Fix mismatched alloc/frees

This commit is contained in:
Roger A. Light
2024-04-25 16:20:14 +01:00
parent 48eddd5676
commit db6ab6869a
25 changed files with 79 additions and 84 deletions
+34 -34
View File
@@ -89,8 +89,8 @@ static int pw__create_argon2id(struct mosquitto_pw *pw, const char *password)
size_t encoded_len = argon2_encodedlen(MOSQ_ARGON2_T, MOSQ_ARGON2_M, MOSQ_ARGON2_P,
(uint32_t)pw->params.argon2id.salt_len, sizeof(pw->params.argon2id.password_hash), Argon2_id);
free(pw->encoded_password);
pw->encoded_password = calloc(1, encoded_len+1);
mosquitto_free(pw->encoded_password);
pw->encoded_password = mosquitto_calloc(1, encoded_len+1);
rc = argon2id_hash_encoded(MOSQ_ARGON2_T, MOSQ_ARGON2_M, MOSQ_ARGON2_P,
password, strlen(password),
@@ -131,10 +131,10 @@ static int pw__verify_argon2id(struct mosquitto_pw *pw, const char *password)
static int pw__decode_argon2id(struct mosquitto_pw *pw, const char *password)
{
#ifdef WITH_ARGON2
char *new_password = strdup(password);
char *new_password = mosquitto_strdup(password);
if(new_password){
free(pw->encoded_password);
mosquitto_free(pw->encoded_password);
pw->encoded_password = new_password;
return MOSQ_ERR_SUCCESS;
}else{
@@ -227,19 +227,19 @@ static int pw__encode_sha512_pbkdf2(struct mosquitto_pw *pw)
rc = mosquitto_base64_encode(pw->params.sha512_pbkdf2.password_hash, sizeof(pw->params.sha512_pbkdf2.password_hash), &hash64);
if(rc){
free(salt64);
mosquitto_free(salt64);
return MOSQ_ERR_UNKNOWN;
}
free(pw->encoded_password);
mosquitto_free(pw->encoded_password);
size_t len = strlen("$6$$") + strlen("1,000,000,000,000") + strlen(salt64) + strlen(hash64) + 1;
pw->encoded_password = calloc(1, len);
pw->encoded_password = mosquitto_calloc(1, len);
if(!pw->encoded_password) return MOSQ_ERR_NOMEM;
snprintf(pw->encoded_password, len, "$%d$%d$%s$%s", pw->hashtype, pw->params.sha512_pbkdf2.iterations, salt64, hash64);
free(salt64);
free(hash64);
mosquitto_free(salt64);
mosquitto_free(hash64);
return MOSQ_ERR_SUCCESS;
#else
@@ -257,51 +257,51 @@ static int pw__decode_sha512_pbkdf2(struct mosquitto_pw *pw, const char *salt_pa
unsigned int salt_len, password_len;
int rc;
sp_heap = strdup(salt_password);
sp_heap = mosquitto_strdup(salt_password);
if(!sp_heap) return MOSQ_ERR_NOMEM;
iterations_s = strtok_r(sp_heap, "$", &saveptr);
if(iterations_s == NULL){
free(sp_heap);
mosquitto_free(sp_heap);
return MOSQ_ERR_INVAL;
}
pw->params.sha512_pbkdf2.iterations = atoi(iterations_s);
if(pw->params.sha512_pbkdf2.iterations < 1){
free(sp_heap);
mosquitto_free(sp_heap);
return MOSQ_ERR_INVAL;
}
salt_b64 = strtok_r(NULL, "$", &saveptr);
if(salt_b64 == NULL){
free(sp_heap);
mosquitto_free(sp_heap);
return MOSQ_ERR_INVAL;
}
rc = mosquitto_base64_decode(salt_b64, &salt, &salt_len);
if(rc != MOSQ_ERR_SUCCESS || (salt_len != 12 && salt_len != HASH_LEN)){
free(sp_heap);
free(salt);
mosquitto_free(sp_heap);
mosquitto_free(salt);
return MOSQ_ERR_INVAL;
}
memcpy(pw->params.sha512_pbkdf2.salt, salt, salt_len);
free(salt);
mosquitto_free(salt);
pw->params.sha512_pbkdf2.salt_len = salt_len;
