUN_SOURCES = tun_windows.c
|
||||
utun_TUN_LIBS = -liphlpapi -lws2_32 -ladvapi32 -lbcrypt
|
||||
utun_TUN_LIBS = -liphlpapi -lws2_32 -ladvapi32 -lbcrypt -ldbghelp
|
||||
else
|
||||
utun_TUN_SOURCES = tun_linux.c
|
||||
utun_TUN_LIBS =
|
||||
@@ -59,6 +59,7 @@ utun_CORE_CFLAGS = \
|
||||
-I$(top_srcdir)/lib \
|
||||
-I$(top_srcdir)/tinycrypt/lib/include \
|
||||
-I$(top_srcdir)/tinycrypt/lib/source \
|
||||
-g \
|
||||
$(DEBUG_FLAGS)
|
||||
|
||||
utun_CFLAGS = $(utun_CORE_CFLAGS)
|
||||
@@ -92,7 +93,7 @@ TINYCRYPT_OBJS = \
|
||||
utun-utils.o
|
||||
|
||||
# Rules to build TinyCrypt objects (for tests)
|
||||
TINYCRYPT_CFLAGS = -I$(top_srcdir)/tinycrypt/lib/include -I$(top_srcdir)/tinycrypt/lib/source
|
||||
TINYCRYPT_CFLAGS = -g -I$(top_srcdir)/tinycrypt/lib/include -I$(top_srcdir)/tinycrypt/lib/source
|
||||
|
||||
utun-aes_encrypt.o: $(TINYCRYPT_SRCDIR)/aes_encrypt.c
|
||||
$(AM_V_CC)$(COMPILE) $(TINYCRYPT_CFLAGS) -c -o $@ $<
|
||||
|
||||
+1
-1
@@ -38,7 +38,7 @@ static uint32_t parse_debug_categories(const char *value);
|
||||
/* Parse debug categories from comma-separated string */
|
||||
static uint32_t parse_debug_categories(const char *value) {
|
||||
uint32_t categories = 0;
|
||||
char *value_copy = strdup(value);
|
||||
char *value_copy = u_strdup(value);
|
||||
if (!value_copy) return DEBUG_CATEGORY_ALL; // Default to all on error
|
||||
|
||||
char *token = strtok(value_copy, ",");
|
||||
|
||||
+19
-3
@@ -164,6 +164,8 @@ static void routing_pkt_from_tun_cb(struct ll_queue* q, void* arg) {
|
||||
struct ETCP_FRAGMENT* pkt = (struct ETCP_FRAGMENT*)queue_data_get(instance->tun->output_queue);
|
||||
if (!pkt) return;
|
||||
|
||||
bool pkt_freed = false;
|
||||
|
||||
if (pkt->ll.dgram && pkt->ll.len > 0) {
|
||||
dump_ip_packet("TUN->routing", (const uint8_t*)pkt->ll.dgram, pkt->ll.len);
|
||||
|
||||
@@ -171,7 +173,9 @@ static void routing_pkt_from_tun_cb(struct ll_queue* q, void* arg) {
|
||||
if (dst_ip == 0) {
|
||||
DEBUG_WARN(DEBUG_CATEGORY_ROUTING, "Failed to extract destination IP, dropping packet");
|
||||
u_free(pkt->ll.dgram);
|
||||
pkt->ll.dgram = NULL;
|
||||
memory_pool_free(instance->tun->pool, pkt);
|
||||
pkt_freed = true;
|
||||
} else {
|
||||
struct in_addr addr;
|
||||
addr.s_addr = htonl(dst_ip);
|
||||
@@ -180,24 +184,32 @@ static void routing_pkt_from_tun_cb(struct ll_queue* q, void* arg) {
|
||||
if (!routes || routes->routes == 0) {
|
||||
DEBUG_INFO(DEBUG_CATEGORY_ROUTING, "No route to %s, dropping packet", ip_to_str(&addr, AF_INET).str);
|
||||
u_free(pkt->ll.dgram);
|
||||
pkt->ll.dgram = NULL;
|
||||
memory_pool_free(instance->tun->pool, pkt);
|
||||
pkt_freed = true;
|
||||
} else {
|
||||
struct ETCP_CONN* conn = routes->entries[0]->next_hop;
|
||||
if (!conn) {
|
||||
DEBUG_WARN(DEBUG_CATEGORY_ROUTING, "Route to %s has no next_hop, dropping packet", ip_to_str(&addr, AF_INET).str);
|
||||
u_free(pkt->ll.dgram);
|
||||
pkt->ll.dgram = NULL;
|
||||
memory_pool_free(instance->tun->pool, pkt);
|
||||
pkt_freed = true;
|
||||
} else if (!conn->normalizer) {
|
||||
DEBUG_WARN(DEBUG_CATEGORY_ROUTING, "Connection for %s has no normalizer, dropping packet", ip_to_str(&addr, AF_INET).str);
|
||||
u_free(pkt->ll.dgram);
|
||||
pkt->ll.dgram = NULL;
|
||||
memory_pool_free(instance->tun->pool, pkt);
|
||||
pkt_freed = true;
|
||||
} else {
|
||||
size_t etcp_data_len = 1 + pkt->ll.len;
|
||||
struct ll_entry* entry = ll_alloc_lldgram(etcp_data_len);
|
||||
if (!entry) {
|
||||
DEBUG_ERROR(DEBUG_CATEGORY_ROUTING, "Failed to allocate entry for ETCP send");
|
||||
u_free(pkt->ll.dgram);
|
||||
pkt->ll.dgram = NULL;
|
||||
memory_pool_free(instance->tun->pool, pkt);
|
||||
pkt_freed = true;
|
||||
} else {
|
||||
entry->dgram[0] = ETCP_ID_DATA;
|
||||
memcpy(entry->dgram + 1, pkt->ll.dgram, pkt->ll.len);
|
||||
@@ -210,19 +222,23 @@ static void routing_pkt_from_tun_cb(struct ll_queue* q, void* arg) {
|
||||
queue_dgram_free(entry);
|
||||
}
|
||||
|
||||
u_free(pkt->ll.dgram);
|
||||
memory_pool_free(instance->tun->pool, pkt);
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
memory_pool_free(instance->tun->pool, pkt);
|
||||
pkt_freed = true;
|
||||
}
|
||||
|
||||
cleanup:
|
||||
if (!pkt_freed) {
|
||||
if (pkt->ll.dgram) {
|
||||
u_free(pkt->ll.dgram);
|
||||
}
|
||||
memory_pool_free(instance->tun->pool, pkt);
|
||||
}
|
||||
|
||||
queue_resume_callback(instance->tun->output_queue);
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user