Add to free 'msg', 'creds', and 'source' due to memory leak issue

Change-Id: Iea97415f5e4c8abfb963cb5906882dc0dbc6ccaf

diff --git a/packaging/capi-media-controller.spec b/packaging/capi-media-controller.spec
index 4cbe5b3690825061690e14c1841d15c7846a8a5d..f541d64acc96006a4eba46f731443bb0edcac016 100644 (file)
--- a/packaging/capi-media-controller.spec
+++ b/packaging/capi-media-controller.spec
@@ -1,6 +1,6 @@
 Name:       capi-media-controller
 Summary:    A media controller library in Tizen Native API
-Version:    0.2.0
+Version:    0.2.1
 Release:    1
 Group:      Multimedia/API
 License:    Apache-2.0

diff --git a/svc/media_controller_svc.c b/svc/media_controller_svc.c
index 73577e483842d65175e5bb5af2e4fa15edf85264..6e21a8f7ccc349ae01830fbc709248d78db3c4c5 100644 (file)
--- a/svc/media_controller_svc.c
+++ b/svc/media_controller_svc.c
@@ -31,7 +31,6 @@
 
 static GMainLoop *g_mc_svc_mainloop = NULL;
 static int g_connection_cnt = -1;
-static int g_queue_work = 0;
 
 typedef struct {
        int client_sock;
@@ -539,15 +538,16 @@ gboolean _mc_service_process(gpointer data)
 
        if (length_of_queue <= 0) {
                mc_debug("There is no request job in the queue");
-               g_queue_work = 0;
-               return FALSE;
+               g_source_unref(_service_data->request->source);
+               _service_data->request->source = NULL;
+               return G_SOURCE_REMOVE;
        }
 
        mc_service_request *req = NULL;
        req = (mc_service_request *) g_queue_pop_head(request_queue);
        if (req == NULL) {
                mc_error("Failed to get a request job from queue");
-               return TRUE;
+               return G_SOURCE_CONTINUE;
        }
 
        mc_comm_msg_s *request_msg = req->req_msg;
@@ -613,17 +613,18 @@ ERROR:
        if (close(req->client_sock) < 0)
                mc_stderror("close failed");
 
+       if (req->req_msg != NULL)
+               MC_SAFE_FREE(req->req_msg->msg);
        MC_SAFE_FREE(req->req_msg);
        MC_SAFE_FREE(req);
 
-       return TRUE;
+       return G_SOURCE_CONTINUE;
 }
 
 gboolean _mc_read_service_request_tcp_socket(GIOChannel *src, GIOCondition condition, gpointer data)
 {
        int sock = -1;
        int client_sock = -1;
-       mc_comm_msg_s recv_msg;
        int ret = MEDIA_CONTROLLER_ERROR_NONE;
        int send_msg = MEDIA_CONTROLLER_ERROR_NONE;
        mc_service_request *req = NULL;
@@ -653,20 +654,27 @@ gboolean _mc_read_service_request_tcp_socket(GIOChannel *src, GIOCondition condi
                goto ERROR;
        }
 
+       req->req_msg = (mc_comm_msg_s *) calloc(1, sizeof(mc_comm_msg_s));
+       if (req->req_msg == NULL) {
+               mc_error("memory allocation is failed");
+               send_msg = MEDIA_CONTROLLER_ERROR_OUT_OF_MEMORY;
+               goto ERROR;
+       }
+
        req->client_sock = client_sock;
-       ret = mc_cynara_receive_untrusted_message(req->client_sock, &recv_msg, &creds);
+       ret = mc_cynara_receive_untrusted_message(req->client_sock, req->req_msg, &creds);
        if (ret != MEDIA_CONTROLLER_ERROR_NONE) {
                mc_error("mc_ipc_receive_message_tcp failed [%d]", ret);
                send_msg = ret;
                goto ERROR;
        }
 
