From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Wed, 18 Jan 2017 13:44:14 +0000 (+0000)
Subject: [Fix] Multiple memory corruption fixes
X-Git-Tag: 1.5.0~312
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=3a3a6f161bd5dd6c3452d103b7ac5e3b7a0932e6;p=rspamd.git

[Fix] Multiple memory corruption fixes
---

diff --git a/src/fuzzy_storage.c b/src/fuzzy_storage.c
index bfa3f3abf..9738c3f63 100644
--- a/src/fuzzy_storage.c
+++ b/src/fuzzy_storage.c
@@ -225,8 +225,6 @@ fuzzy_key_stat_dtor (gpointer p)
 	if (st->last_ips) {
 		rspamd_lru_hash_destroy (st->last_ips);
 	}
-
-	g_slice_free1 (sizeof (*st), st);
 }
 
 static void
@@ -237,8 +235,6 @@ fuzzy_key_dtor (gpointer p)
 	if (key->stat) {
 		fuzzy_key_stat_dtor (key->stat);
 	}
-
-	g_slice_free1 (sizeof (*key), key);
 }
 
 static void
@@ -2031,7 +2027,7 @@ init_fuzzy (struct rspamd_config *cfg)
 			(rspamd_mempool_destruct_t)g_hash_table_unref, ctx->keys);
 	ctx->master_flags = g_hash_table_new (g_direct_hash, g_direct_equal);
 	rspamd_mempool_add_destructor (cfg->cfg_pool,
-				(rspamd_mempool_destruct_t)g_hash_table_unref, ctx->master_flags);
+			(rspamd_mempool_destruct_t)g_hash_table_unref, ctx->master_flags);
 	ctx->errors_ips = rspamd_lru_hash_new_full (1024,
 			(GDestroyNotify) rspamd_inet_address_destroy, g_free,
 			rspamd_inet_address_hash, rspamd_inet_address_equal);
@@ -2425,7 +2421,6 @@ start_fuzzy (struct rspamd_worker *worker)
 		rspamd_keypair_cache_destroy (ctx->keypair_cache);
 	}
 
-	g_hash_table_unref (ctx->keys);
 	REF_RELEASE (ctx->cfg);
 
 	exit (EXIT_SUCCESS);
diff --git a/src/libmime/mime_expressions.c b/src/libmime/mime_expressions.c
index ad5be8c0c..8a5672459 100644
--- a/src/libmime/mime_expressions.c
+++ b/src/libmime/mime_expressions.c
@@ -481,7 +481,6 @@ rspamd_mime_expr_parse_function_atom (rspamd_mempool_t *pool, const gchar *input
 	res->name = rspamd_mempool_alloc (pool, obrace - input + 1);
 	rspamd_strlcpy (res->name, input, obrace - input + 1);
 	res->args = g_array_new (FALSE, FALSE, sizeof (struct expression_argument));
-	rspamd_mempool_add_destructor (pool, rspamd_array_free_hard, res->args);
 
 	p = obrace + 1;
 	c = p;
@@ -528,9 +527,6 @@ rspamd_mime_expr_parse_function_atom (rspamd_mempool_t *pool, const gchar *input
 					arg.type = EXPRESSION_ARGUMENT_NORMAL;
 					arg.data = databuf;
 				}
-				else {
-					g_free (databuf);
-				}
 
 				g_array_append_val (res->args, arg);
 				state = got_comma;
@@ -873,20 +869,10 @@ static void
 rspamd_mime_expr_destroy (rspamd_expression_atom_t *atom)
 {
 	struct rspamd_mime_atom *mime_atom = atom->data;
-	guint i;
-	struct expression_argument *arg;
 
 	if (mime_atom) {
 		if (mime_atom->type == MIME_ATOM_INTERNAL_FUNCTION) {
 			/* Need to cleanup arguments */
-			for (i = 0; i < mime_atom->d.func->args->len; i ++) {
-				arg = &g_array_index (mime_atom->d.func->args,
-						struct expression_argument, i);
-
-				if (arg->type == EXPRESSION_ARGUMENT_NORMAL) {
-					g_free (arg->data);
-				}
-			}
 			g_array_free (mime_atom->d.func->args, TRUE);
 		}
 	}