fixed many bugs and memory leaks

7 files changed, 73 insertions, 46 deletions

diff --git a/accel-pptpd/radius/acct.c b/accel-pptpd/radius/acct.c
index 72e6df34..6004138d 100644
--- a/accel-pptpd/radius/acct.c
+++ b/accel-pptpd/radius/acct.c
@@ -10,6 +10,8 @@
 #include "log.h"
 #include "radius_p.h"
 
+#include "memdebug.h"
+
 static int req_set_RA(struct rad_req_t *req, const char *secret)
 {
 	MD5_CTX ctx;
@@ -49,6 +51,9 @@ static int rad_acct_read(struct triton_md_handler_t *h)
 {
 	struct rad_req_t *req = container_of(h, typeof(*req), hnd);
 
+	if (req->reply)
+		rad_packet_free(req->reply);
+
 	req->reply = rad_packet_recv(h->fd, NULL);
 	if (!req->reply)
 		return 0;
@@ -63,7 +68,8 @@ static int rad_acct_read(struct triton_md_handler_t *h)
 		req->reply = NULL;
 	} else {
 		req->pack->id++;
-		triton_timer_del(&req->timeout);
+		if (req->timeout.tpd)
+			triton_timer_del(&req->timeout);
 	}
 
 	return 0;
@@ -159,6 +165,12 @@ void rad_acct_stop(struct radius_pd_t *rpd)
 		req_set_stat(rpd->acct_req, rpd->ppp);
 		req_set_RA(rpd->acct_req, conf_acct_secret);
 		/// !!! rad_req_add_val(rpd->acct_req, "Acct-Terminate-Cause", "");
+		
+		if (rpd->acct_req->reply) {
+			rad_packet_free(rpd->acct_req->reply);
+			rpd->acct_req->reply = NULL;
+		}
+
 		for(i = 0; i < conf_max_try; i++) {
 			if (rad_req_send(rpd->acct_req))
 				break;
diff --git a/accel-pptpd/radius/auth.c b/accel-pptpd/radius/auth.c
index 92406b34..46adbd7a 100644
--- a/accel-pptpd/radius/auth.c
+++ b/accel-pptpd/radius/auth.c
@@ -9,6 +9,7 @@
 
 #include "radius_p.h"
 
+#include "memdebug.h"
 
 static uint8_t* encrypt_password(const char *passwd, const char *secret, const uint8_t *RA, int *epasswd_len)
 {
@@ -19,7 +20,7 @@ static uint8_t* encrypt_password(const char *passwd, const char *secret, const u
 	
 	chunk_cnt = (strlen(passwd) - 1) / 16 + 1;
 	
-	epasswd = malloc(chunk_cnt * 16);
+	epasswd = _malloc(chunk_cnt * 16);
 	if (!epasswd) {
 		log_emerg("radius: out of memory\n");
 		return NULL;
@@ -93,11 +94,11 @@ int rad_auth_pap(struct radius_pd_t *rpd, const char *username, va_list args)
 		goto out;
 
 	if (rad_packet_add_octets(req->pack, "User-Password", epasswd, epasswd_len)) {
-		free(epasswd);
+		_free(epasswd);
 		goto out;
 	}
 
-	free(epasswd);
+	_free(epasswd);
 
 	r = rad_auth_send(req);
 	if (r == PWDB_SUCCESS) {
diff --git a/accel-pptpd/radius/dict.c b/accel-pptpd/radius/dict.c
index bd7a4ef3..54cf895e 100644
--- a/accel-pptpd/radius/dict.c
+++ b/accel-pptpd/radius/dict.c
@@ -8,6 +8,8 @@
 #include "radius_p.h"
 #include "log.h"
 
+#include "memdebug.h"
+
 static struct rad_dict_t *dict;
 
 static char *skip_word(char *ptr)
@@ -216,19 +218,19 @@ int rad_dict_load(const char *fname)
 	INIT_LIST_HEAD(&dict->items);
 	INIT_LIST_HEAD(&dict->vendors);
 
-	path = malloc(PATH_MAX);
+	path = _malloc(PATH_MAX);
 	if (!path) {
 		log_emerg("radius: out of memory\n");
 		goto out_free_dict;
 	}
 
