Skip to content

Commit

Permalink
Fix potential IPPacketInfo leak in LwIP code. (project-chip#22198)
Browse files Browse the repository at this point in the history
  • Loading branch information
bzbarsky-apple authored and isiu-apple committed Sep 16, 2022
1 parent 29a6d75 commit 178b3c5
Showing 1 changed file with 9 additions and 13 deletions.
22 changes: 9 additions & 13 deletions src/inet/UDPEndPointImplLwIP.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -367,10 +367,9 @@ void UDPEndPointImplLwIP::LwIPReceiveUDPMessage(void * arg, struct udp_pcb * pcb
{
return;
}
// Raw pointer is required for passing into lambda.
// The memory life cycle of `pktInfo` is manually managed.
IPPacketInfo * pktInfo = Platform::New<IPPacketInfo>();
if (pktInfo == nullptr)

auto pktInfo = Platform::MakeUnique<IPPacketInfo>();
if (pktInfo.get() == nullptr)
{
ChipLogError(Inet, "Cannot allocate packet info");
return;
Expand All @@ -391,20 +390,17 @@ void UDPEndPointImplLwIP::LwIPReceiveUDPMessage(void * arg, struct udp_pcb * pcb
pktInfo->SrcPort = port;
pktInfo->DestPort = pcb->local_port;

CHIP_ERROR err = ep->GetSystemLayer().ScheduleLambda([ep, p = System::LwIPPacketBufferView::UnsafeGetLwIPpbuf(buf), pktInfo] {
ep->HandleDataReceived(System::PacketBufferHandle::Adopt(p), pktInfo);
});
CHIP_ERROR err = ep->GetSystemLayer().ScheduleLambda(
[ep, p = System::LwIPPacketBufferView::UnsafeGetLwIPpbuf(buf), pktInfo = pktInfo.get()] {
ep->HandleDataReceived(System::PacketBufferHandle::Adopt(p), pktInfo);
});

if (err == CHIP_NO_ERROR)
{
// If ScheduleLambda() succeeded, it has ownership of the buffer, so we need to release it (without freeing it).
static_cast<void>(std::move(buf).UnsafeRelease());
}
else
{
// If ScheduleLambda() succeeded, `pktInfo` will be deleted in `HandleDataReceived`.
// Otherwise we delete it here.
Platform::Delete(pktInfo);
// Similarly, ScheduleLambda now has ownership of pktInfo.
pktInfo.release();
}
}

Expand Down

0 comments on commit 178b3c5

Please sign in to comment.