diff options
author | 2017-07-31 19:48:11 -0700 | |
---|---|---|
committer | 2017-07-31 19:48:11 -0700 | |
commit | c073e43488dccdd94a078d28e8b2c0d6c2008acf (patch) | |
tree | 2869e3161c70aabbb830d02d59c9001fca52c9be /src/core | |
parent | 6ba3dff070d21819ee1801fcf3ed5040a9fe062d (diff) | |
parent | e6432bf3539e4928edfee27badc93d31eabec148 (diff) |
Merge pull request #12008 from ncteisen/fuzz-direct-leak-in-malloc
Fix leak if duplicated static metadata
Diffstat (limited to 'src/core')
-rw-r--r-- | src/core/lib/surface/call.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/src/core/lib/surface/call.c b/src/core/lib/surface/call.c index c57d0894c2..00ec9c7c9a 100644 --- a/src/core/lib/surface/call.c +++ b/src/core/lib/surface/call.c @@ -825,7 +825,7 @@ uint32_t grpc_call_test_only_get_encodings_accepted_by_peer(grpc_call *call) { return encodings_accepted_by_peer; } -static grpc_linked_mdelem *linked_from_md(grpc_metadata *md) { +static grpc_linked_mdelem *linked_from_md(const grpc_metadata *md) { return (grpc_linked_mdelem *)&md->internal_data; } @@ -849,7 +849,7 @@ static int prepare_application_metadata( for (i = 0; i < total_count; i++) { const grpc_metadata *md = get_md_elem(metadata, additional_metadata, i, count); - grpc_linked_mdelem *l = (grpc_linked_mdelem *)&md->internal_data; + grpc_linked_mdelem *l = linked_from_md(md); GPR_ASSERT(sizeof(grpc_linked_mdelem) == sizeof(md->internal_data)); if (!GRPC_LOG_IF_ERROR("validate_metadata", grpc_validate_header_key_is_legal(md->key))) { @@ -866,7 +866,7 @@ static int prepare_application_metadata( for (int j = 0; j < i; j++) { const grpc_metadata *md = get_md_elem(metadata, additional_metadata, j, count); - grpc_linked_mdelem *l = (grpc_linked_mdelem *)&md->internal_data; + grpc_linked_mdelem *l = linked_from_md(md); GRPC_MDELEM_UNREF(exec_ctx, l->md); } return 0; @@ -884,9 +884,12 @@ static int prepare_application_metadata( } for (i = 0; i < total_count; i++) { grpc_metadata *md = get_md_elem(metadata, additional_metadata, i, count); - GRPC_LOG_IF_ERROR( - "prepare_application_metadata", - grpc_metadata_batch_link_tail(exec_ctx, batch, linked_from_md(md))); + grpc_linked_mdelem *l = linked_from_md(md); + grpc_error *error = grpc_metadata_batch_link_tail(exec_ctx, batch, l); + if (error != GRPC_ERROR_NONE) { + GRPC_MDELEM_UNREF(exec_ctx, l->md); + } + GRPC_LOG_IF_ERROR("prepare_application_metadata", error); } call->send_extra_metadata_count = 0; |