From 9dc5d874a052df26fee1fd3c745bd7cd33bae8f9 Mon Sep 17 00:00:00 2001 From: Donatas Abraitis Date: Tue, 14 Mar 2023 11:03:53 +0200 Subject: [PATCH] bgpd: Free memory allocated by ecommunity_ecom2str() Return local string, copied from returned value of ecom2str. ``` ./bgp_snmp_mplsl3vpn.test_bgp_snmp_mplsvpn/r1.bgpd.asan.2925690:Direct leak of 528 byte(s) in 8 object(s) allocated from: ./bgp_snmp_mplsl3vpn.test_bgp_snmp_mplsvpn/r1.bgpd.asan.2925690- 0 0x7efcde5d6037 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 ./bgp_snmp_mplsl3vpn.test_bgp_snmp_mplsvpn/r1.bgpd.asan.2925690- 1 0x7efcde1dc7e2 in qcalloc lib/memory.c:105 ./bgp_snmp_mplsl3vpn.test_bgp_snmp_mplsvpn/r1.bgpd.asan.2925690- 2 0x5628a0592704 in ecommunity_ecom2str bgpd/bgp_ecommunity.c:947 ./bgp_snmp_mplsl3vpn.test_bgp_snmp_mplsvpn/r1.bgpd.asan.2925690- 3 0x7efcdaa558c8 in mplsL3vpnVrfRtTable bgpd/bgp_mplsvpn_snmp.c:1152 ./bgp_snmp_mplsl3vpn.test_bgp_snmp_mplsvpn/r1.bgpd.asan.2925690- 4 0x7efcda784139 in netsnmp_old_api_helper helpers/old_api.c:332 ./bgp_snmp_mplsl3vpn.test_bgp_snmp_mplsvpn/r1.bgpd.asan.2925690- ./bgp_snmp_mplsl3vpn.test_bgp_snmp_mplsvpn/r1.bgpd.asan.2925690-SUMMARY: AddressSanitizer: 528 byte(s) leaked in 8 allocation(s). ``` Signed-off-by: Donatas Abraitis --- bgpd/bgp_mplsvpn_snmp.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/bgpd/bgp_mplsvpn_snmp.c b/bgpd/bgp_mplsvpn_snmp.c index 9b2ab66806..8453133dff 100644 --- a/bgpd/bgp_mplsvpn_snmp.c +++ b/bgpd/bgp_mplsvpn_snmp.c @@ -1124,7 +1124,8 @@ static uint8_t *mplsL3vpnVrfRtTable(struct variable *v, oid name[], struct bgp *l3vpn_bgp; uint32_t rt_index = 0; uint8_t rt_type = 0; - char *rt_b; + char *rt_b = NULL; + static char rt_b_str[BUFSIZ] = {}; if (smux_header_table(v, name, length, exact, var_len, write_method) == MATCH_FAILED) @@ -1156,14 +1157,16 @@ static uint8_t *mplsL3vpnVrfRtTable(struct variable *v, oid name[], ECOMMUNITY_ROUTE_TARGET); break; default: - rt_b = NULL; break; } - if (rt_b) + if (rt_b) { *var_len = strnlen(rt_b, ECOMMUNITY_STRLEN); - else + strlcpy(rt_b_str, rt_b, sizeof(rt_b_str)); + XFREE(MTYPE_ECOMMUNITY_STR, rt_b); + } else { *var_len = 0; - return (uint8_t *)rt_b; + } + return (uint8_t *)rt_b_str; case MPLSL3VPNVRFRTDESCR: /* since we dont have a description generate one */ memset(rt_description, 0, VRF_NAMSIZ + RT_PREAMBLE_SIZE);