password_b64 = strtok_r(NULL, "$", &saveptr);
if(password_b64 == NULL){
free(sp_heap);
mosquitto_free(sp_heap);
return MOSQ_ERR_INVAL;
}
rc = mosquitto_base64_decode(password_b64, &password, &password_len);
free(sp_heap);
mosquitto_free(sp_heap);
if(rc != MOSQ_ERR_SUCCESS || password_len != HASH_LEN){
free(password);
mosquitto_free(password);
return MOSQ_ERR_INVAL;
}
memcpy(pw->params.sha512_pbkdf2.password_hash, password, password_len);
free(password);
mosquitto_free(password);
return MOSQ_ERR_SUCCESS;
#else
@@ -400,15 +400,15 @@ static int pw__encode_sha512(struct mosquitto_pw *pw)
return MOSQ_ERR_UNKNOWN;
}
free(pw->encoded_password);
mosquitto_free(pw->encoded_password);
size_t len = strlen("$6$$") + strlen(salt64) + strlen(hash64) + 1;
pw->encoded_password = calloc(1, len);
pw->encoded_password = mosquitto_calloc(1, len);
if(!pw->encoded_password) return MOSQ_ERR_NOMEM;
snprintf(pw->encoded_password, len, "$%d$%s$%s", pw->hashtype, salt64, hash64);
free(salt64);
free(hash64);
mosquitto_free(salt64);
mosquitto_free(hash64);
return MOSQ_ERR_SUCCESS;
#else
@@ -425,40 +425,40 @@ static int pw__decode_sha512(struct mosquitto_pw *pw, const char *salt_password)
unsigned int salt_len, password_len;
int rc;
sp_heap = strdup(salt_password);
sp_heap = mosquitto_strdup(salt_password);
if(!sp_heap) return MOSQ_ERR_NOMEM;
salt_b64 = strtok_r(sp_heap, "$", &saveptr);
if(salt_b64 == NULL){
free(sp_heap);
mosquitto_free(sp_heap);
return MOSQ_ERR_INVAL;
}
rc = mosquitto_base64_decode(salt_b64, &salt, &salt_len);
if(rc != MOSQ_ERR_SUCCESS || (salt_len != 12 && salt_len != HASH_LEN)){
free(sp_heap);
free(salt);
mosquitto_free(sp_heap);
mosquitto_free(salt);
return MOSQ_ERR_INVAL;
}
memcpy(pw->params.sha512.salt, salt, salt_len);
free(salt);
mosquitto_free(salt);
pw->params.sha512.salt_len = salt_len;
password_b64 = strtok_r(NULL, "$", &saveptr);
if(password_b64 == NULL){
free(sp_heap);
mosquitto_free(sp_heap);
return MOSQ_ERR_INVAL;
}
rc = mosquitto_base64_decode(password_b64, &password, &password_len);
free(sp_heap);
mosquitto_free(sp_heap);
if(rc != MOSQ_ERR_SUCCESS || password_len != HASH_LEN){
free(password);
mosquitto_free(password);
return MOSQ_ERR_INVAL;
}
memcpy(pw->params.sha512.password_hash, password, password_len);
free(password);
mosquitto_free(password);
return MOSQ_ERR_SUCCESS;
#else
@@ -541,7 +541,7 @@ int pw__decode(struct mosquitto_pw *pw, const char *password)
void pw__cleanup(struct mosquitto_pw *pw)
{
if(pw){
free(pw->encoded_password);
mosquitto_free(pw->encoded_password);
pw->encoded_password = NULL;
}
}
+1 -1
View File
@@ -87,7 +87,7 @@ int handle__connack(struct mosquitto *mosq)
if(mosq->id){
/* We've been sent a client identifier but already have one. This
* shouldn't happen. */
SAFE_FREE(clientid);
mosquitto_FREE(clientid);
mosquitto_property_free_all(&properties);
return MOSQ_ERR_PROTOCOL;
}else{
+2 -2
View File
@@ -114,7 +114,7 @@ libmosq_EXPORT int mosquitto_subscribe_simple(
*messages = NULL;
userdata.messages = calloc(sizeof(struct mosquitto_message), (size_t)msg_count);
userdata.messages = mosquitto_calloc(sizeof(struct mosquitto_message), (size_t)msg_count);
