From: Amos Jeffries <amosjeffries@squid-cache.org>
Date: Wed, 14 Jul 2010 23:41:16 +0000 (-0600)
Subject: Author: Alex Rousskov <rousskov@measurement-factory.com>
X-Git-Tag: SQUID_3_1_5_1~22
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=829533350923560aea84c6cb6082d16599f93217;p=thirdparty%2Fsquid.git

Author: Alex Rousskov <rousskov@measurement-factory.com>
Prevent memory leaks when cloning Range requests.

HttpRequest::range field was set to a new HttpHdrRange object twice:
once in HttpRequest::clone() and once in HttpRequest::hdrCacheInit()
called from clone().

Polished HttpReply::clone() to make sure HttpReply::hdrCacheInit()
does not use uninitialized HttpReply::sline field and to prevent
benign double-initialization of HttpReply::keep_alive.
---

diff --git a/src/HttpReply.cc b/src/HttpReply.cc
index 66fe3ed2a4..85ead64e4c 100644
--- a/src/HttpReply.cc
+++ b/src/HttpReply.cc
@@ -607,6 +607,7 @@ HttpReply *
 HttpReply::clone() const
 {
     HttpReply *rep = new HttpReply();
+    rep->sline = sline; // used in hdrCacheInit() call below
     rep->header.append(&header);
     rep->hdrCacheInit();
     rep->hdr_sz = hdr_sz;
@@ -615,8 +616,7 @@ HttpReply::clone() const
     rep->body_pipe = body_pipe;
 
     rep->protocol = protocol;
-    rep->sline = sline;
-    rep->keep_alive = keep_alive;
+    // keep_alive is handled in hdrCacheInit()
     return rep;
 }
 
diff --git a/src/HttpRequest.cc b/src/HttpRequest.cc
index a74f56a64f..006583d53b 100644
--- a/src/HttpRequest.cc
+++ b/src/HttpRequest.cc
@@ -188,7 +188,7 @@ HttpRequest::clone() const
     // urlPath handled in ctor
     copy->canonical = canonical ? xstrdup(canonical) : NULL;
 
-    copy->range = range ? new HttpHdrRange(*range) : NULL;
+    // range handled in hdrCacheInit()
     copy->ims = ims;
     copy->imslen = imslen;
     copy->max_forwards = max_forwards;
@@ -358,6 +358,7 @@ HttpRequest::hdrCacheInit()
 {
     HttpMsg::hdrCacheInit();
 
+    assert(!range);
     range = header.getRange();
 }