Fix mismatched free for cJSON-generated string in dynsec__config_save #3287
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR changes the deallocation of the JSON string returned by
cJSON_Print()
frommosquitto_free()
tocJSON_free()
, fixing a memory‐tracking underflow caused by mixing allocators. This underflow makes the tracking subsystem thinks that it has a lot of GB reserved, and any subsequent call tomosquitto_malloc()
returns "out of memory" which leaves the broker unusable after a few operations with the Dynamic Security Plugin. The only way of recovering it is restarting Mosquitto.Background & Problem
In
dynsec__config_save()
, the code currently does:However:
cJSON_Print()
internally allocates withcJSON_malloc()
.mosquitto_free()
(instead ofcJSON_free()
) decrements Mosquitto’s own allocation counter (memory_mosq.c) for a pointer that was never allocated and counted bymosquitto_malloc()
, causing the counter to underflow.mosquitto_malloc()
this counter appears “too large,” causing subsequent allocations to spuriously fail with “out of memory,” rendering the broker unusable until restart.How to reproduce
Set a
memory_limit
in mosquitto.confUsing the dynamic security plugin perform a few operations of adding and/or removing users to/from ACL rules. The counter of the memory tracker will decrease with each operation until it underflows.
make test
with your changes locally?