if(!userdata.messages){
return MOSQ_ERR_NOMEM;
}
@@ -137,7 +137,7 @@ libmosq_EXPORT int mosquitto_subscribe_simple(
for(i=0; i<msg_count; i++){
mosquitto_message_free_contents(&userdata.messages[i]);
}
SAFE_FREE(userdata.messages);
mosquitto_FREE(userdata.messages);
return rc;
}
}
+2 -2
View File
@@ -76,7 +76,7 @@ int http_c__context_init(struct mosquitto *context)
"Sec-WebSocket-Protocol: mqtt\r\n"
"Sec-WebSocket-Version: 13\r\n"
"\r\n", path, context->host, key);
SAFE_FREE(key);
mosquitto_FREE(key);
packet->packet_length += WS_PACKET_OFFSET;
packet->to_process = packet->packet_length;
context->http_request[0] = '\0';
@@ -86,7 +86,7 @@ int http_c__context_init(struct mosquitto *context)
int http_c__context_cleanup(struct mosquitto *context)
{
SAFE_FREE(context->wsd.accept_key);
mosquitto_FREE(context->wsd.accept_key);
mosquitto_FREE(context->http_request);
return MOSQ_ERR_SUCCESS;
}
+3 -3
View File
@@ -46,7 +46,7 @@ int mosquitto_base64_encode(const unsigned char *in, size_t in_len, char **encod
if(BIO_flush(b64) == 1){
BIO_get_mem_ptr(b64, &bptr);
*encoded = malloc(bptr->length+1);
*encoded = mosquitto_malloc(bptr->length+1);
if(*encoded){
memcpy(*encoded, bptr->data, bptr->length);
(*encoded)[bptr->length] = '\0';
@@ -79,7 +79,7 @@ int mosquitto_base64_decode(const char *in, unsigned char **decoded, unsigned in
BIO_write(bmem, in, (int)slen);
if(BIO_flush(bmem) == 1){
*decoded = calloc(slen, 1);
*decoded = mosquitto_calloc(slen, 1);
if(*decoded){
len = BIO_read(b64, *decoded, (int)slen);
@@ -87,7 +87,7 @@ int mosquitto_base64_decode(const char *in, unsigned char **decoded, unsigned in
*decoded_len = (unsigned int)len;
rc = 0;
}else{
free(*decoded);
mosquitto_free(*decoded);
*decoded = NULL;
}
}
+11 -11
View File
@@ -56,7 +56,7 @@ void mosquitto_property_free(mosquitto_property **property)
break;
}
free(*property);
mosquitto_free(*property);
*property = NULL;
}
@@ -819,7 +819,7 @@ BROKER_EXPORT const mosquitto_property *mosquitto_property_read_binary(const mos
if(value){
*len = p->value.bin.len;
if(p->value.bin.len){
*value = calloc(1, *len + 1U);
*value = mosquitto_calloc(1, *len + 1U);
if(!(*value)) return NULL;
memcpy(*value, p->value.bin.v, *len);
@@ -852,7 +852,7 @@ BROKER_EXPORT const mosquitto_property *mosquitto_property_read_string(const mos
if(value){
if(p->value.s.len){
*value = calloc(1, (size_t)p->value.s.len+1);
*value = mosquitto_calloc(1, (size_t)p->value.s.len+1);
if(!(*value)) return NULL;
memcpy(*value, p->value.s.v, p->value.s.len);
@@ -879,7 +879,7 @@ BROKER_EXPORT const mosquitto_property *mosquitto_property_read_string_pair(cons
if(name){
if(p->name.len){
*name = calloc(1, (size_t)p->name.len+1);
*name = mosquitto_calloc(1, (size_t)p->name.len+1);
if(!(*name)) return NULL;
memcpy(*name, p->name.v, p->name.len);
}else{
@@ -889,10 +889,10 @@ BROKER_EXPORT const mosquitto_property *mosquitto_property_read_string_pair(cons
if(value){
if(p->value.s.len){
*value = calloc(1, (size_t)p->value.s.len+1);
*value = mosquitto_calloc(1, (size_t)p->value.s.len+1);
if(!(*value)){
if(name){
