[tor-bugs] #19555 [Core Tor/Tor]: Memleaks in shared rand code (was: Memleak in shared rand state keeping)

[Tor Bug Tracker & Wiki]

#19555: Memleaks in shared rand code
--------------------------+------------------------------------
 Reporter:  asn           |          Owner:
     Type:  defect        |         Status:  new
 Priority:  High          |      Milestone:  Tor: 0.2.9.x-final
Component:  Core Tor/Tor  |        Version:
 Severity:  Normal        |     Resolution:
 Keywords:  tor-prop250   |  Actual Points:
Parent ID:                |         Points:  0.2
 Reviewer:                |        Sponsor:  SponsorR-must
--------------------------+------------------------------------
Description changed by asn:

Old description:

> There is a memleak in `disk_state_reset()`:
>
> {{{
> /* Reset disk state that is free allocated memory and zeroed the object.
> */
> static void
> disk_state_reset(void)
> {
>   config_free_lines(sr_disk_state->Commit);
>   config_free_lines(sr_disk_state->SharedRandValues);
>   config_free_lines(sr_disk_state->ExtraLines);
>   memset(sr_disk_state, 0, sizeof(*sr_disk_state));
>   sr_disk_state->magic_ = SR_DISK_STATE_MAGIC;
>   sr_disk_state->TorVersion = tor_strdup(get_version());
> }
> }}}
>
> See how the `TorVersion` ptr is never freed before being overwritten with
> a new alloced ptr.
>
> This function is called everytime we save the state to disk (which should
> happen a few times every hour).
>
> I think the fix might be as simple as freeing `sr_disk_state->TorVersion`
> before overwriting the pointer. But we should make sure we don't double
> free.

New description:

 Two memleaks:

 ----

 There is a memleak in `disk_state_reset()`:

 {{{
 /* Reset disk state that is free allocated memory and zeroed the object.
 */
 static void
 disk_state_reset(void)
 {
   config_free_lines(sr_disk_state->Commit);
   config_free_lines(sr_disk_state->SharedRandValues);
   config_free_lines(sr_disk_state->ExtraLines);
   memset(sr_disk_state, 0, sizeof(*sr_disk_state));
   sr_disk_state->magic_ = SR_DISK_STATE_MAGIC;
   sr_disk_state->TorVersion = tor_strdup(get_version());
 }
 }}}

 See how the `TorVersion` ptr is never freed before being overwritten with
 a new alloced ptr.

 This function is called everytime we save the state to disk (which should
 happen a few times every hour).

 I think the fix might be as simple as freeing `sr_disk_state->TorVersion`
 before overwriting the pointer. But we should make sure we don't double
 free.

 ----

 A second memleak in `sr_act_post_consensus()`:

 {{{
 /* Update our internal state with the next voting interval starting time.
 */
   interval_starts = get_voting_schedule(options, time(NULL),
                                         LOG_NOTICE)->interval_starts;
   sr_state_update(interval_starts);
 }
 }}}

 `voting_schedule_t` returned from `get_voting_schedule()` is never freed.

 Code quality wise, we would have probably noticed this bug if we did the
 operation in two steps (first get struct, then access element), instead of
 trying to do two things at once. Something like this:

 {{{
   /* Update our internal state with the next voting interval starting
 time. */
   {
     voting_schedule_t voting_schedule = get_voting_schedule(options,
 time(NULL), LOG_NOTICE);
     time_t interval_starts = voting_schedule->interval_starts;
     sr_state_update(interval_starts);
     tor_free(voting_schedule);
   }
 }}}

--

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19555#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online