[Fix] Multiple memory corruption fixes

diff --git a/src/fuzzy_storage.c b/src/fuzzy_storage.c
index bfa3f3abfacede60da71c4b9a261cef9903b4bbb..9738c3f63a5d967f92c7f079566a1bc948cd2a0e 100644 (file)
--- a/src/fuzzy_storage.c
+++ b/src/fuzzy_storage.c
@@ -225,8 +225,6 @@ fuzzy_key_stat_dtor (gpointer p)
        if (st->last_ips) {
                rspamd_lru_hash_destroy (st->last_ips);
        }
-
-       g_slice_free1 (sizeof (*st), st);
 }
 
 static void
@@ -237,8 +235,6 @@ fuzzy_key_dtor (gpointer p)
        if (key->stat) {
                fuzzy_key_stat_dtor (key->stat);
        }
-
-       g_slice_free1 (sizeof (*key), key);
 }
 
 static void
@@ -2031,7 +2027,7 @@ init_fuzzy (struct rspamd_config *cfg)
                        (rspamd_mempool_destruct_t)g_hash_table_unref, ctx->keys);
        ctx->master_flags = g_hash_table_new (g_direct_hash, g_direct_equal);
        rspamd_mempool_add_destructor (cfg->cfg_pool,
-                               (rspamd_mempool_destruct_t)g_hash_table_unref, ctx->master_flags);
+                       (rspamd_mempool_destruct_t)g_hash_table_unref, ctx->master_flags);
        ctx->errors_ips = rspamd_lru_hash_new_full (1024,
                        (GDestroyNotify) rspamd_inet_address_destroy, g_free,
                        rspamd_inet_address_hash, rspamd_inet_address_equal);
@@ -2425,7 +2421,6 @@ start_fuzzy (struct rspamd_worker *worker)
                rspamd_keypair_cache_destroy (ctx->keypair_cache);
        }
 
-       g_hash_table_unref (ctx->keys);
        REF_RELEASE (ctx->cfg);
 
        exit (EXIT_SUCCESS);

diff --git a/src/libmime/mime_expressions.c b/src/libmime/mime_expressions.c
index ad5be8c0cf3d35017d8f447c7208ad13ea2270c3..8a567245925270997e76b7ecf2d91dc1ec8d2a70 100644 (file)
--- a/src/libmime/mime_expressions.c
+++ b/src/libmime/mime_expressions.c
@@ -481,7 +481,6 @@ rspamd_mime_expr_parse_function_atom (rspamd_mempool_t *pool, const gchar *input
        res->name = rspamd_mempool_alloc (pool, obrace - input + 1);
        rspamd_strlcpy (res->name, input, obrace - input + 1);
        res->args = g_array_new (FALSE, FALSE, sizeof (struct expression_argument));
-       rspamd_mempool_add_destructor (pool, rspamd_array_free_hard, res->args);
 
        p = obrace + 1;
        c = p;
@@ -528,9 +527,6 @@ rspamd_mime_expr_parse_function_atom (rspamd_mempool_t *pool, const gchar *input
                                        arg.type = EXPRESSION_ARGUMENT_NORMAL;
                                        arg.data = databuf;
                                }
-                               else {
-                                       g_free (databuf);
-                               }
 
                                g_array_append_val (res->args, arg);
                                state = got_comma;
@@ -873,20 +869,10 @@ static void
 rspamd_mime_expr_destroy (rspamd_expression_atom_t *atom)
 {
        struct rspamd_mime_atom *mime_atom = atom->data;
-       guint i;
-       struct expression_argument *arg;
 
        if (mime_atom) {
                if (mime_atom->type == MIME_ATOM_INTERNAL_FUNCTION) {
                        /* Need to cleanup arguments */
-                       for (i = 0; i < mime_atom->d.func->args->len; i ++) {
-                               arg = &g_array_index (mime_atom->d.func->args,
-                                               struct expression_argument, i);
-
-                               if (arg->type == EXPRESSION_ARGUMENT_NORMAL) {
-                                       g_free (arg->data);
-                               }
-                       }
                        g_array_free (mime_atom->d.func->args, TRUE);
                }
        }