Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-12 10:40:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1021335: Fix DataChannel leak of recv buffers from SCTP r=tuexen

Browse Source
This commit is contained in:
Randell Jesup 2014-06-08 09:53:13 -04:00
parent 539d95f87e
commit 63f0d0928d
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
netwerk/sctp/datachannel/DataChannel.cpp
View File

@ -1318,6 +1318,7 @@ DataChannelConnection::HandleDataMessage(uint32_t ppid,
// Since this is rare and non-performance, keep a single list of queued
// data messages to deliver once the channel opens.
LOG(("Queuing data for stream %u, length %u", stream, length));
// Copies data
mQueuedData.AppendElement(new QueuedDataMessage(stream, ppid, data, length));
return;
}
@ -1326,7 +1327,7 @@ DataChannelConnection::HandleDataMessage(uint32_t ppid,
NS_ENSURE_TRUE_VOID(channel->mState != CLOSED);
{
nsAutoCString recvData(buffer, length);
nsAutoCString recvData(buffer, length); // copies (<64) or allocates
bool is_binary = true;
if (ppid == DATA_CHANNEL_PPID_DOMSTRING ||
@ -1933,6 +1934,11 @@ DataChannelConnection::ReceiveCallback(struct socket* sock, void *data, size_t d
HandleMessage(data, datalen, ntohl(rcv.rcv_ppid), rcv.rcv_sid);
}
}
// sctp allocates 'data' with malloc(), and expects the receiver to free
// it (presumably with free).
// XXX future optimization: try to deliver messages without an internal
// alloc/copy, and if so delay the free until later.
free(data);
// usrsctp defines the callback as returning an int, but doesn't use it
return 1;
}