-	fname1 = malloc(PATH_MAX);
+	fname1 = _malloc(PATH_MAX);
 	if (!fname1) {
 		log_emerg("radius: out of memory\n");
 		goto out_free_path;
 	}
 
-	buf = malloc(BUF_SIZE);
+	buf = _malloc(BUF_SIZE);
 	if (!buf) {
 		log_emerg("radius: out of memory\n");
 		goto out_free_fname1;
@@ -239,9 +241,9 @@ int rad_dict_load(const char *fname)
 	r = dict_load(fname);
 
 out_free_fname1:
-	free(fname1);
+	_free(fname1);
 out_free_path:
-	free(path);
+	_free(path);
 out_free_dict:
 	if (r)
 		rad_dict_free(dict);
@@ -258,16 +260,16 @@ void rad_dict_free(struct rad_dict_t *dict)
 		while (!list_empty(&attr->values)) {
 			val = list_entry(attr->values.next, typeof(*val), entry);
 			list_del(&val->entry);
-			free((char*)val->name);
+			_free((char*)val->name);
 			if (attr->type == ATTR_TYPE_STRING)
-				free((char*)val->val.string);
-			free(val);
+				_free((char*)val->val.string);
+			_free(val);
 		}
 		list_del(&attr->entry);
-		free((char*)attr->name);
-		free(attr);
+		_free((char*)attr->name);
+		_free(attr);
 	}
-	free(dict);
+	_free(dict);
 }
 
 static struct rad_dict_attr_t *dict_find_attr(struct list_head *items, const char *name)
diff --git a/accel-pptpd/radius/dm_coa.c b/accel-pptpd/radius/dm_coa.c
index f515f873..af7c0fe9 100644
--- a/accel-pptpd/radius/dm_coa.c
+++ b/accel-pptpd/radius/dm_coa.c
@@ -17,6 +17,8 @@
 
 #include "radius_p.h"
 
+#include "memdebug.h"
+
 #define PD_COA_PORT 3799
 
 struct dm_coa_serv_t
diff --git a/accel-pptpd/radius/packet.c b/accel-pptpd/radius/packet.c
index 9e7df01d..8623f523 100644
--- a/accel-pptpd/radius/packet.c
+++ b/accel-pptpd/radius/packet.c
@@ -10,11 +10,13 @@
 
 #include "radius_p.h"
 
+#include "memdebug.h"
+
 struct rad_packet_t *rad_packet_alloc(int code)
 {
 	struct rad_packet_t *pack;
 
-	pack = malloc(sizeof(*pack));
+	pack = _malloc(sizeof(*pack));
 	if (!pack) {
 		log_emerg("radius:packet: out of memory\n");
 		return NULL;
@@ -43,9 +45,9 @@ int rad_packet_build(struct rad_packet_t *pack, uint8_t *RA)
 	uint8_t *ptr;
 
 	if (pack->buf)
-		ptr = realloc(pack->buf, pack->len);
+		ptr = _realloc(pack->buf, pack->len);
 	else
-		ptr = malloc(pack->len);
+		ptr = _malloc(pack->len);
 
 	if (!ptr) {
 		log_emerg("radius:packet: out of memory\n");
@@ -105,7 +107,7 @@ struct rad_packet_t *rad_packet_recv(int fd, struct sockaddr_in *addr)
 	if (!pack)
 		return NULL;
 
-	pack->buf = malloc(REQ_LENGTH_MAX);
+	pack->buf = _malloc(REQ_LENGTH_MAX);
 	if (!pack->buf) {
 		log_emerg("radius:packet: out of memory\n");
 		goto out_err;
@@ -169,7 +171,7 @@ struct rad_packet_t *rad_packet_recv(int fd, struct sockaddr_in *addr)
 			vendor = NULL;
 		da = rad_dict_find_attr_id(vendor, id);
 		if (da) {
-			attr = malloc(sizeof(*attr));
+			attr = _malloc(sizeof(*attr));
 			if (!attr) {
 				log_emerg("radius:packet: out of memory\n");
 				goto out_err;
@@ -180,20 +182,20 @@ struct rad_packet_t *rad_packet_recv(int fd, struct sockaddr_in *addr)
 			attr->len = len;
 			switch (da->type) {
 				case ATTR_TYPE_STRING:
-					attr->val.string = malloc(len+1);
+					attr->val.string = _malloc(len+1);
 					if (!attr->val.string) {
 						log_emerg("radius:packet: out of memory\n");
-						free(attr);
+						_free(attr);
 						goto out_err;
 					}
 					memcpy(attr->val.string, ptr, len);
 					attr->val.string[len] = 0;
 					break;
 				case ATTR_TYPE_OCTETS:
-					attr->val.octets = malloc(len);
+					attr->val.octets = _malloc(len);
 					if (!attr->val.octets) {
 						log_emerg("radius:packet: out of memory\n");
-						free(attr);
+						_free(attr);
 						goto out_err;
 					}
 					memcpy(attr->val.octets, ptr, len);
@@ -225,17 +227,18 @@ void rad_packet_free(struct rad_packet_t *pack)
 	struct rad_attr_t *attr;
 	
