[CritFix] Fix critical memory issues with radix maps

diff --git a/src/libutil/map.c b/src/libutil/map.c
index da99e384c0ef1479e307425cdf2156af8f04f146..11ef2c441da0f51770e0b572ef0949767c6ad236 100644 (file)
--- a/src/libutil/map.c
+++ b/src/libutil/map.c
@@ -2069,8 +2069,12 @@ static void
 radix_tree_insert_helper (gpointer st, gconstpointer key, gconstpointer value)
 {
        radix_compressed_t *tree = (radix_compressed_t *)st;
+       rspamd_mempool_t *pool;
+       gpointer nvalue;
 
-       rspamd_radix_add_iplist ((gchar *)key, ",", tree, value, FALSE);
+       pool = radix_get_pool (tree);
+       nvalue = rspamd_mempool_strdup (pool, value);
+       rspamd_radix_add_iplist (key, ",", tree, nvalue, FALSE);
 }
 
 static void

diff --git a/src/libutil/radix.c b/src/libutil/radix.c
index 8b1ca01c91ccae81ccc96ab921999b1194b288b9..b44391bfc5a886a9ac02e16739a593b41bc9b37f 100644 (file)
--- a/src/libutil/radix.c
+++ b/src/libutil/radix.c
@@ -163,6 +163,7 @@ rspamd_radix_add_iplist (const gchar *list, const gchar *separators,
        struct in_addr ina;
        struct in6_addr ina6;
        guint k = G_MAXINT;
+       gpointer key;
        gint af;
        gint res = 0, r;
        struct addrinfo hints, *ai_res, *cur_ai;
@@ -246,8 +247,12 @@ rspamd_radix_add_iplist (const gchar *list, const gchar *separators,
                                                                        k = 32;
                                                                }
 
+                                                               key = rspamd_mempool_alloc (tree->pool,
+                                                                               sizeof (sin->sin_addr));
+                                                               memcpy (key, &sin->sin_addr,
+                                                                               sizeof (sin->sin_addr));
                                                                radix_insert_compressed (tree,
-                                                                               (guint8 *)&sin->sin_addr,
+                                                                               key,
                                                                                sizeof (sin->sin_addr),
                                                                                32 - k, (uintptr_t)value);
                                                                res ++;
@@ -260,8 +265,13 @@ rspamd_radix_add_iplist (const gchar *list, const gchar *separators,
                                                                        k = 128;
                                                                }
 
+
+                                                               key = rspamd_mempool_alloc (tree->pool,
+                                                                               sizeof (sin6->sin6_addr));
+                                                               memcpy (key, &sin6->sin6_addr,
+                                                                               sizeof (sin6->sin6_addr));
                                                                radix_insert_compressed (tree,
-                                                                               (guint8 *)&sin6->sin6_addr,
+                                                                               key,
                                                                                sizeof (sin6->sin6_addr),
                                                                                128 - k, (uintptr_t)value);
                                                                res ++;
@@ -292,7 +302,10 @@ rspamd_radix_add_iplist (const gchar *list, const gchar *separators,
                                k = 32;
                        }
 
-                       radix_insert_compressed (tree, (guint8 *)&ina, sizeof (ina),
+
+                       key = rspamd_mempool_alloc (tree->pool, sizeof (ina));
+                       memcpy (key, &ina, sizeof (ina));
+                       radix_insert_compressed (tree, key, sizeof (ina),
                                        32 - k, (uintptr_t)value);
                        res ++;
                }
@@ -300,6 +313,9 @@ rspamd_radix_add_iplist (const gchar *list, const gchar *separators,
                        if (k > 128) {
                                k = 128;
                        }
+
+                       key = rspamd_mempool_alloc (tree->pool, sizeof (ina6));
+                       memcpy (key, &ina6, sizeof (ina6));
                        radix_insert_compressed (tree, (guint8 *)&ina6, sizeof (ina6),
                                        128 - k, (uintptr_t)value);
                        res ++;