MFB: Fixed bug #45405 (snmp extension memory leak)

diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c
index b52d9c072e5a95277df15d349387e2f4ea55dd25..8202f8746c7d616ffb42f90207c19b1fd0a9cd50 100644 (file)
--- a/ext/snmp/snmp.c
+++ b/ext/snmp/snmp.c
@@ -627,13 +627,13 @@ static void php_snmp_internal(INTERNAL_FUNCTION_PARAMETERS, int st,
        while (keepwalking) {
                keepwalking = 0;
                if ((st == SNMP_CMD_GET) || (st == SNMP_CMD_GETNEXT)) {
-                       pdu = snmp_pdu_create((st == SNMP_CMD_GET) ? SNMP_MSG_GET : SNMP_MSG_GETNEXT);
                        name_length = MAX_OID_LEN;
                        if (!snmp_parse_oid(objid, name, &name_length)) {
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid object identifier: %s", objid);
                                snmp_close(ss);
                                RETURN_FALSE;
                        }
+                       pdu = snmp_pdu_create((st == SNMP_CMD_GET) ? SNMP_MSG_GET : SNMP_MSG_GETNEXT);
                        snmp_add_null_var(pdu, name, name_length);
                } else if (st == SNMP_CMD_SET) {
                        pdu = snmp_pdu_create(SNMP_MSG_SET);
@@ -644,6 +644,7 @@ static void php_snmp_internal(INTERNAL_FUNCTION_PARAMETERS, int st,
                                sprint_objid(buf, name, name_length);
 #endif
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not add variable: %s %c %s", buf, type, value);
+                               snmp_free_pdu(pdu);
                                snmp_close(ss);
                                RETURN_FALSE;
                        }
@@ -677,11 +678,13 @@ retry:
                                                *return_value = *snmpval;
                                                zval_copy_ctor(return_value);
                                                zval_ptr_dtor(&snmpval);
+                                               snmp_free_pdu(pdu);
                                                snmp_close(ss);
                                                return;
                                        } else if (st == SNMP_CMD_GETNEXT) {
                                                *return_value = *snmpval;
                                                zval_copy_ctor(return_value);
+                                               snmp_free_pdu(pdu);
                                                snmp_close(ss);
                                                return;
                                        } else if (st == SNMP_CMD_WALK) {
@@ -720,23 +723,28 @@ retry:
                                        }
                                        if (st == SNMP_CMD_GET) {
                                                if ((pdu = snmp_fix_pdu(response, SNMP_MSG_GET)) != NULL) {
+                                                       snmp_free_pdu(pdu);
                                                        goto retry;
                                                }
                                        } else if (st == SNMP_CMD_SET) {
                                                if ((pdu = snmp_fix_pdu(response, SNMP_MSG_SET)) != NULL) {
+                                                       snmp_free_pdu(pdu);
                                                        goto retry;
                                                }
                                        } else if (st == SNMP_CMD_GETNEXT) {
                                                if ((pdu = snmp_fix_pdu(response, SNMP_MSG_GETNEXT)) != NULL) {
+                                                       snmp_free_pdu(pdu);
                                                        goto retry;
                                                }
                                        } else if (st >= SNMP_CMD_WALK) { /* Here we do walks. */
                                                if ((pdu = snmp_fix_pdu(response, ((session->version == SNMP_VERSION_1)
                                                                                ? SNMP_MSG_GETNEXT
                                                                                : SNMP_MSG_GETBULK))) != NULL) {
+                                                       snmp_free_pdu(pdu);
                                                        goto retry;
                                                }
                                        }
+                                       snmp_free_pdu(pdu);
                                        snmp_close(ss);
                                        if (st == SNMP_CMD_WALK || st == SNMP_CMD_REALWALK) {
                                                zval_dtor(return_value);