 	if (pack->buf)
-		free(pack->buf);
+		_free(pack->buf);
 
 	while(!list_empty(&pack->attrs)) {
 		attr = list_entry(pack->attrs.next, typeof(*attr), entry);
-		if (attr->attr->type == ATTR_TYPE_STRING || attr->attr->type == ATTR_TYPE_OCTETS)
-			free(attr->val.string);
+		log_ppp_debug("free: %s\n", attr->attr->name);
 		list_del(&attr->entry);
-		free(attr);
+		if (attr->attr->type == ATTR_TYPE_STRING || attr->attr->type == ATTR_TYPE_OCTETS)
+			_free(attr->val.string);
+		_free(attr);
 	}
 
-	free(pack);
+	_free(pack);
 }
 
 void rad_packet_print(struct rad_packet_t *pack, void (*print)(const char *fmt, ...))
@@ -323,7 +326,7 @@ int rad_packet_add_int(struct rad_packet_t *pack, const char *name, int val)
 	if (!attr)
 		return -1;
 	
-	ra = malloc(sizeof(*ra));
+	ra = _malloc(sizeof(*ra));
 	if (!ra)
 		return -1;
 
@@ -362,7 +365,7 @@ int rad_packet_add_octets(struct rad_packet_t *pack, const char *name, uint8_t *
 	if (!attr)
 		return -1;
 	
-	ra = malloc(sizeof(*ra));
+	ra = _malloc(sizeof(*ra));
 	if (!ra) {
 		log_emerg("radius: out of memory\n");
 		return -1;
@@ -371,10 +374,10 @@ int rad_packet_add_octets(struct rad_packet_t *pack, const char *name, uint8_t *
 	memset(ra, 0, sizeof(*ra));
 	ra->attr = attr;
 	ra->len = len;
-	ra->val.octets = malloc(len);
+	ra->val.octets = _malloc(len);
 	if (!ra->val.octets) {
 		log_emerg("radius: out of memory\n");
-		free(ra);
+		_free(ra);
 		return -1;
 	}
 	memcpy(ra->val.octets, val, len);
@@ -395,7 +398,7 @@ int rad_packet_add_str(struct rad_packet_t *pack, const char *name, const char *
 	if (!attr)
 		return -1;
 	
-	ra = malloc(sizeof(*ra));
+	ra = _malloc(sizeof(*ra));
 	if (!ra) {
 		log_emerg("radius: out of memory\n");
 		return -1;
@@ -404,10 +407,10 @@ int rad_packet_add_str(struct rad_packet_t *pack, const char *name, const char *
 	memset(ra, 0, sizeof(*ra));
 	ra->attr = attr;
 	ra->len = len;
-	ra->val.string = malloc(len+1);
+	ra->val.string = _malloc(len+1);
 	if (!ra->val.string) {
 		log_emerg("radius: out of memory\n");
-		free(ra);
+		_free(ra);
 		return -1;
 	}
 	memcpy(ra->val.string, val, len);
@@ -430,7 +433,7 @@ int rad_packet_change_str(struct rad_packet_t *pack, const char *name, const cha
 		if (pack->len - ra->len + len >= REQ_LENGTH_MAX)
 			return -1;
 