-       if (recv_msg.priv_type == MC_PRIV_TYPE_SERVER) {
+       if (req->req_msg->priv_type == MC_PRIV_TYPE_SERVER) {
                ret = mc_cynara_check(&creds, MC_SERVER_PRIVILEGE);
-       } else if (recv_msg.priv_type == MC_PRIV_TYPE_CLIENT) {
+       } else if (req->req_msg->priv_type == MC_PRIV_TYPE_CLIENT) {
                ret = mc_cynara_check(&creds, MC_CLIENT_PRIVILEGE);
        } else {
-               mc_error("wroing priv_type[%d]", recv_msg.priv_type);
+               mc_error("wroing priv_type[%d]", req->req_msg->priv_type);
                send_msg = MEDIA_CONTROLLER_ERROR_INVALID_OPERATION;
                goto ERROR;
        }
@@ -677,44 +685,31 @@ gboolean _mc_read_service_request_tcp_socket(GIOChannel *src, GIOCondition condi
                goto ERROR;
        }
 
-       if (recv_msg.msg_type >= 0 && recv_msg.msg_type < MC_MSG_MAX) {
-               if (g_queue_get_length(request_queue) >= MAX_MC_REQUEST) {
-                       send_msg = MEDIA_CONTROLLER_ERROR_INVALID_OPERATION;
-                       goto ERROR;
-               }
-
-               req->req_msg = (mc_comm_msg_s *) calloc(1, sizeof(mc_comm_msg_s));
-               if (req->req_msg == NULL) {
-                       send_msg = MEDIA_CONTROLLER_ERROR_OUT_OF_MEMORY;
-                       goto ERROR;
-               }
-               memcpy(req->req_msg, &recv_msg, sizeof(mc_comm_msg_s) - sizeof(recv_msg.msg));
-
-               if (recv_msg.msg_size > 0) {
-                       req->req_msg->msg = (char *) calloc(1, recv_msg.msg_size + 1);
-                       if (req->req_msg->msg == NULL) {
-                               send_msg = MEDIA_CONTROLLER_ERROR_OUT_OF_MEMORY;
-                               MC_SAFE_FREE(req->req_msg);
-                               goto ERROR;
-                       }
+       if (req->req_msg->msg_type < 0 || req->req_msg->msg_type >= MC_MSG_MAX) {
+               mc_error("wroing msg_type[%d]", req->req_msg->msg_type);
+               send_msg = MEDIA_CONTROLLER_ERROR_INVALID_OPERATION;
+               goto ERROR;
+       }
 
-                       memcpy(req->req_msg->msg, recv_msg.msg, recv_msg.msg_size);
-               } else {
-                       req->req_msg->msg = NULL;
-               }
+       if (g_queue_get_length(request_queue) >= MAX_MC_REQUEST) {
+               mc_error("request_queue is limited until %d", MAX_MC_REQUEST);
+               send_msg = MEDIA_CONTROLLER_ERROR_INVALID_OPERATION;
+               goto ERROR;
+       }
 
-               mc_debug("msg(%d) is queued", req->req_msg->msg_type);
-               g_queue_push_tail(request_queue, (gpointer)req);
+       mc_debug("msg(%d) is queued", req->req_msg->msg_type);
+       g_queue_push_tail(request_queue, (gpointer)req);
 
-               /* push received message to queue */
-               if (g_queue_work == 0) {
-                       _service_data->request->source = g_idle_source_new();
-                       g_source_set_callback(_service_data->request->source, _mc_service_process, _service_data, NULL);
-                       g_source_attach(_service_data->request->source, g_main_context_get_thread_default());
-                       g_queue_work = 1;
-               }
+       /* push received message to queue */
+       if (!_service_data->request->source) {
+               _service_data->request->source = g_idle_source_new();
+               g_source_set_callback(_service_data->request->source, _mc_service_process, _service_data, NULL);
+               g_source_attach(_service_data->request->source, g_main_context_get_thread_default());
        }
 
+       MC_SAFE_FREE(creds.uid);
+       MC_SAFE_FREE(creds.smack);
+
        return TRUE;
 
 ERROR: