Skip to content

fix(mdns): Fix potential mem issue with scheduled packets #920

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+73 −13
Open

fix(mdns): Fix potential mem issue with scheduled packets #920

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a8e1acb
fix(mdns): Use after free
david-cermak Oct 29, 2025
9d0e1ca
fix(mdns): Fix bug with const-string domain name
david-cermak Oct 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
86 changes: 73 additions & 13 deletions components/mdns/mdns.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2078,12 +2078,24 @@ static bool _mdns_append_host_question(mdns_out_question_t **questions, const ch
q->next = NULL;
q->unicast = unicast;
q->type = MDNS_TYPE_ANY;
q->host = hostname;
q->host = hostname ? mdns_mem_strndup(hostname, MDNS_NAME_BUF_LEN - 1) : NULL;
q->service = NULL;
q->proto = NULL;
q->domain = MDNS_DEFAULT_DOMAIN;
q->own_dynamic_memory = false;
q->domain = mdns_mem_strdup(MDNS_DEFAULT_DOMAIN);
if (!q->domain) {
HOOK_MALLOC_FAILED;
if (q->host) {
mdns_mem_free((char *)q->host);
}
mdns_mem_free(q);
return false;
}
q->own_dynamic_memory = true;
Copy link

@cursor cursor bot Oct 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: MDNS Question Freeing Memory Leak

In _mdns_append_host_question, when a duplicate question is detected and freed, the dynamically allocated fields (host) are not freed first. Since own_dynamic_memory is now set to true, this causes a memory leak. The code should free these fields before freeing the question structure.

Fix in Cursor Fix in Web

if (_mdns_question_exists(q, *questions)) {
if (q->own_dynamic_memory) {
mdns_mem_free((char *)q->host);
mdns_mem_free((char *)q->domain);
}
mdns_mem_free(q);
} else {
queueToEnd(mdns_out_question_t, *questions, q);
Expand Down Expand Up @@ -2127,12 +2139,33 @@ static mdns_tx_packet_t *_mdns_create_probe_packet(mdns_if_t tcpip_if, mdns_ip_p
q->next = NULL;
q->unicast = first;
q->type = MDNS_TYPE_ANY;
q->host = _mdns_get_service_instance_name(services[i]->service);
q->service = services[i]->service->service;
q->proto = services[i]->service->proto;
q->domain = MDNS_DEFAULT_DOMAIN;
q->own_dynamic_memory = false;
q->host = _mdns_get_service_instance_name(services[i]->service) ? mdns_mem_strndup(_mdns_get_service_instance_name(services[i]->service), MDNS_NAME_BUF_LEN - 1) : NULL;
q->service = services[i]->service->service ? mdns_mem_strndup(services[i]->service->service, MDNS_NAME_BUF_LEN - 1) : NULL;
q->proto = services[i]->service->proto ? mdns_mem_strndup(services[i]->service->proto, MDNS_NAME_BUF_LEN - 1) : NULL;
q->domain = mdns_mem_strdup(MDNS_DEFAULT_DOMAIN);
if (!q->domain) {
HOOK_MALLOC_FAILED;
if (q->host) {
mdns_mem_free((char *)q->host);
}
if (q->service) {
mdns_mem_free((char *)q->service);
}
if (q->proto) {
mdns_mem_free((char *)q->proto);
}
mdns_mem_free(q);
_mdns_free_tx_packet(packet);
return NULL;
}
q->own_dynamic_memory = true;
Copy link

@cursor cursor bot Oct 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Memory Allocation Failures in mDNS Queries

The mdns_mem_strdup calls for q->service and q->proto lack NULL checks. If allocation fails, NULL pointers are used, and the existing check only validates q->host. This can lead to q being added to the packet with NULL service/proto strings, causing crashes during packet processing. Additionally, successfully allocated strings are leaked if q is freed in the error path.

Fix in Cursor Fix in Web

Copy link

@cursor cursor bot Oct 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: MDNS Question Freeing Memory Leak

In _mdns_create_probe_packet, when a duplicate question is detected or q->host is NULL, the question is freed without first freeing the dynamically allocated fields (host, service, proto). Since own_dynamic_memory is now set to true, this causes a memory leak. These fields must be freed before freeing the question structure.

Fix in Cursor Fix in Web

if (!q->host || _mdns_question_exists(q, packet->questions)) {
if (q->own_dynamic_memory) {
mdns_mem_free((char *)q->host);
mdns_mem_free((char *)q->service);
mdns_mem_free((char *)q->proto);
mdns_mem_free((char *)q->domain);
}
mdns_mem_free(q);
continue;
} else {
Expand Down Expand Up @@ -2834,13 +2867,25 @@ static void _mdns_remove_scheduled_service_packets(mdns_service_t *service)
&& qs->service && strcmp(qs->service, service->service) == 0
&& qs->proto && strcmp(qs->proto, service->proto) == 0) {
q->questions = q->questions->next;
if (qs->own_dynamic_memory) {
mdns_mem_free((char *)qs->host);
mdns_mem_free((char *)qs->service);
mdns_mem_free((char *)qs->proto);
mdns_mem_free((char *)qs->domain);
}
mdns_mem_free(qs);
} else while (qs->next) {
qsn = qs->next;
if (qsn->type == MDNS_TYPE_ANY
&& qsn->service && strcmp(qsn->service, service->service) == 0
&& qsn->proto && strcmp(qsn->proto, service->proto) == 0) {
qs->next = qsn->next;
if (qsn->own_dynamic_memory) {
mdns_mem_free((char *)qsn->host);
mdns_mem_free((char *)qsn->service);
mdns_mem_free((char *)qsn->proto);
mdns_mem_free((char *)qsn->domain);
}
mdns_mem_free(qsn);
break;
}
Expand Down Expand Up @@ -5017,11 +5062,26 @@ static mdns_tx_packet_t *_mdns_create_search_packet(mdns_search_once_t *search,
q->next = NULL;
q->unicast = search->unicast;
q->type = search->type;
q->host = search->instance;
q->service = search->service;
q->proto = search->proto;
q->domain = MDNS_DEFAULT_DOMAIN;
q->own_dynamic_memory = false;
q->host = search->instance ? mdns_mem_strndup(search->instance, MDNS_NAME_BUF_LEN - 1) : NULL;
q->service = search->service ? mdns_mem_strndup(search->service, MDNS_NAME_BUF_LEN - 1) : NULL;
q->proto = search->proto ? mdns_mem_strndup(search->proto, MDNS_NAME_BUF_LEN - 1) : NULL;
q->domain = mdns_mem_strdup(MDNS_DEFAULT_DOMAIN);
if (!q->domain) {
HOOK_MALLOC_FAILED;
if (q->host) {
mdns_mem_free((char *)q->host);
}
if (q->service) {
mdns_mem_free((char *)q->service);
}
if (q->proto) {
mdns_mem_free((char *)q->proto);
}
mdns_mem_free(q);
_mdns_free_tx_packet(packet);
return NULL;
}
q->own_dynamic_memory = true;
queueToEnd(mdns_out_question_t, packet->questions, q);

if (search->type == MDNS_TYPE_PTR) {
Expand Down