From: Victor Stinner <victor.stinner@gmail.com>
Date: Mon, 12 Sep 2016 09:41:58 +0000 (+0200)
Subject: socket: Fix memory leak in sendmsg() and sendmsg_afalg()
X-Git-Tag: v3.6.0b1~14
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=52d61e485eeebcd3cc9ebdf0c762d100fc2916dc;p=python

socket: Fix memory leak in sendmsg() and sendmsg_afalg()

Issue #27744:

* Release msg.msg_iov memory block.
* Release memory on PyMem_Malloc(controllen) failure
---

diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c
index 0490d71b41..eee607fd13 100644
--- a/Modules/socketmodule.c
+++ b/Modules/socketmodule.c
@@ -4072,11 +4072,13 @@ sock_sendmsg(PySocketSockObject *s, PyObject *args)
     if (ncmsgbufs > 0) {
         struct cmsghdr *cmsgh = NULL;
 
-        if ((msg.msg_control = controlbuf =
-             PyMem_Malloc(controllen)) == NULL) {
+        controlbuf = PyMem_Malloc(controllen);
+        if (controlbuf == NULL) {
             PyErr_NoMemory();
             goto finally;
         }
+        msg.msg_control = controlbuf;
+
         msg.msg_controllen = controllen;
 
         /* Need to zero out the buffer as a workaround for glibc's
@@ -4141,8 +4143,10 @@ finally:
         PyBuffer_Release(&cmsgs[i].data);
     PyMem_Free(cmsgs);
     Py_XDECREF(cmsg_fast);
-    for (i = 0; i < ndatabufs; i++)
+    PyMem_Free(msg.msg_iov);
+    for (i = 0; i < ndatabufs; i++) {
         PyBuffer_Release(&databufs[i]);
+    }
     PyMem_Free(databufs);
     return retval;
 }
@@ -4243,7 +4247,8 @@ sock_sendmsg_afalg(PySocketSockObject *self, PyObject *args, PyObject *kwds)
 
     controlbuf = PyMem_Malloc(controllen);
     if (controlbuf == NULL) {
-        return PyErr_NoMemory();
+        PyErr_NoMemory();
+        goto finally;
     }
     memset(controlbuf, 0, controllen);
 
@@ -4315,8 +4320,10 @@ sock_sendmsg_afalg(PySocketSockObject *self, PyObject *args, PyObject *kwds)
     if (iv.buf != NULL) {
         PyBuffer_Release(&iv);
     }
-    for (i = 0; i < ndatabufs; i++)
+    PyMem_Free(msg.msg_iov);
+    for (i = 0; i < ndatabufs; i++) {
         PyBuffer_Release(&databufs[i]);
+    }
     PyMem_Free(databufs);
     return retval;
 }