From b1971d89c8776f06ddce7f44d98dde79c3dfc223 Mon Sep 17 00:00:00 2001
From: Roger Dingledine <arma@torproject.org>
Date: Wed, 3 Oct 2012 13:15:27 -0400
Subject: [PATCH] properly free the return values of rate_limit_log()

resolves bug 7022.
---
 changes/bug7022       |  3 +++
 src/or/circuitbuild.c | 27 ++++++++++++++++++---------
 2 files changed, 21 insertions(+), 9 deletions(-)
 create mode 100644 changes/bug7022

diff --git a/changes/bug7022 b/changes/bug7022
new file mode 100644
index 0000000000..10ac354724
--- /dev/null
+++ b/changes/bug7022
@@ -0,0 +1,3 @@
+  o Minor bugfixes:
+    - Fix memory leaks whenever we logged any message about the "path
+      bias" detection. Fixes bug 7022; bugfix on 0.2.3.21-rc.
diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c
index ffc7b5eaf8..a7d370c0ea 100644
--- a/src/or/circuitbuild.c
+++ b/src/or/circuitbuild.c
@@ -2655,12 +2655,13 @@ pathbias_count_first_hop(origin_circuit_t *circ)
               approx_time()))) {
         log_info(LD_BUG,
                "One-hop circuit has length %d. Path state is %s. "
-               "Circuit is a %s currently %s. %s",
+               "Circuit is a %s currently %s.%s",
                circ->build_state->desired_path_len,
                pathbias_state_to_string(circ->path_state),
                circuit_purpose_to_string(circ->_base.purpose),
                circuit_state_to_string(circ->_base.state),
                rate_msg);
+        tor_free(rate_msg);
       }
       tor_fragile_assert();
     }
@@ -2674,11 +2675,12 @@ pathbias_count_first_hop(origin_circuit_t *circ)
                                      approx_time()))) {
         log_info(LD_BUG,
                 "Opened circuit is in strange path state %s. "
-                "Circuit is a %s currently %s. %s",
+                "Circuit is a %s currently %s.%s",
                 pathbias_state_to_string(circ->path_state),
                 circuit_purpose_to_string(circ->_base.purpose),
                 circuit_state_to_string(circ->_base.state),
                 rate_msg);
+        tor_free(rate_msg);
       }
     }
 
@@ -2701,11 +2703,12 @@ pathbias_count_first_hop(origin_circuit_t *circ)
                   approx_time()))) {
             log_info(LD_BUG,
                    "Unopened circuit has strange path state %s. "
-                   "Circuit is a %s currently %s. %s",
+                   "Circuit is a %s currently %s.%s",
                    pathbias_state_to_string(circ->path_state),
                    circuit_purpose_to_string(circ->_base.purpose),
                    circuit_state_to_string(circ->_base.state),
                    rate_msg);
+            tor_free(rate_msg);
           }
         }
       } else {
@@ -2713,10 +2716,11 @@ pathbias_count_first_hop(origin_circuit_t *circ)
                 approx_time()))) {
           log_info(LD_BUG,
               "Unopened circuit has no known guard. "
-              "Circuit is a %s currently %s. %s",
+              "Circuit is a %s currently %s.%s",
               circuit_purpose_to_string(circ->_base.purpose),
               circuit_state_to_string(circ->_base.state),
               rate_msg);
+          tor_free(rate_msg);
         }
       }
     }
@@ -2727,12 +2731,13 @@ pathbias_count_first_hop(origin_circuit_t *circ)
                 approx_time()))) {
         log_info(LD_BUG,
             "A %s circuit is in cpath state %d (opened: %d). "
-            "Circuit is a %s currently %s. %s",
+            "Circuit is a %s currently %s.%s",
             pathbias_state_to_string(circ->path_state),
             circ->cpath->state, circ->has_opened,
             circuit_purpose_to_string(circ->_base.purpose),
             circuit_state_to_string(circ->_base.state),
             rate_msg);
+        tor_free(rate_msg);
       }
     }
   }
@@ -2765,12 +2770,13 @@ pathbias_count_success(origin_circuit_t *circ)
               approx_time()))) {
         log_info(LD_BUG,
                "One-hop circuit has length %d. Path state is %s. "
-               "Circuit is a %s currently %s. %s",
+               "Circuit is a %s currently %s.%s",
                circ->build_state->desired_path_len,
                pathbias_state_to_string(circ->path_state),
                circuit_purpose_to_string(circ->_base.purpose),
                circuit_state_to_string(circ->_base.state),
                rate_msg);
+        tor_free(rate_msg);
       }
       tor_fragile_assert();
     }
@@ -2795,11 +2801,12 @@ pathbias_count_success(origin_circuit_t *circ)
                 approx_time()))) {
           log_info(LD_BUG,
               "Succeeded circuit is in strange path state %s. "
-              "Circuit is a %s currently %s. %s",
+              "Circuit is a %s currently %s.%s",
               pathbias_state_to_string(circ->path_state),
               circuit_purpose_to_string(circ->_base.purpose),
               circuit_state_to_string(circ->_base.state),
               rate_msg);
+          tor_free(rate_msg);
         }
       }
 
@@ -2814,10 +2821,11 @@ pathbias_count_success(origin_circuit_t *circ)
               approx_time()))) {
         log_info(LD_BUG,
             "Completed circuit has no known guard. "
-            "Circuit is a %s currently %s. %s",
+            "Circuit is a %s currently %s.%s",
             circuit_purpose_to_string(circ->_base.purpose),
             circuit_state_to_string(circ->_base.state),
             rate_msg);
+        tor_free(rate_msg);
       }
     }
   } else {
@@ -2826,11 +2834,12 @@ pathbias_count_success(origin_circuit_t *circ)
               approx_time()))) {
         log_info(LD_BUG,
             "Opened circuit is in strange path state %s. "
-            "Circuit is a %s currently %s. %s",
+            "Circuit is a %s currently %s.%s",
             pathbias_state_to_string(circ->path_state),
             circuit_purpose_to_string(circ->_base.purpose),
             circuit_state_to_string(circ->_base.state),
             rate_msg);
+        tor_free(rate_msg);
       }
     }
   }