From: Jo-Philipp Wich <jo@mein.io>
Date: Thu, 17 Oct 2019 09:50:39 +0000 (+0200)
Subject: plugin: fix leaking invoked method name for exec plugins
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=d80f70eb4af0ad447f7d34c5b9198e4fece7da57;p=oweals%2Frpcd.git

plugin: fix leaking invoked method name for exec plugins

The invoked method name was separately duplicated from the call_context
structure. The structure itself is eventually freed by rpc_exec_reply()
but the method string it points to is lost after that.

Use calloc_a() instead to allocate the string copy buffer together with
the context structure, to ensure that all involved memory is freed.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 37aa9196b603769ffbff4d0c58f76259a3791384)
---

diff --git a/plugin.c b/plugin.c
index 3740622..fa5f09f 100644
--- a/plugin.c
+++ b/plugin.c
@@ -135,14 +135,14 @@ rpc_plugin_call(struct ubus_context *ctx, struct ubus_object *obj,
 {
 	int rv = UBUS_STATUS_UNKNOWN_ERROR;
 	struct call_context *c;
-	char *plugin;
+	char *plugin, *mptr;
 
-	c = calloc(1, sizeof(*c));
+	c = calloc_a(sizeof(*c), &mptr, strlen(method) + 1);
 
 	if (!c)
 		goto fail;
 
-	c->method = strdup(method);
+	c->method = strcpy(mptr, method);
 	c->input = blobmsg_format_json(msg, true);
 	c->tok = json_tokener_new();