bugfix: memory leak in imtcp & subsystems under some circumstances

This leak is tied to error conditions which lead to incorrect cleanup
of some data structures.

1 files changed, 11 insertions, 6 deletions

diff --git a/tcpsrv.c b/tcpsrv.c
index a8f69512..adb23e60 100644
--- a/tcpsrv.c
+++ b/tcpsrv.c
@@ -564,16 +564,18 @@ finalize_it:
 static inline rsRetVal
 processWorksetItem(tcpsrv_t *pThis, nspoll_t *pPoll, int idx, void *pUsr)
 {
-	tcps_sess_t *pNewSess;
+	tcps_sess_t *pNewSess = NULL;
 	DEFiRet;
 
-	dbgprintf("tcpsrv: processing item %d, pUsr %p\n", idx, pUsr);
+	DBGPRINTF("tcpsrv: processing item %d, pUsr %p, bAbortConn\n", idx, pUsr);
 	if(pUsr == pThis->ppLstn) {
 		DBGPRINTF("New connect on NSD %p.\n", pThis->ppLstn[idx]);
 		iRet = SessAccept(pThis, pThis->ppLstnPort[idx], &pNewSess, pThis->ppLstn[idx]);
 		if(iRet == RS_RET_OK) {
-			if(pPoll != NULL)
+			if(pPoll != NULL) {
+				dbgprintf("XXXXXX: processWorksetItem trying nspoll.ctl\n");
 				CHKiRet(nspoll.Ctl(pPoll, pNewSess->pStrm, 0, pNewSess, NSDPOLL_IN, NSDPOLL_ADD));
+			}
 			DBGPRINTF("New session created with NSD %p.\n", pNewSess);
 		} else {
 			DBGPRINTF("tcpsrv: error %d during accept\n", iRet);
@@ -702,6 +704,7 @@ RunSelect(tcpsrv_t *pThis, nsd_epworkset_t workset[], size_t sizeWorkset)
 	int iTCPSess;
 	int bIsReady;
 	nssel_t *pSel = NULL;
+	rsRetVal localRet;
 
 	ISOBJ_TYPE_assert(pThis, tcpsrv);
 
@@ -758,8 +761,8 @@ RunSelect(tcpsrv_t *pThis, nsd_epworkset_t workset[], size_t sizeWorkset)
 		while(nfds && iTCPSess != -1) {
 			if(glbl.GetGlobalInputTermState() == 1)
 				ABORT_FINALIZE(RS_RET_FORCE_TERM);
-			CHKiRet(nssel.IsReady(pSel, pThis->pSessions[iTCPSess]->pStrm, NSDSEL_RD, &bIsReady, &nfds));
-			if(bIsReady) {
+			localRet = nssel.IsReady(pSel, pThis->pSessions[iTCPSess]->pStrm, NSDSEL_RD, &bIsReady, &nfds);
+			if(bIsReady || localRet != RS_RET_OK) {
 				workset[iWorkset].id = iTCPSess;
 				workset[iWorkset].pUsr = (void*) pThis->pSessions[iTCPSess];
 				++iWorkset;
@@ -783,7 +786,9 @@ finalize_it: /* this is a very special case - this time only we do not exit the
 	      * crashed, which made sense (the rest of the engine was not prepared for
 	      * that) -- rgerhards, 2008-05-19
 	      */
-		/*EMPTY*/;
+		if(pSel != NULL) { /* cleanup missing? happens during err exit! */
+			nssel.Destruct(&pSel);
+		}
 	}
 
 	/* note that this point is usually not reached */