From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Mon, 4 Jan 2016 13:34:46 +0000 (+0000)
Subject: Fix another critical issue with memory corruption and ownership
X-Git-Tag: 1.1.0~133
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d315a3368c65a0246b7c863e075013eb0d09bdc9;p=thirdparty%2Frspamd.git

Fix another critical issue with memory corruption and ownership
---

diff --git a/src/libmime/mime_expressions.c b/src/libmime/mime_expressions.c
index 4817e589b6..be9912463d 100644
--- a/src/libmime/mime_expressions.c
+++ b/src/libmime/mime_expressions.c
@@ -189,12 +189,12 @@ rspamd_mime_expr_quark (void)
  * Rspamd regexp utility functions
  */
 static struct rspamd_regexp_atom *
-rspamd_mime_expr_parse_regexp_atom (rspamd_mempool_t * pool, const gchar *line)
+rspamd_mime_expr_parse_regexp_atom (rspamd_mempool_t * pool, const gchar *line,
+		struct rspamd_config *cfg)
 {
 	const gchar *begin, *end, *p, *src, *start;
 	gchar *dbegin, *dend;
 	struct rspamd_regexp_atom *result;
-	rspamd_regexp_t *re;
 	GError *err = NULL;
 	GString *re_flags;
 
@@ -203,10 +203,6 @@ rspamd_mime_expr_parse_regexp_atom (rspamd_mempool_t * pool, const gchar *line)
 		return NULL;
 	}
 
-	if ((re = rspamd_regexp_cache_query (NULL, line, NULL)) != NULL) {
-		return ((struct rspamd_regexp_atom *)rspamd_regexp_get_ud (re));
-	}
-
 	src = line;
 	result = rspamd_mempool_alloc0 (pool, sizeof (struct rspamd_regexp_atom));
 	/* Skip whitespaces */
@@ -356,19 +352,15 @@ rspamd_mime_expr_parse_regexp_atom (rspamd_mempool_t * pool, const gchar *line)
 		return NULL;
 	}
 
-	if (result->regexp) {
-		if (result->is_multiple) {
-			rspamd_regexp_set_maxhits (result->regexp, 0);
-		}
-		else {
-			rspamd_regexp_set_maxhits (result->regexp, 1);
-		}
+	if (result->is_multiple) {
+		rspamd_regexp_set_maxhits (result->regexp, 0);
+	}
+	else {
+		rspamd_regexp_set_maxhits (result->regexp, 1);
 	}
 
 	rspamd_regexp_set_ud (result->regexp, result);
 
-	rspamd_regexp_cache_insert (NULL, line, NULL, result->regexp);
-
 	*dend = '/';
 
 	return result;
@@ -621,7 +613,7 @@ set:
 
 	if (type == MIME_ATOM_REGEXP) {
 		mime_atom->d.re = rspamd_mime_expr_parse_regexp_atom (pool,
-				mime_atom->str);
+				mime_atom->str, cfg);
 		if (mime_atom->d.re == NULL) {
 			g_set_error (err, rspamd_mime_expr_quark(), 200, "cannot parse regexp '%s'",
 					mime_atom->str);
@@ -631,6 +623,7 @@ set:
 			/* Register new item in the cache */
 			if (mime_atom->d.re->type == RSPAMD_RE_HEADER ||
 					mime_atom->d.re->type == RSPAMD_RE_RAWHEADER) {
+
 				if (mime_atom->d.re->header != NULL) {
 					own_re = mime_atom->d.re->regexp;
 					mime_atom->d.re->regexp = rspamd_re_cache_add (cfg->re_cache,
diff --git a/src/lua/lua_regexp.c b/src/lua/lua_regexp.c
index 371f89d45d..a612f71d7b 100644
--- a/src/lua/lua_regexp.c
+++ b/src/lua/lua_regexp.c
@@ -711,7 +711,6 @@ lua_regexp_gc (lua_State *L)
 	struct rspamd_lua_regexp *to_del = lua_check_regexp (L);
 
 	if (to_del) {
-		msg_warn ("del: %p", to_del->re);
 		if (!IS_DESTROYED (to_del)) {
 			rspamd_regexp_unref (to_del->re);
 		}