free(*name);
mosquitto_free(*name);
*name = NULL;
}
return NULL;
@@ -944,7 +944,7 @@ BROKER_EXPORT int mosquitto_property_copy_all(mosquitto_property **dest, const m
*dest = NULL;
while(src){
pnew = calloc(1, sizeof(mosquitto_property));
pnew = mosquitto_calloc(1, sizeof(mosquitto_property));
if(!pnew){
mosquitto_property_free_all(dest);
return MOSQ_ERR_NOMEM;
@@ -978,7 +978,7 @@ BROKER_EXPORT int mosquitto_property_copy_all(mosquitto_property **dest, const m
case MQTT_PROP_TYPE_STRING:
pnew->value.s.len = src->value.s.len;
pnew->value.s.v = src->value.s.v ? strdup(src->value.s.v) : (char*)calloc(1,1);
pnew->value.s.v = src->value.s.v ? mosquitto_strdup(src->value.s.v) : (char*)mosquitto_calloc(1,1);
if(!pnew->value.s.v){
mosquitto_property_free_all(dest);
return MOSQ_ERR_NOMEM;
@@ -988,7 +988,7 @@ BROKER_EXPORT int mosquitto_property_copy_all(mosquitto_property **dest, const m
case MQTT_PROP_TYPE_BINARY:
pnew->value.bin.len = src->value.bin.len;
if(src->value.bin.len){
pnew->value.bin.v = malloc(pnew->value.bin.len);
pnew->value.bin.v = mosquitto_malloc(pnew->value.bin.len);
if(!pnew->value.bin.v){
mosquitto_property_free_all(dest);
return MOSQ_ERR_NOMEM;
@@ -999,14 +999,14 @@ BROKER_EXPORT int mosquitto_property_copy_all(mosquitto_property **dest, const m
case MQTT_PROP_TYPE_STRING_PAIR:
pnew->value.s.len = src->value.s.len;
pnew->value.s.v = src->value.s.v ? strdup(src->value.s.v) : (char*)calloc(1,1);
pnew->value.s.v = src->value.s.v ? mosquitto_strdup(src->value.s.v) : (char*)mosquitto_calloc(1,1);
if(!pnew->value.s.v){
mosquitto_property_free_all(dest);
return MOSQ_ERR_NOMEM;
}
pnew->name.len = src->name.len;
pnew->name.v = src->name.v ? strdup(src->name.v) : (char*)calloc(1,1);
pnew->name.v = src->name.v ? mosquitto_strdup(src->name.v) : (char*)mosquitto_calloc(1,1);
if(!pnew->name.v){
mosquitto_property_free_all(dest);
return MOSQ_ERR_NOMEM;
+4 -4
View File
@@ -230,7 +230,7 @@ int dynsec_groups__config_load(struct dynsec__data *data, cJSON *tree)
const char *textname;
if(json_get_string(j_group, "textname", &textname, false) == MOSQ_ERR_SUCCESS){
if(textname){
group->text_name = strdup(textname);
group->text_name = mosquitto_strdup(textname);
if(group->text_name == NULL){
mosquitto_free(group);
continue;
@@ -242,7 +242,7 @@ int dynsec_groups__config_load(struct dynsec__data *data, cJSON *tree)
const char *textdescription;
if(json_get_string(j_group, "textdescription", &textdescription, false) == MOSQ_ERR_SUCCESS){
if(textdescription){
group->text_description = strdup(textdescription);
group->text_description = mosquitto_strdup(textdescription);
if(group->text_description == NULL){
mosquitto_free(group->text_name);
mosquitto_free(group);
@@ -411,7 +411,7 @@ int dynsec_groups__process_create(struct dynsec__data *data, struct mosquitto_co
}
strncpy(group->groupname, groupname, groupname_len+1);
if(text_name){
group->text_name = strdup(text_name);
group->text_name = mosquitto_strdup(text_name);
if(group->text_name == NULL){
mosquitto_control_command_reply(cmd, "Internal error");
group__free_item(data, group);