-		ra->val.string = realloc(ra->val.string, len + 1);
+		ra->val.string = _realloc(ra->val.string, len + 1);
 		if (!ra->val.string) {
 			log_emerg("radius: out of memory\n");
 			return -1;
@@ -463,7 +466,7 @@ int rad_packet_add_val(struct rad_packet_t *pack, const char *name, const char *
 	if (!v)
 		return -1;
 	
-	ra = malloc(sizeof(*ra));
+	ra = _malloc(sizeof(*ra));
 	if (!ra)
 		return -1;
 
@@ -547,7 +550,7 @@ int rad_packet_add_vendor_octets(struct rad_packet_t *pack, const char *vendor_n
 	if (!attr)
 		return -1;
 	
-	ra = malloc(sizeof(*ra));
+	ra = _malloc(sizeof(*ra));
 	if (!ra) {
 		log_emerg("radius: out of memory\n");
 		return -1;
@@ -557,10 +560,10 @@ int rad_packet_add_vendor_octets(struct rad_packet_t *pack, const char *vendor_n
 	ra->vendor = vendor;
 	ra->attr = attr;
 	ra->len = len;
-	ra->val.octets = malloc(len);
+	ra->val.octets = _malloc(len);
 	if (!ra->val.octets) {
 		log_emerg("radius: out of memory\n");
-		free(ra);
+		_free(ra);
 		return -1;
 	}
 	memcpy(ra->val.octets, val, len);
diff --git a/accel-pptpd/radius/radius.c b/accel-pptpd/radius/radius.c
index 04e41332..8a5e7b85 100644
--- a/accel-pptpd/radius/radius.c
+++ b/accel-pptpd/radius/radius.c
@@ -13,6 +13,8 @@
 
 #include "radius_p.h"
 
+#include "memdebug.h"
+
 #define CHAP_MD5 5
 #define MSCHAP_V1 0x80
 #define MSCHAP_V2 0x81
@@ -102,7 +104,7 @@ static struct ipdb_item_t *get_ip(struct ppp_t *ppp)
 
 static void ppp_starting(struct ppp_t *ppp)
 {
-	struct radius_pd_t *pd = malloc(sizeof(*pd));
+	struct radius_pd_t *pd = _malloc(sizeof(*pd));
 
 	memset(pd, 0, sizeof(*pd));
 	pd->pd.key = &pd_key;
@@ -138,11 +140,14 @@ static void ppp_finished(struct ppp_t *ppp)
 	pthread_mutex_unlock(&rpd->lock);
 	pthread_rwlock_unlock(&sessions_lock);
 
+	if (rpd->acct_req)
+		rad_req_free(rpd->acct_req);
+
 	if (rpd->dm_coa_req)
 		rad_packet_free(rpd->dm_coa_req);
 
 	list_del(&rpd->pd.entry);
-	free(rpd);
+	_free(rpd);
 }
 
 struct radius_pd_t *find_pd(struct ppp_t *ppp)
@@ -242,7 +247,7 @@ static struct pwdb_t pwdb = {
 
 static int parse_server(const char *opt, char **name, int *port, char **secret)
 {
-	char *str = strdup(opt);
+	char *str = _strdup(opt);
 	char *p1, *p2;
 
 	p1 = strstr(str, ":");
diff --git a/accel-pptpd/radius/req.c b/accel-pptpd/radius/req.c
index a9192bb4..ac41f199 100644
--- a/accel-pptpd/radius/req.c
+++ b/accel-pptpd/radius/req.c
@@ -11,6 +11,8 @@
 #include "log.h"
 #include "radius_p.h"
 
+#include "memdebug.h"
+
 static int urandom_fd;
 
 static int rad_req_read(struct triton_md_handler_t *h);
@@ -18,7 +20,7 @@ static void rad_req_timeout(struct triton_timer_t *t);
 
 struct rad_req_t *rad_req_alloc(struct radius_pd_t *rpd, int code, const char *username)
 {
-	struct rad_req_t *req = malloc(sizeof(*req));
+	struct rad_req_t *req = _malloc(sizeof(*req));
 
 	if (!req)
 		return NULL;
@@ -101,7 +103,7 @@ void rad_req_free(struct rad_req_t *req)
 		rad_packet_free(req->pack);
 	if (req->reply)
 		rad_packet_free(req->reply);
-	free(req);
+	_free(req);
 }
 
 static int make_socket(struct rad_req_t *req)