Fix two memory leaks on CALLOC/FREE of ec_globals_alloc function, det…

include/ec_globals.h

@@ -104,6 +104,7 @@ struct ec_options {
    char *target1;
    char *target2;
    char *script;
+   char *script_orig;
    char *ssl_cert;
    char *ssl_pkey;
    FILE *msg_fd;

plug-ins/rand_flood/rand_flood.c

@@ -53,8 +53,8 @@ struct arp_eth_header {
 };
 
 #define FAKE_PCK_LEN sizeof(struct eth_header)+sizeof(struct arp_header)+sizeof(struct arp_eth_header)
-struct packet_object fake_po;
-char fake_pck[FAKE_PCK_LEN];
+struct packet_object flood_fake_po;
+char flood_fake_pck[FAKE_PCK_LEN];
 
 
 /* protos */
@@ -158,7 +158,7 @@ EC_THREAD_FUNC(flooder)
    srandom(seed.tv_sec ^ seed.tv_usec);
 
    /* Create a fake ARP packet */
-   heth = (struct eth_header *)fake_pck;
+   heth = (struct eth_header *)flood_fake_pck;
    harp = (struct arp_header *)(heth + 1);
 
    heth->proto = htons(LL_TYPE_ARP);
@@ -168,7 +168,7 @@ EC_THREAD_FUNC(flooder)
    harp->ar_pln = 4;
    harp->ar_op  = htons(ARPOP_REQUEST);
 
-   packet_create_object(&fake_po, (u_char*)fake_pck, FAKE_PCK_LEN);
+   packet_create_object(&flood_fake_po, (u_char*)flood_fake_pck, FAKE_PCK_LEN);
 
    /* init the thread and wait for start up */
    ec_thread_init();
@@ -193,7 +193,7 @@ EC_THREAD_FUNC(flooder)
       memcpy(heth->sha, MACS, ETH_ADDR_LEN);
 
       /* Send on the wire and wait */
-      send_to_L2(&fake_po); 
+      send_to_L2(&flood_fake_po); 
 
       ec_usleep(EC_GBL_CONF->port_steal_send_delay);
    }

plug-ins/stp_mangler/stp_mangler.c

@@ -62,8 +62,8 @@ struct stp_header
 };
 
 #define FAKE_PCK_LEN 60
-struct packet_object fake_po;
-char fake_pck[FAKE_PCK_LEN];
+struct packet_object stp_fake_po;
+char stp_fake_pck[FAKE_PCK_LEN];
 
 
 /* protos */
@@ -162,9 +162,9 @@ EC_THREAD_FUNC(mangler)
    (void) EC_THREAD_PARAM;
 
    /* Avoid crappy compiler alignment :( */    
-   heth  = (struct eth_header *)fake_pck;
-   hllc  = (struct llc_header *)(fake_pck + 14);
-   hstp  = (struct stp_header *)(fake_pck + 22);
+   heth  = (struct eth_header *)stp_fake_pck;
+   hllc  = (struct llc_header *)(stp_fake_pck + 14);
+   hstp  = (struct stp_header *)(stp_fake_pck + 22);
 
    /* Create a fake STP packet */
    heth->proto = htons(0x0026);
@@ -184,7 +184,7 @@ EC_THREAD_FUNC(mangler)
    hstp->hello_time = htons_inv(2);
    hstp->forward_delay = htons_inv(15);
 
-   packet_create_object(&fake_po, (u_char*)fake_pck, FAKE_PCK_LEN);
+   packet_create_object(&stp_fake_po, (u_char*)stp_fake_pck, FAKE_PCK_LEN);
 
    /* init the thread and wait for start up */
    ec_thread_init();
@@ -193,7 +193,7 @@ EC_THREAD_FUNC(mangler)
       CANCELLATION_POINT();
 
       /* Send on the wire and wait */
-      send_to_L2(&fake_po); 
+      send_to_L2(&stp_fake_po); 
       ec_usleep(SEC2MICRO(1));
    }
 

src/ec_capture.c

@@ -137,16 +137,18 @@ void capture_getifs(void)
       SAFE_CALLOC(cdev, 1, sizeof(pcap_if_t));
       memcpy(cdev, dev, sizeof(pcap_if_t));
 
-      /* set the description for the local loopback */
+      /* fill the empty descriptions */
+      if (cdev->description == NULL)
+         cdev->description = strdup(cdev->name);
+      else /* use separate pointer to avoid double-free through pcap_freealldevs() */
+         cdev->description = strdup(cdev->description);
+
+      /* Normalize the description for the local loopback */
       if (cdev->flags & PCAP_IF_LOOPBACK) {
          SAFE_FREE(cdev->description);
          cdev->description = strdup("Local Loopback");
       }
 
-      /* fill the empty descriptions */
-      if (cdev->description == NULL)
-         cdev->description = strdup(cdev->name);
-
       DEBUG_MSG("capture_getifs: [%s] %s", cdev->name, cdev->description);
 
       /* reset link to next list element */

src/ec_conf.c

@@ -398,6 +398,7 @@ void load_conf(void)
          } while (p++ < *tmp + tmplen );
 