@@ -419,7 +419,7 @@ int dynsec_groups__process_create(struct dynsec__data *data, struct mosquitto_co
}
}
if(text_description){
group->text_description = strdup(text_description);
group->text_description = mosquitto_strdup(text_description);
if(group->text_description == NULL){
mosquitto_control_command_reply(cmd, "Internal error");
group__free_item(data, group);
+5 -5
View File
@@ -215,11 +215,11 @@ static int client_restore(struct mosquitto_sqlite *ms)
while(sqlite3_step(stmt) == SQLITE_ROW){
str = (const char *)sqlite3_column_text(stmt, 0);
if(str){
client.clientid = strdup(str);
client.clientid = mosquitto_strdup(str);
}
str = (const char *)sqlite3_column_text(stmt, 1);
if(str){
client.username = strdup(str);
client.username = mosquitto_strdup(str);
}
client.will_delay_time = (time_t)sqlite3_column_int64(stmt, 2);
client.session_expiry_time = (time_t)sqlite3_column_int64(stmt, 3);
@@ -309,7 +309,7 @@ static int base_msg_restore(struct mosquitto_sqlite *ms)
base_msg.expiry_time = (time_t)sqlite3_column_int64(stmt, 1);
str = (const char *)sqlite3_column_text(stmt, 2);
if(str){
base_msg.topic = strdup(str);
base_msg.topic = mosquitto_strdup(str);
if(!base_msg.topic){
failed++;
continue;
@@ -320,9 +320,9 @@ static int base_msg_restore(struct mosquitto_sqlite *ms)
payload = (const void *)sqlite3_column_blob(stmt, 3);
base_msg.payloadlen = (uint32_t)sqlite3_column_int(stmt, 6);
if(payload && base_msg.payloadlen){
base_msg.payload = malloc(base_msg.payloadlen+1);
base_msg.payload = mosquitto_malloc(base_msg.payloadlen+1);
if(!base_msg.payload){
free(base_msg.topic);
mosquitto_free(base_msg.topic);
failed++;
continue;
}
+8
View File
@@ -364,6 +364,12 @@ static void post_shutdown_cleanup(void)
net__broker_cleanup();
}
static void cjson_init(void)
{
cJSON_Hooks hooks = {mosquitto_malloc, mosquitto_free};
cJSON_InitHooks(&hooks);
}
#ifdef WITH_FUZZING
int mosquitto_fuzz_main(int argc, char *argv[])
#else
@@ -379,6 +385,8 @@ int main(int argc, char *argv[])
#endif
struct mosquitto *ctxt, *ctxt_tmp;
cjson_init();
#if defined(WIN32) || defined(__CYGWIN__)
if(argc == 2){
if(!strcmp(argv[1], "run")){
+6 -6
View File
@@ -110,7 +110,7 @@ int persist__chunk_client_msg_write_v6(FILE *db_fptr, struct P_client_msg *chunk
write_e(db_fptr, chunk->clientid, id_len);
if(chunk->subscription_identifier){
if(proplen > 0){
prop_packet = calloc(1, sizeof(struct mosquitto__packet)+proplen);
prop_packet = mosquitto_calloc(1, sizeof(struct mosquitto__packet)+proplen);
if(prop_packet == NULL){
return MOSQ_ERR_NOMEM;
}
@@ -118,7 +118,7 @@ int persist__chunk_client_msg_write_v6(FILE *db_fptr, struct P_client_msg *chunk
prop_packet->packet_length = proplen;
rc = property__write_all(prop_packet, &subscription_id_prop, true);
if(rc){
SAFE_FREE(prop_packet);
mosquitto_FREE(prop_packet);
return rc;
}
@@ -175,7 +175,7 @@ int persist__chunk_message_store_write_v6(FILE *db_fptr, struct P_base_msg *chun
}
if(chunk->properties){
if(proplen > 0){
struct mosquitto__packet *prop_packet = calloc(1, sizeof(struct mosquitto__packet)+proplen);
struct mosquitto__packet *prop_packet = mosquitto_calloc(1, sizeof(struct mosquitto__packet)+proplen);
