From 11fae7989f619fbafb69391bcc3977108b948381 Mon Sep 17 00:00:00 2001 From: "jiyong.min" Date: Wed, 3 Jul 2019 11:40:36 +0900 Subject: [PATCH] Add to free 'msg', 'creds', and 'source' due to memory leak issue Change-Id: Iea97415f5e4c8abfb963cb5906882dc0dbc6ccaf --- packaging/capi-media-controller.spec | 2 +- svc/media_controller_svc.c | 81 +++++++++++++++++------------------- 2 files changed, 39 insertions(+), 44 deletions(-) diff --git a/packaging/capi-media-controller.spec b/packaging/capi-media-controller.spec index 4cbe5b3..f541d64 100644 --- a/packaging/capi-media-controller.spec +++ b/packaging/capi-media-controller.spec @@ -1,6 +1,6 @@ Name: capi-media-controller Summary: A media controller library in Tizen Native API -Version: 0.2.0 +Version: 0.2.1 Release: 1 Group: Multimedia/API License: Apache-2.0 diff --git a/svc/media_controller_svc.c b/svc/media_controller_svc.c index 73577e4..6e21a8f 100644 --- a/svc/media_controller_svc.c +++ b/svc/media_controller_svc.c @@ -31,7 +31,6 @@ static GMainLoop *g_mc_svc_mainloop = NULL; static int g_connection_cnt = -1; -static int g_queue_work = 0; typedef struct { int client_sock; @@ -539,15 +538,16 @@ gboolean _mc_service_process(gpointer data) if (length_of_queue <= 0) { mc_debug("There is no request job in the queue"); - g_queue_work = 0; - return FALSE; + g_source_unref(_service_data->request->source); + _service_data->request->source = NULL; + return G_SOURCE_REMOVE; } mc_service_request *req = NULL; req = (mc_service_request *) g_queue_pop_head(request_queue); if (req == NULL) { mc_error("Failed to get a request job from queue"); - return TRUE; + return G_SOURCE_CONTINUE; } mc_comm_msg_s *request_msg = req->req_msg; @@ -613,17 +613,18 @@ ERROR: if (close(req->client_sock) < 0) mc_stderror("close failed"); + if (req->req_msg != NULL) + MC_SAFE_FREE(req->req_msg->msg); MC_SAFE_FREE(req->req_msg); MC_SAFE_FREE(req); - return TRUE; + return G_SOURCE_CONTINUE; } gboolean _mc_read_service_request_tcp_socket(GIOChannel *src, GIOCondition condition, gpointer data) { int sock = -1; int client_sock = -1; - mc_comm_msg_s recv_msg; int ret = MEDIA_CONTROLLER_ERROR_NONE; int send_msg = MEDIA_CONTROLLER_ERROR_NONE; mc_service_request *req = NULL; @@ -653,20 +654,27 @@ gboolean _mc_read_service_request_tcp_socket(GIOChannel *src, GIOCondition condi goto ERROR; } + req->req_msg = (mc_comm_msg_s *) calloc(1, sizeof(mc_comm_msg_s)); + if (req->req_msg == NULL) { + mc_error("memory allocation is failed"); + send_msg = MEDIA_CONTROLLER_ERROR_OUT_OF_MEMORY; + goto ERROR; + } + req->client_sock = client_sock; - ret = mc_cynara_receive_untrusted_message(req->client_sock, &recv_msg, &creds); + ret = mc_cynara_receive_untrusted_message(req->client_sock, req->req_msg, &creds); if (ret != MEDIA_CONTROLLER_ERROR_NONE) { mc_error("mc_ipc_receive_message_tcp failed [%d]", ret); send_msg = ret; goto ERROR; } - if (recv_msg.priv_type == MC_PRIV_TYPE_SERVER) { + if (req->req_msg->priv_type == MC_PRIV_TYPE_SERVER) { ret = mc_cynara_check(&creds, MC_SERVER_PRIVILEGE); - } else if (recv_msg.priv_type == MC_PRIV_TYPE_CLIENT) { + } else if (req->req_msg->priv_type == MC_PRIV_TYPE_CLIENT) { ret = mc_cynara_check(&creds, MC_CLIENT_PRIVILEGE); } else { - mc_error("wroing priv_type[%d]", recv_msg.priv_type); + mc_error("wroing priv_type[%d]", req->req_msg->priv_type); send_msg = MEDIA_CONTROLLER_ERROR_INVALID_OPERATION; goto ERROR; } @@ -677,44 +685,31 @@ gboolean _mc_read_service_request_tcp_socket(GIOChannel *src, GIOCondition condi goto ERROR; } - if (recv_msg.msg_type >= 0 && recv_msg.msg_type < MC_MSG_MAX) { - if (g_queue_get_length(request_queue) >= MAX_MC_REQUEST) { - send_msg = MEDIA_CONTROLLER_ERROR_INVALID_OPERATION; - goto ERROR; - } - - req->req_msg = (mc_comm_msg_s *) calloc(1, sizeof(mc_comm_msg_s)); - if (req->req_msg == NULL) { - send_msg = MEDIA_CONTROLLER_ERROR_OUT_OF_MEMORY; - goto ERROR; - } - memcpy(req->req_msg, &recv_msg, sizeof(mc_comm_msg_s) - sizeof(recv_msg.msg)); - - if (recv_msg.msg_size > 0) { - req->req_msg->msg = (char *) calloc(1, recv_msg.msg_size + 1); - if (req->req_msg->msg == NULL) { - send_msg = MEDIA_CONTROLLER_ERROR_OUT_OF_MEMORY; - MC_SAFE_FREE(req->req_msg); - goto ERROR; - } + if (req->req_msg->msg_type < 0 || req->req_msg->msg_type >= MC_MSG_MAX) { + mc_error("wroing msg_type[%d]", req->req_msg->msg_type); + send_msg = MEDIA_CONTROLLER_ERROR_INVALID_OPERATION; + goto ERROR; + } - memcpy(req->req_msg->msg, recv_msg.msg, recv_msg.msg_size); - } else { - req->req_msg->msg = NULL; - } + if (g_queue_get_length(request_queue) >= MAX_MC_REQUEST) { + mc_error("request_queue is limited until %d", MAX_MC_REQUEST); + send_msg = MEDIA_CONTROLLER_ERROR_INVALID_OPERATION; + goto ERROR; + } - mc_debug("msg(%d) is queued", req->req_msg->msg_type); - g_queue_push_tail(request_queue, (gpointer)req); + mc_debug("msg(%d) is queued", req->req_msg->msg_type); + g_queue_push_tail(request_queue, (gpointer)req); - /* push received message to queue */ - if (g_queue_work == 0) { - _service_data->request->source = g_idle_source_new(); - g_source_set_callback(_service_data->request->source, _mc_service_process, _service_data, NULL); - g_source_attach(_service_data->request->source, g_main_context_get_thread_default()); - g_queue_work = 1; - } + /* push received message to queue */ + if (!_service_data->request->source) { + _service_data->request->source = g_idle_source_new(); + g_source_set_callback(_service_data->request->source, _mc_service_process, _service_data, NULL); + g_source_attach(_service_data->request->source, g_main_context_get_thread_default()); } + MC_SAFE_FREE(creds.uid); + MC_SAFE_FREE(creds.smack); + return TRUE; ERROR: -- 2.7.4