Resolve memory leak in cronet_transport

1 files changed, 20 insertions, 0 deletions

diff --git a/src/core/ext/transport/cronet/transport/cronet_transport.c b/src/core/ext/transport/cronet/transport/cronet_transport.c
index 366690acf2..1a731f5885 100644
--- a/src/core/ext/transport/cronet/transport/cronet_transport.c
+++ b/src/core/ext/transport/cronet/transport/cronet_transport.c
@@ -341,6 +341,11 @@ static void on_failed(cronet_bidirectional_stream *stream, int net_error) {
     gpr_free(s->state.ws.write_buffer);
     s->state.ws.write_buffer = NULL;
   }
+  if (s->state.rs.read_buffer &&
+      s->state.rs.read_buffer != s->state.rs.grpc_header_bytes) {
+    gpr_free(s->state.rs.read_buffer);
+    s->state.rs.read_buffer = NULL;
+  }
   gpr_mu_unlock(&s->mu);
   execute_from_storage(s);
 }
@@ -363,6 +368,11 @@ static void on_canceled(cronet_bidirectional_stream *stream) {
     gpr_free(s->state.ws.write_buffer);
     s->state.ws.write_buffer = NULL;
   }
+  if (s->state.rs.read_buffer &&
+      s->state.rs.read_buffer != s->state.rs.grpc_header_bytes) {
+    gpr_free(s->state.rs.read_buffer);
+    s->state.rs.read_buffer = NULL;
+  }
   gpr_mu_unlock(&s->mu);
   execute_from_storage(s);
 }
@@ -377,6 +387,11 @@ static void on_succeeded(cronet_bidirectional_stream *stream) {
   cronet_bidirectional_stream_destroy(s->cbs);
   s->state.state_callback_received[OP_SUCCEEDED] = true;
   s->cbs = NULL;
+  if (s->state.rs.read_buffer &&
+      s->state.rs.read_buffer != s->state.rs.grpc_header_bytes) {
+    gpr_free(s->state.rs.read_buffer);
+    s->state.rs.read_buffer = NULL;
+  }
   gpr_mu_unlock(&s->mu);
   execute_from_storage(s);
 }
@@ -901,6 +916,11 @@ static enum e_op_result execute_stream_op(grpc_exec_ctx *exec_ctx,
       uint8_t *dst_p = GPR_SLICE_START_PTR(read_data_slice);
       memcpy(dst_p, stream_state->rs.read_buffer,
              (size_t)stream_state->rs.length_field);
+      if (stream_state.rs.read_buffer &&
+          stream_state.rs.read_buffer != stream_state.rs.grpc_header_bytes) {
+        gpr_free(stream_state.rs.read_buffer);
+        stream_state.rs.read_buffer = NULL;
+      }
       gpr_slice_buffer_init(&stream_state->rs.read_slice_buffer);
       gpr_slice_buffer_add(&stream_state->rs.read_slice_buffer,
                            read_data_slice);