[tor-bugs] #20987 [Core Tor/Tor]: Memory leak in rend_config_services()

[Tor Bug Tracker & Wiki]

#20987: Memory leak in rend_config_services()
--------------------------+------------------------------------
 Reporter:  nickm         |          Owner:  nickm
     Type:  defect        |         Status:  needs_revision
 Priority:  Medium        |      Milestone:  Tor: 0.3.0.x-final
Component:  Core Tor/Tor  |        Version:
 Severity:  Normal        |     Resolution:
 Keywords:                |  Actual Points:
Parent ID:                |         Points:  .1
 Reviewer:                |        Sponsor:
--------------------------+------------------------------------
Changes (by teor):

 * status:  needs_review => needs_revision


Comment:

 Replying to [comment:4 nickm]:
 > Fix in branch `bug20987` in my public repo.
 >
 > Adding teor in cc since this leak was new in 8a0ea3ee43da006, so you
 probalby remember how the code goes. :)

 In general, the code in `rend_config_services` is complex and hard to
 modify correctly - it should be split into multiple functions. (Hopefully
 this will happen as part of the prop224 work!)

 These cases have a double-free, they call `rend_service_free(service)`
 twice:
 * HiddenServiceAllowUnknownPorts
 * HiddenServiceDirGroupReadable
 * HiddenServiceMaxStreams
 * HiddenServiceMaxStreamsCloseCircuit
 * HiddenServiceNumIntroductionPoints

 Is there a function for freeing a smartlist containing rend_service_t
 instances?
 If there is, we should use it. If not, we should create it and use it.
 (Perhaps in another ticket?)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20987#comment:5>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online