traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

socket: Fix memory leak in sendmsg() and sendmsg_afalg() 

Issue #27744:

* Release msg.msg_iov memory block.
* Release memory on PyMem_Malloc(controllen) failure
This commit is contained in:
Victor Stinner 2016-09-12 11:41:58 +02:00
parent 288b5bf624
commit 52d61e485e
1 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
Modules/socketmodule.c
View File

@ -4072,11 +4072,13 @@ sock_sendmsg(PySocketSockObject *s, PyObject *args)
if (ncmsgbufs > 0) {
struct cmsghdr *cmsgh = NULL;
if ((msg.msg_control = controlbuf =
PyMem_Malloc(controllen)) == NULL) {
controlbuf = PyMem_Malloc(controllen);
if (controlbuf == NULL) {
PyErr_NoMemory();
goto finally;
}
msg.msg_control = controlbuf;
msg.msg_controllen = controllen;
/* Need to zero out the buffer as a workaround for glibc's
@ -4141,8 +4143,10 @@ finally:
PyBuffer_Release(&cmsgs[i].data);
PyMem_Free(cmsgs);
Py_XDECREF(cmsg_fast);
for (i = 0; i < ndatabufs; i++)
PyMem_Free(msg.msg_iov);
for (i = 0; i < ndatabufs; i++) {
PyBuffer_Release(&databufs[i]);
}
PyMem_Free(databufs);
return retval;
}
@ -4243,7 +4247,8 @@ sock_sendmsg_afalg(PySocketSockObject *self, PyObject *args, PyObject *kwds)
controlbuf = PyMem_Malloc(controllen);
if (controlbuf == NULL) {
return PyErr_NoMemory();
PyErr_NoMemory();
goto finally;
}
memset(controlbuf, 0, controllen);
@ -4315,8 +4320,10 @@ sock_sendmsg_afalg(PySocketSockObject *self, PyObject *args, PyObject *kwds)
if (iv.buf != NULL) {
PyBuffer_Release(&iv);
}
for (i = 0; i < ndatabufs; i++)
PyMem_Free(msg.msg_iov);
for (i = 0; i < ndatabufs; i++) {
PyBuffer_Release(&databufs[i]);
}
PyMem_Free(databufs);
return retval;
}