Skip to content

Commit c495098

Browse files
defanatorFelipe Zimmerle
authored and
Felipe Zimmerle
committed
Fix memory leak in intervention processing
intervention.log is being allocated via strdup() here: https://github.com/SpiderLabs/ModSecurity/blob/v3/master/src/transaction.cc#L1362 and should be freed by connector.
1 parent b5ba557 commit c495098

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

src/ngx_http_modsecurity_module.c

+8-2
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,7 @@ ngx_inline char *ngx_str_to_char(ngx_str_t a, ngx_pool_t *p)
132132
ngx_inline int
133133
ngx_http_modsecurity_process_intervention (Transaction *transaction, ngx_http_request_t *r)
134134
{
135+
char *log = NULL;
135136
ModSecurityIntervention intervention;
136137
intervention.status = 200;
137138
intervention.url = NULL;
@@ -145,11 +146,16 @@ ngx_http_modsecurity_process_intervention (Transaction *transaction, ngx_http_re
145146
return 0;
146147
}
147148

149+
log = intervention.log;
148150
if (intervention.log == NULL) {
149-
intervention.log = "(no log message was specified)";
151+
log = "(no log message was specified)";
150152
}
151153

152-
ngx_log_error(NGX_LOG_WARN, (ngx_log_t *)r->connection->log, 0, "%s", intervention.log);
154+
ngx_log_error(NGX_LOG_WARN, (ngx_log_t *)r->connection->log, 0, "%s", log);
155+
156+
if (intervention.log != NULL) {
157+
free(intervention.log);
158+
}
153159

154160
if (intervention.url != NULL)
155161
{

0 commit comments

Comments
 (0)