mirror of
https://gitlab.torproject.org/tpo/core/tor.git
synced 2024-11-27 13:53:31 +01:00
r11919@Kushana: nickm | 2007-01-10 13:32:48 -0500
Add some defensive programming to eventdns.c in an attempt to catch possible memory stomping bugs. svn:r9322
This commit is contained in:
Nick Mathewson
parent
53b730556e
commit
9937695598
@ -3,6 +3,8 @@ Changes in version 0.1.2.7-alpha - 2007-??-??
|
||||
- When computing clock skew from directory HTTP headers, consider what
|
||||
time it was when we finished asking for the directory, not what time it
|
||||
is now.
|
||||
- Add some defensive programming to eventdns.c in an attempt to catch
|
||||
possible memory-stomping bugs.
|
||||
|
||||
|
||||
Changes in version 0.1.2.6-alpha - 2007-01-09
|
||||
|
||||
@ -141,6 +141,8 @@ typedef unsigned int uint;
|
||||
|
||||
#define CLASS_INET EVDNS_CLASS_INET
|
||||
|
||||
#define CLEAR(x) do { memset((x), 0, sizeof(*(x))); } while(0)
|
||||
|
||||
struct request {
|
||||
u8 *request; // the dns packet data
|
||||
unsigned int request_len;
|
||||
@ -450,6 +452,7 @@ static void
|
||||
nameserver_probe_failed(struct nameserver *const ns) {
|
||||
const struct timeval * timeout;
|
||||
(void) evtimer_del(&ns->timeout_event);
|
||||
CLEAR(&ns->timeout_event);
|
||||
if (ns->state == 1) {
|
||||
// This can happen if the nameserver acts in a way which makes us mark
|
||||
// it as bad and then starts sending good replies.
|
||||
@ -526,6 +529,7 @@ nameserver_up(struct nameserver *const ns) {
|
||||
log(EVDNS_LOG_WARN, "Nameserver %s is back up",
|
||||
debug_ntoa(ns->address));
|
||||
evtimer_del(&ns->timeout_event);
|
||||
CLEAR(&ns->timeout_event);
|
||||
ns->state = 1;
|
||||
ns->failed_times = 0;
|
||||
ns->timedout = 0;
|
||||
@ -557,6 +561,7 @@ request_finished(struct request *const req, struct request **head) {
|
||||
log(EVDNS_LOG_DEBUG, "Removing timeout for request %lx",
|
||||
(unsigned long) req);
|
||||
evtimer_del(&req->timeout_event);
|
||||
CLEAR(&req->timeout_event);
|
||||
|
||||
search_request_finished(req);
|
||||
global_requests_inflight--;
|
||||
@ -569,6 +574,7 @@ request_finished(struct request *const req, struct request **head) {
|
||||
// so everything gets free()ed when we:
|
||||
}
|
||||
|
||||
CLEAR(req);
|
||||
free(req);
|
||||
|
||||
evdns_requests_pump_waiting_queue();
|
||||
@ -975,6 +981,7 @@ err:
|
||||
free(server_req->base.questions[i]);
|
||||
free(server_req->base.questions);
|
||||
}
|
||||
CLEAR(server_req);
|
||||
free(server_req);
|
||||
}
|
||||
return -1;
|
||||
@ -1136,6 +1143,7 @@ server_port_flush(struct evdns_server_port *port)
|
||||
|
||||
// We have no more pending requests; stop listening for 'writeable' events.
|
||||
(void) event_del(&port->event);
|
||||
CLEAR(&port->event);
|
||||
event_set(&port->event, port->socket, EV_READ | EV_PERSIST,
|
||||
server_port_ready_callback, port);
|
||||
if (event_add(&port->event, NULL) < 0) {
|
||||
@ -1153,6 +1161,7 @@ nameserver_write_waiting(struct nameserver *ns, char waiting) {
|
||||
|
||||
ns->write_waiting = waiting;
|
||||
(void) event_del(&ns->event);
|
||||
CLEAR(&ns->event);
|
||||
event_set(&ns->event, ns->socket, EV_READ | (waiting ? EV_WRITE : 0) | EV_PERSIST,
|
||||
nameserver_ready_callback, ns);
|
||||
if (event_add(&ns->event, NULL) < 0) {
|
||||
@ -1380,6 +1389,7 @@ evdns_add_server_port(int socket, int is_tcp, evdns_request_callback_fn_type cb,
|
||||
struct evdns_server_port *port;
|
||||
if (!(port = malloc(sizeof(struct evdns_server_port))))
|
||||
return NULL;
|
||||
memset(port, 0, sizeof(struct evdns_server_port));
|
||||
|
||||
assert(!is_tcp); // TCP sockets not yet implemented
|
||||
port->socket = socket;
|
||||
@ -1438,8 +1448,10 @@ evdns_server_request_add_reply(struct evdns_server_request *_req, int section, c
|
||||
item = malloc(sizeof(struct server_reply_item));
|
||||
if (!item)
|
||||
return -1;
|
||||
CLEAR(item);
|
||||
item->next = NULL;
|
||||
if (!(item->name = strdup(name))) {
|
||||
CLEAR(item);
|
||||
free(item);
|
||||
return -1;
|
||||
}
|
||||
@ -1453,6 +1465,7 @@ evdns_server_request_add_reply(struct evdns_server_request *_req, int section, c
|
||||
if (item->is_name) {
|
||||
if (!(item->data = strdup(data))) {
|
||||
free(item->name);
|
||||
CLEAR(item);
|
||||
