Menu

#638 Memory leak vulnerability in source file "if2ip.c"

closed-fixed
nobody
None
5
2013-06-21
2007-04-12
songma
No

Hi,

I found there's one memory problem in source file "if2ip.c". In function "Curl_if2ip()" it has the following statements:

" 85 char *Curl_if2ip(const char *interface, char *buf, int buf_size)
86 {
87 int dummy;
88 char *ip=NULL;
89
90 if(!interface)
91 return NULL;
92
93 dummy = socket(AF_INET, SOCK_STREAM, 0);
94 if (SYS_ERROR == dummy) {
95 return NULL;
96 }
97 else {
98 struct ifreq req;
99 size_t len = strlen(interface);
100 memset(&req, 0, sizeof(req));
101 if(len >= sizeof(req.ifr_name))
102 return NULL; /* this can't be a fine interface name */
... ...
"

At line 93 it opened a socket and return the socket file descriptor. but at line 102, if the size of system interface name is bigger than the given size "
req.ifr_name" the function will exit and return NULL. However I think the function "Curl_if2ip" shall close the socket it opened at line 93 first thus to release all resource related with it. Otherwise this opened socket will never be closed by someone.

The fix may looks like:
101 if(len >= sizeof(req.ifr_name)) {
102 sclose(dummy);
103 return NULL; /* this can't be a fine interface name */
104 }

Best Regards,
Song Ma

Discussion

  • Daniel Stenberg

    Daniel Stenberg - 2007-04-12
    • status: open --> closed-fixed
     
  • Daniel Stenberg

    Daniel Stenberg - 2007-04-12

    Logged In: YES
    user_id=1110
    Originator: NO

    Thanks, fix committed!