Skip to content

Fix memory leaks in password encoding error paths - #3739

Open
Sn0wyDay wants to merge 1 commit into
eclipse-mosquitto:fixesfrom
Sn0wyDay:fix-password-encode-oom-leaks
Open

Sn0wyDay wants to merge 1 commit into
eclipse-mosquitto:fixesfrom
Sn0wyDay:fix-password-encode-oom-leaks

Conversation

@Sn0wyDay

Copy link
Copy Markdown
  • Have you signed the Eclipse Contributor Agreement, using the same email address as you used in your commits?
  • Do each of your commits have a "Signed-off-by" line, with the correct email address?
  • If you are contributing a new feature, is your work based off the develop branch? (Not applicable: this is a bug fix.)
  • If you are contributing a bugfix, is your work based off the fixes branch?
  • Have you added an explanation of what your changes do and why you'd like us to include them?
  • Have you successfully run make test with your changes locally? (The full suite could not run locally because GTest, CUnit, and microsocks were unavailable; the focused password tests and sanitizer checks passed.)

pw__encode_sha512() and pw__encode_sha512_pbkdf2() leave their temporary Base64 buffers allocated on some allocation-failure paths. The SHA-512 path also leaves the encoded salt allocated when encoding the password hash fails.

Free the temporary buffers before returning from those paths. Successful password encoding is unchanged.

Validation:

  • Built the project with CMake on macOS.
  • Passed test/apps/passwd/passwd-args.py, passwd-stdout.py, and passwd-changes.py.
  • Exercised all three affected failure paths with Mosquitto's memory limit and memory tracking. Before this change, cleanup left 96, 192, and 192 bytes allocated on this platform; after this change, all three paths leave zero bytes allocated while preserving their return codes.
  • Repeated the failure-path checks in an AddressSanitizer and UndefinedBehaviorSanitizer build.

This bug fix is based on the fixes branch.

Signed-off-by: 안민기 <ancrs0527@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant