[tor-commits] [tor/release-0.3.3] Fix memory leak in new_establish_intro_cell().

[nickm@xxxxxxxxxxxxxx]

commit 8e805bf0f65ffd137a6c9ed89be060e5d9ba317d
Author: Alexander Færøy <ahf@xxxxxxxxxxxxxx>
Date:   Sat Jun 23 10:48:42 2018 +0200

    Fix memory leak in new_establish_intro_cell().
    
    This patch fixes a memory leak in new_establish_intro_cell() that could
    happen if a test assertion fails and the *cell_out value isn't properly
    free'd.
    
    See: Coverity CID 1437445
---
 src/test/test_hs_intropoint.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/test/test_hs_intropoint.c b/src/test/test_hs_intropoint.c
index 0cae2de7e..b2d2700f8 100644
--- a/src/test/test_hs_intropoint.c
+++ b/src/test/test_hs_intropoint.c
@@ -43,6 +43,10 @@ new_establish_intro_cell(const char *circ_nonce,
   trn_cell_establish_intro_t *cell = NULL;
   hs_service_intro_point_t *ip = NULL;
 
+  /* Ensure that *cell_out is NULL such that we can use to check if we need to
+   * free `cell` in case of an error. */
+  *cell_out = NULL;
+
   /* Auth key pair is generated in the constructor so we are all set for
    * using this IP object. */
   ip = service_intro_point_new(NULL, 0);
@@ -56,6 +60,9 @@ new_establish_intro_cell(const char *circ_nonce,
   *cell_out = cell;
 
  done:
+  if (*cell_out == NULL)
+    trn_cell_establish_intro_free(cell);
+
   service_intro_point_free(ip);
   return cell_len;
 }



_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits