coydog/zmap-freebsd
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix strdup/malloc/free ordering to always free the right pointer.

Browse Source 
This commit ensures that udp_send_msg is freed before being reallocated
and freed before the process exits. This also changes the last fprintf
to a log_warn() call, which should be more inline with the intent.
This commit is contained in:
HD Moore 2013-08-17 20:52:43 -05:00
parent aeac7d291d
commit d57091dcbf
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/probe_modules/module_udp.c
View File

@ -29,10 +29,10 @@
#define MAX_UDP_PAYLOAD_LEN 1472 #define MAX_UDP_PAYLOAD_LEN 1472
char *udp_send_msg = NULL; // Must be null-terminated char *udp_send_msg = NULL;
int udp_send_msg_len = 0; int udp_send_msg_len = 0;
const char *udp_send_msg_default = "GET / HTTP/1.1\r\n\r\n"; const char *udp_send_msg_default = "GET / HTTP/1.1\r\nHost: www\r\n\r\n";
static int num_ports = 1; static int num_ports = 1;
@ -66,6 +66,7 @@ int udp_global_initialize(struct state_conf * zconf) {
*c++ = 0; *c++ = 0;
if (strcmp(args, "text") == 0) { if (strcmp(args, "text") == 0) {
free(udp_send_msg);
udp_send_msg = strdup(c); udp_send_msg = strdup(c);
udp_send_msg_len = strlen(udp_send_msg); udp_send_msg_len = strlen(udp_send_msg);
@ -77,10 +78,10 @@ int udp_global_initialize(struct state_conf * zconf) {
log_fatal("udp", "could not open UDP data file '%s'\n", c); log_fatal("udp", "could not open UDP data file '%s'\n", c);
exit(1); exit(1);
} }
free(udp_send_msg);
udp_send_msg = malloc(MAX_UDP_PAYLOAD_LEN); udp_send_msg = malloc(MAX_UDP_PAYLOAD_LEN);
if (! udp_send_msg) { if (! udp_send_msg) {
free(args); free(args);
free(udp_send_msg);
log_fatal("udp", "failed to malloc payload buffer"); log_fatal("udp", "failed to malloc payload buffer");
exit(1); exit(1);
} }
@ -89,10 +90,10 @@ int udp_global_initialize(struct state_conf * zconf) {
} else if (strcmp(args, "hex") == 0) { } else if (strcmp(args, "hex") == 0) {
udp_send_msg_len = strlen(c) / 2; udp_send_msg_len = strlen(c) / 2;
free(udp_send_msg);
udp_send_msg = malloc(udp_send_msg_len); udp_send_msg = malloc(udp_send_msg_len);
if (! udp_send_msg) { if (! udp_send_msg) {
free(args); free(args);
free(udp_send_msg);
log_fatal("udp", "failed to malloc payload buffer"); log_fatal("udp", "failed to malloc payload buffer");
exit(1); exit(1);
} }
@ -108,12 +109,13 @@ int udp_global_initialize(struct state_conf * zconf) {
} }
} else { } else {
log_fatal("udp", "unknown UDP probe specification (expected file:/path, text:STRING, or hex:01020304)"); log_fatal("udp", "unknown UDP probe specification (expected file:/path, text:STRING, or hex:01020304)");
free(udp_send_msg);
free(args); free(args);
exit(1); exit(1);
} }
if (udp_send_msg_len > MAX_UDP_PAYLOAD_LEN) { if (udp_send_msg_len > MAX_UDP_PAYLOAD_LEN) {
fprintf(stderr, "warning: reducing UDP payload to %d bytes (from %d) to fit on the wire\n", log_warn("udp", "warning: reducing UDP payload to %d bytes (from %d) to fit on the wire\n",
MAX_UDP_PAYLOAD_LEN, udp_send_msg_len); MAX_UDP_PAYLOAD_LEN, udp_send_msg_len);
udp_send_msg_len = MAX_UDP_PAYLOAD_LEN; udp_send_msg_len = MAX_UDP_PAYLOAD_LEN;
} }