+memory check module

fix double free @routing
This commit is contained in:
jeka committed 2026-03-06 15:55:16 +03:00
1 parent 15c7968c8c
commit 066a9aa89e
13 files changed
+218 -229

No files matched your search

+3 -2
View File
@@ -25,7 +25,7 @@ utun_CORE_SOURCES = \
# Platform-specific TUN sources
if OS_WINDOWS
utun_TUN_SOURCES = tun_windows.c
utun_TUN_LIBS = -liphlpapi -lws2_32 -ladvapi32 -lbcrypt
utun_TUN_LIBS = -liphlpapi -lws2_32 -ladvapi32 -lbcrypt -ldbghelp
else
utun_TUN_SOURCES = tun_linux.c
utun_TUN_LIBS =
@@ -59,6 +59,7 @@ utun_CORE_CFLAGS = \
-I$(top_srcdir)/lib \
-I$(top_srcdir)/tinycrypt/lib/include \
-I$(top_srcdir)/tinycrypt/lib/source \
-g \
$(DEBUG_FLAGS)
utun_CFLAGS = $(utun_CORE_CFLAGS)
@@ -92,7 +93,7 @@ TINYCRYPT_OBJS = \
utun-utils.o
# Rules to build TinyCrypt objects (for tests)
TINYCRYPT_CFLAGS = -I$(top_srcdir)/tinycrypt/lib/include -I$(top_srcdir)/tinycrypt/lib/source
TINYCRYPT_CFLAGS = -g -I$(top_srcdir)/tinycrypt/lib/include -I$(top_srcdir)/tinycrypt/lib/source
utun-aes_encrypt.o: $(TINYCRYPT_SRCDIR)/aes_encrypt.c
$(AM_V_CC)$(COMPILE) $(TINYCRYPT_CFLAGS) -c -o $@ $<
+1 -1
View File
@@ -38,7 +38,7 @@ static uint32_t parse_debug_categories(const char *value);
/* Parse debug categories from comma-separated string */
static uint32_t parse_debug_categories(const char *value) {
uint32_t categories = 0;
char *value_copy = strdup(value);
char *value_copy = u_strdup(value);
if (!value_copy) return DEBUG_CATEGORY_ALL; // Default to all on error
char *token = strtok(value_copy, ",");
+19 -3
View File
@@ -164,6 +164,8 @@ static void routing_pkt_from_tun_cb(struct ll_queue* q, void* arg) {
struct ETCP_FRAGMENT* pkt = (struct ETCP_FRAGMENT*)queue_data_get(instance->tun->output_queue);
if (!pkt) return;
bool pkt_freed = false;
if (pkt->ll.dgram && pkt->ll.len > 0) {
dump_ip_packet("TUN->routing", (const uint8_t*)pkt->ll.dgram, pkt->ll.len);
@@ -171,7 +173,9 @@ static void routing_pkt_from_tun_cb(struct ll_queue* q, void* arg) {
if (dst_ip == 0) {
DEBUG_WARN(DEBUG_CATEGORY_ROUTING, "Failed to extract destination IP, dropping packet");
u_free(pkt->ll.dgram);
pkt->ll.dgram = NULL;
memory_pool_free(instance->tun->pool, pkt);
pkt_freed = true;
} else {
struct in_addr addr;
addr.s_addr = htonl(dst_ip);
@@ -180,24 +184,32 @@ static void routing_pkt_from_tun_cb(struct ll_queue* q, void* arg) {
if (!routes || routes->routes == 0) {
DEBUG_INFO(DEBUG_CATEGORY_ROUTING, "No route to %s, dropping packet", ip_to_str(&addr, AF_INET).str);
u_free(pkt->ll.dgram);
pkt->ll.dgram = NULL;
memory_pool_free(instance->tun->pool, pkt);
pkt_freed = true;
} else {
struct ETCP_CONN* conn = routes->entries[0]->next_hop;
if (!conn) {
DEBUG_WARN(DEBUG_CATEGORY_ROUTING, "Route to %s has no next_hop, dropping packet", ip_to_str(&addr, AF_INET).str);
u_free(pkt->ll.dgram);
pkt->ll.dgram = NULL;
memory_pool_free(instance->tun->pool, pkt);
pkt_freed = true;
} else if (!conn->normalizer) {
DEBUG_WARN(DEBUG_CATEGORY_ROUTING, "Connection for %s has no normalizer, dropping packet", ip_to_str(&addr, AF_INET).str);
u_free(pkt->ll.dgram);
pkt->ll.dgram = NULL;
memory_pool_free(instance->tun->pool, pkt);
pkt_freed = true;
} else {
size_t etcp_data_len = 1 + pkt->ll.len;
struct ll_entry* entry = ll_alloc_lldgram(etcp_data_len);
if (!entry) {
DEBUG_ERROR(DEBUG_CATEGORY_ROUTING, "Failed to allocate entry for ETCP send");
u_free(pkt->ll.dgram);
pkt->ll.dgram = NULL;
memory_pool_free(instance->tun->pool, pkt);
pkt_freed = true;
} else {
entry->dgram[0] = ETCP_ID_DATA;
memcpy(entry->dgram + 1, pkt->ll.dgram, pkt->ll.len);
@@ -210,19 +222,23 @@ static void routing_pkt_from_tun_cb(struct ll_queue* q, void* arg) {
queue_dgram_free(entry);
}
u_free(pkt->ll.dgram);
memory_pool_free(instance->tun->pool, pkt);
goto cleanup;
}
}
}
}
} else {
memory_pool_free(instance->tun->pool, pkt);
pkt_freed = true;
}
cleanup:
if (!pkt_freed) {
if (pkt->ll.dgram) {
u_free(pkt->ll.dgram);
}
memory_pool_free(instance->tun->pool, pkt);
}
queue_resume_callback(instance->tun->output_queue);
}