if(prop_packet == NULL){
return MOSQ_ERR_NOMEM;
}
@@ -183,15 +183,15 @@ int persist__chunk_message_store_write_v6(FILE *db_fptr, struct P_base_msg *chun
prop_packet->packet_length = proplen;
rc = property__write_all(prop_packet, chunk->properties, true);
if(rc){
SAFE_FREE(prop_packet);
mosquitto_FREE(prop_packet);
return rc;
}
if(fwrite(prop_packet->payload, 1, proplen, db_fptr) != proplen){
SAFE_FREE(prop_packet);
mosquitto_FREE(prop_packet);
goto error;
}
SAFE_FREE(prop_packet);
mosquitto_FREE(prop_packet);
}
}
+1 -1
View File
@@ -73,7 +73,7 @@ static void plugin__unload_single(mosquitto_plugin_id_t *plugin)
}
if(plugin->lib.lib){
LIB_CLOSE(plugin->lib.lib);
//LIB_CLOSE(plugin->lib.lib);
}
memset(&plugin->lib, 0, sizeof(struct mosquitto__plugin_lib));
}
+2 -2
View File
@@ -267,7 +267,7 @@ BROKER_EXPORT int mosquitto_broker_publish_copy(
return MOSQ_ERR_INVAL;
}
payload_out = calloc(1, (size_t)(payloadlen+1));
payload_out = mosquitto_calloc(1, (size_t)(payloadlen+1));
if(payload_out == NULL){
return MOSQ_ERR_NOMEM;
}
@@ -283,7 +283,7 @@ BROKER_EXPORT int mosquitto_broker_publish_copy(
properties);
if(rc){
SAFE_FREE(payload_out);
mosquitto_FREE(payload_out);
}
return rc;
}
-1
View File
@@ -42,7 +42,6 @@ int main(int argc, char *argv[])
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
return run;
@@ -41,7 +41,6 @@ int main(int argc, char *argv[])
rc = mosq->loop();
if(rc) break;
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
-1
View File
@@ -49,7 +49,6 @@ int main(int argc, char *argv[])
while(run == -1){
mosq->loop();
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
-1
View File
@@ -48,7 +48,6 @@ int main(int argc, char *argv[])
while(run == -1){
mosq->loop();
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
-1
View File
@@ -49,7 +49,6 @@ int main(int argc, char *argv[])
while(run == -1){
mosq->loop();
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
-1
View File
@@ -55,7 +55,6 @@ int main(int argc, char *argv[])
while(run == -1){
mosq->loop();
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
@@ -64,7 +64,6 @@ int main(int argc, char *argv[])
while(run == -1){
mosq->loop();
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
@@ -66,7 +66,6 @@ int main(int argc, char *argv[])
while(run == -1){
mosq->loop();
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
@@ -59,7 +59,6 @@ int main(int argc, char *argv[])
while(run == -1){
mosq->loop();
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
-1
View File
@@ -50,7 +50,6 @@ int main(int argc, char *argv[])
while(run == -1){
mosq->loop();
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
@@ -70,7 +70,6 @@ int main(int argc, char *argv[])
while(run == -1){
mosq->loop();
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
@@ -57,7 +57,6 @@ int main(int argc, char *argv[])
while(run == -1){
mosq->loop();
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();
-1
View File
@@ -51,7 +51,6 @@ int main(int argc, char *argv[])
while(run == -1){
mosq->loop();
}
delete mosq;
delete mosq;
mosqpp::lib_cleanup();