From: Vsevolod Stakhov <vsevolod@rspamd.com>
Date: Sat, 18 Oct 2025 14:19:27 +0000 (+0100)
Subject: [Fix] Stat: fix memory leak in metadata tokenization
X-Git-Tag: 3.14.0~66
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=012ba5f3150409ed76c9ff26e6f7813273084056;p=thirdparty%2Frspamd.git

[Fix] Stat: fix memory leak in metadata tokenization

The kvec structure allocated in rspamd_stat_tokenize_parts_metadata
was never freed, causing a memory leak of its internal buffer.
The leak was 450KB across 569 objects as reported by ASAN.

Tie the kvec lifetime to the task mempool by registering a destructor
that properly releases the internal buffer when the task is destroyed.
---

diff --git a/src/libstat/stat_process.c b/src/libstat/stat_process.c
index ffd0fa11af..9e14d09c43 100644
--- a/src/libstat/stat_process.c
+++ b/src/libstat/stat_process.c
@@ -104,6 +104,13 @@ rspamd_task_get_autolearn_class(struct rspamd_task *task)
 	return NULL;
 }
 
+static void
+rspamd_words_kvec_dtor(gpointer p)
+{
+	rspamd_words_t *words = (rspamd_words_t *) p;
+	kv_destroy(*words);
+}
+
 static void
 rspamd_stat_tokenize_parts_metadata(struct rspamd_stat_ctx *st_ctx,
 									struct rspamd_task *task)
@@ -115,6 +122,7 @@ rspamd_stat_tokenize_parts_metadata(struct rspamd_stat_ctx *st_ctx,
 
 	words = rspamd_mempool_alloc(task->task_pool, sizeof(*words));
 	kv_init(*words);
+	rspamd_mempool_add_destructor(task->task_pool, rspamd_words_kvec_dtor, words);
 	memset(&elt, 0, sizeof(elt));
 	elt.flags = RSPAMD_STAT_TOKEN_FLAG_META;