Memleaks in shared rand code
Two memleaks:
There is a memleak in disk_state_reset()
:
/* Reset disk state that is free allocated memory and zeroed the object. */
static void
disk_state_reset(void)
{
config_free_lines(sr_disk_state->Commit);
config_free_lines(sr_disk_state->SharedRandValues);
config_free_lines(sr_disk_state->ExtraLines);
memset(sr_disk_state, 0, sizeof(*sr_disk_state));
sr_disk_state->magic_ = SR_DISK_STATE_MAGIC;
sr_disk_state->TorVersion = tor_strdup(get_version());
}
See how the TorVersion
ptr is never freed before being overwritten with a new alloced ptr.
This function is called everytime we save the state to disk (which should happen a few times every hour).
I think the fix might be as simple as freeing sr_disk_state->TorVersion
before overwriting the pointer. But we should make sure we don't double free.
A second memleak in sr_act_post_consensus()
:
/* Update our internal state with the next voting interval starting time. */
interval_starts = get_voting_schedule(options, time(NULL),
LOG_NOTICE)->interval_starts;
sr_state_update(interval_starts);
}
voting_schedule_t
returned from get_voting_schedule()
is never freed.
Code quality wise, we would have probably noticed this bug if we did the operation in two steps (first get struct, then access element), instead of trying to do two things at once. Something like this:
/* Update our internal state with the next voting interval starting time. */
{
voting_schedule_t voting_schedule = get_voting_schedule(options, time(NULL), LOG_NOTICE);
time_t interval_starts = voting_schedule->interval_starts;
sr_state_update(interval_starts);
tor_free(voting_schedule);
}