          DEBUG_MSG("load_conf: \tENTRY: %s  [%s]", q, *tmp);
+         SAFE_FREE(*tmp);
       } else {
          /* set the integer value */ 
          *(int *)value = strtol(p, (char **)NULL, 10);

src/ec_dissect.c

@@ -196,6 +196,7 @@ void dissect_del(char *name)
       if (!strcasecmp(e->name, name)) {
          del_decoder(e->level, e->type);
          SLIST_REMOVE(&dissect_list, e, dissect_entry, next);
+         SAFE_FREE(e->name);
          SAFE_FREE(e);
       }
    }

src/ec_globals.c

@@ -72,6 +72,7 @@ void ec_globals_free(void)
 {
 
    capture_freeifs();
+   EC_GBL_FREE(ec_gbls->pcap->filter);
    EC_GBL_FREE(ec_gbls->pcap);
    EC_GBL_FREE(ec_gbls->lnet);
    EC_GBL_FREE(ec_gbls->iface);
@@ -84,6 +85,7 @@ void ec_globals_free(void)
    free_ip_list(ec_gbls->t2);
    EC_GBL_FREE(ec_gbls->t2);
 
+   EC_GBL_FREE(ec_gbls->wifi);
    EC_GBL_FREE(ec_gbls->env->name);
    EC_GBL_FREE(ec_gbls->env->version);
    EC_GBL_FREE(ec_gbls->env->debug_file);
@@ -97,11 +99,19 @@ void ec_globals_free(void)
    EC_GBL_FREE(ec_gbls->options->iface_bridge);
    EC_GBL_FREE(ec_gbls->options->target1);
    EC_GBL_FREE(ec_gbls->options->target2);
+   EC_GBL_FREE(ec_gbls->options->script_orig);
+   EC_GBL_FREE(ec_gbls->options->address);
+   EC_GBL_FREE(ec_gbls->options->netmask);
+   EC_GBL_FREE(ec_gbls->options->hostsfile);
+   EC_GBL_FREE(ec_gbls->options->ssl_cert);
+   EC_GBL_FREE(ec_gbls->options->ssl_pkey);
    EC_GBL_FREE(ec_gbls->stats);
    EC_GBL_FREE(ec_gbls->options);
+   EC_GBL_FREE(ec_gbls->conf->file);
    EC_GBL_FREE(ec_gbls->conf);
    /* destroy the list structure */
    filter_clear();
+   EC_GBL_FREE(ec_gbls->ui);
 
    EC_GBL_FREE(ec_gbls);
 

src/ec_network.c

@@ -91,19 +91,15 @@ void network_init()
 
 static void close_network()
 {
-   pcap_close(EC_GBL_IFACE->pcap);
-   SAFE_FREE(EC_GBL_IFACE->pbuf);
+   source_close(EC_GBL_IFACE);
+
    if(EC_GBL_SNIFF->type == SM_BRIDGED) {
-      pcap_close(EC_GBL_BRIDGE->pcap);
-      SAFE_FREE(EC_GBL_BRIDGE->pbuf);
+      source_close(EC_GBL_BRIDGE);
    }
 
    if(EC_GBL_OPTIONS->write)
       pcap_dump_close(EC_GBL_PCAP->dump);
 
-   libnet_destroy(EC_GBL_IFACE->lnet);
-   libnet_destroy(EC_GBL_BRIDGE->lnet);
-
    DEBUG_MSG("ATEXIT: close_network");
 }
 
@@ -325,8 +321,9 @@ static int source_init(char *name, struct iface_env *source, bool primary, bool
 
 static void source_close(struct iface_env *iface)
 {
+   DEBUG_MSG("source_close(%s)", iface->name);
 #ifdef WITH_IPV6
-   struct net_list *n;
+   struct net_list *n, *tmp;
 #endif
 
    iface->is_ready = 0;
@@ -338,13 +335,16 @@ static void source_close(struct iface_env *iface)
       libnet_destroy(iface->lnet);
 
 #ifdef WITH_IPV6 
-   LIST_FOREACH(n, &iface->ip6_list, next) {
-      LIST_REMOVE(n, next);
-      SAFE_FREE(n);
+   if (iface->has_ipv6) {
+      LIST_FOREACH_SAFE(n, &iface->ip6_list, next, tmp) {
+         LIST_REMOVE(n, next);
+         SAFE_FREE(n);
+      }
    }
 #endif
 
    SAFE_FREE(iface->name);
+   SAFE_FREE(iface->pbuf);
    memset(iface, 0, sizeof(*iface));
 }
 

src/ec_set.c

@@ -217,6 +217,8 @@ void set_quiet(void)
 void set_script(char *script)
 {
 	EC_GBL_OPTIONS->script = strdup(script);
+   /* Keep original pointer for later free() operation */
+   EC_GBL_OPTIONS->script_orig = EC_GBL_OPTIONS->script;
 }
 
 void set_silent(void)

src/os/ec_linux.c

@@ -263,15 +263,12 @@ u_int16 get_iface_mtu(const char *iface)
 void disable_interface_offload(void)
 {
 	int param_length= 0;
-	char *command;
+	char command_store[100], *command;
 	char **param = NULL;
 	char *p;
 	int ret_val, i = 0;
 
-	SAFE_CALLOC(command, 100, sizeof(char));
-
-	BUG_IF(command==NULL);
-
+	command = command_store;
 	memset(command, '\0', 100);	
 	snprintf(command, 99, "ethtool -K %s tso off gso off gro off lro off", EC_GBL_OPTIONS->iface);
 
@@ -294,13 +291,13 @@ void disable_interface_offload(void)
 #endif
 			execvp(param[0], param);
 			WARN_MSG("cannot disable offload on %s, do you have ethtool installed?", EC_GBL_OPTIONS->iface);
-			safe_free_mem(param, &param_length, command);
+			safe_free_mem(param, &param_length, NULL);
 			_exit(-E_INVALID);
 		case -1:
-			safe_free_mem(param, &param_length, command);
+			safe_free_mem(param, &param_length, NULL);
          break;
 		default:
-			safe_free_mem(param, &param_length, command);
+			safe_free_mem(param, &param_length, NULL);
 			wait(&ret_val);
 	} 	
 }