free(item);
|
||||
return -1;
|
||||
}
|
||||
@ -1460,6 +1473,7 @@ evdns_server_request_add_reply(struct evdns_server_request *_req, int section, c
|
||||
} else {
|
||||
if (!(item->data = malloc(datalen))) {
|
||||
free(item->name);
|
||||
CLEAR(item);
|
||||
free(item);
|
||||
return -1;
|
||||
}
|
||||
@ -1650,6 +1664,7 @@ evdns_server_request_respond(struct evdns_server_request *_req, int err)
|
||||
port->choked = 1;
|
||||
|
||||
(void) event_del(&port->event);
|
||||
CLEAR(&port->event);
|
||||
event_set(&port->event, port->socket, (port->closing?0:EV_READ) | EV_WRITE | EV_PERSIST, server_port_ready_callback, port);
|
||||
|
||||
if (event_add(&port->event, NULL) < 0) {
|
||||
@ -1689,6 +1704,7 @@ server_request_free_answers(struct server_request *req)
|
||||
free(victim->name);
|
||||
if (victim->data)
|
||||
free(victim->data);
|
||||
/* XXXX free(victim?) -NM */
|
||||
victim = next;
|
||||
}
|
||||
*list = NULL;
|
||||
@ -1716,8 +1732,9 @@ server_request_free(struct server_request *req)
|
||||
rc = --req->port->refcnt;
|
||||
}
|
||||
|
||||
if (req->response)
|
||||
if (req->response) {
|
||||
free(req->response);
|
||||
}
|
||||
|
||||
server_request_free_answers(req);
|
||||
|
||||
@ -1728,9 +1745,11 @@ server_request_free(struct server_request *req)
|
||||
|
||||
if (rc == 0) {
|
||||
server_port_free(req->port);
|
||||
CLEAR(req);
|
||||
free(req);
|
||||
return (1);
|
||||
}
|
||||
CLEAR(req);
|
||||
free(req);
|
||||
return (0);
|
||||
}
|
||||
@ -1747,6 +1766,8 @@ server_port_free(struct evdns_server_port *port)
|
||||
port->socket = -1;
|
||||
}
|
||||
(void) event_del(&port->event);
|
||||
CLEAR(&port->event);
|
||||
// XXXX actually free the port? -NM
|
||||
}
|
||||
|
||||
// exported function
|
||||
@ -1778,6 +1799,7 @@ evdns_request_timeout_callback(int fd, short events, void *arg) {
|
||||
}
|
||||
|
||||
(void) evtimer_del(&req->timeout_event);
|
||||
CLEAR(&req->timeout_event);
|
||||
if (req->tx_count >= global_max_retransmits) {
|
||||
// this request has failed
|
||||
reply_callback(req, 0, DNS_ERR_TIMEOUT, NULL);
|
||||
@ -1938,9 +1960,12 @@ evdns_clear_nameservers_and_suspend(void)
|
||||
while (1) {
|
||||
struct nameserver *next = server->next;
|
||||
(void) event_del(&server->event);
|
||||
CLEAR(&server->event);
|
||||
(void) evtimer_del(&server->timeout_event);
|
||||
CLEAR(&server->timeout_event);
|
||||
if (server->socket >= 0)
|
||||
CLOSE_SOCKET(server->socket);
|
||||
CLEAR(server);
|
||||
free(server);
|
||||
if (next == started_at)
|
||||
break;
|
||||
@ -1955,6 +1980,7 @@ evdns_clear_nameservers_and_suspend(void)
|
||||
req->ns = NULL;
|
||||
// ???? What to do about searches?
|
||||
(void) evtimer_del(&req->timeout_event);
|
||||
CLEAR(&req->timeout_event);
|
||||
req->trans_id = 0;
|
||||
req->transmit_me = 0;
|
||||
|
||||
@ -2054,6 +2080,7 @@ evdns_nameserver_add(unsigned long int address) {
|
||||
out2:
|
||||
CLOSE_SOCKET(ns->socket);
|
||||
out1:
|
||||
CLEAR(ns);
|
||||
free(ns);
|
||||
log(EVDNS_LOG_WARN, "Unable to add nameserver %s: error %d", debug_ntoa(address), err);
|
||||
return err;
|
||||
@ -2130,6 +2157,7 @@ request_new(int type, const char *name, int flags,
|
||||
|
||||
return req;
|
||||
err1:
|
||||
CLEAR(req);
|
||||
free(req);
|
||||
return NULL;
|
||||
}
|
||||
@ -2258,8 +2286,10 @@ search_state_decref(struct search_state *const state) {
|
||||
struct search_domain *next, *dom;
|
||||
for (dom = state->head; dom; dom = next) {
|
||||
next = dom->next;
|
||||
CLEAR(dom);
|
||||
free(dom);
|
||||
}
|
||||
CLEAR(state);
|
||||
free(state);
|
||||
}
|
||||
}
|
||||
@ -2911,6 +2941,7 @@ evdns_shutdown(int fail_requests)
|
||||
if (server->socket >= 0)
|
||||
CLOSE_SOCKET(server->socket);
|
||||
(void) event_del(&server->event);
|
||||
CLEAR(server);
|
||||
free(server);
|
||||
if (server_next == server_head)
|
||||
break;
|
||||
@ -2921,8 +2952,10 @@ evdns_shutdown(int fail_requests)
|
||||
if (global_search_state) {
|
||||
for (dom = global_search_state->head; dom; dom = dom_next) {
|
||||
dom_next = dom->next;
|
||||
CLEAR(dom);
|
||||
free(dom);
|
||||
}
|
||||
CLEAR(global_search_state);
|
||||
free(global_search_state);
|
||||
global_search_state = NULL;
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user