Memleak in libssh2_session_init_ex and _libssh2_channel_open about libssh2 HOT 7 CLOSED

You should call libssh2_channel_free(), libssh2_session_free(), etc. See the examples and/or documentation of libssh2 API.

from libssh2.

Oops, sorry, I missed them in the send_resp_obj function. Please share also the valgrind output.

from libssh2.

thanks for the quick reply
below is the actual code for the leak

"
#include <unistd.h>
#include <errno.h>
#include <arpa/inet.h>
#include <libssh2.h>
#include <stdlib.h>
#include <stdio.h>

LIBSSH2_CHANNEL channel;
LIBSSH2_SESSION *session;
void send_resp_obj(char out_str, int status)
{
free(out_str);
libssh2_channel_send_eof(channel);
libssh2_channel_close(channel); //its blocking
libssh2_channel_free(channel);
libssh2_session_disconnect(session, "SESSION Shutdown");
libssh2_session_free(session);
return;
}
char* username = "admin";
char* password = "admin123";
char commands = "show bootvar\r\n";
int main2()
{
int ret, addrs_len, bytes_read, out_len;
struct sockaddr_in sock_addr;
char out_str = NULL;
sock_addr.sin_family = AF_INET;
sock_addr.sin_port = htons(22);
sock_addr.sin_addr.s_addr = inet_addr("192.168.95.136");
int socket_fd;
socket_fd = socket(AF_INET, SOCK_STREAM, 0);
ret = connect(socket_fd, (struct sockaddr_)&sock_addr, sizeof(struct sockaddr_in));
session = libssh2_session_init();
ret = libssh2_session_handshake(session, socket_fd);
ret = libssh2_userauth_password(session, username, password);
channel = libssh2_channel_open_session(session);
libssh2_channel_shell(channel);
libssh2_channel_set_blocking(channel, 0);
libssh2_channel_write(channel, commands, strlen(commands));
ret = 0;
do {
if (NULL == out_str) {
out_len = 0;
out_str = (char_) malloc(4096);
if (NULL == out_str) {
send_resp_obj(out_str, 0);
}
bzero(out_str,4096);
}
errno = 0;
bytes_read = libssh2_channel_read(channel, out_str + out_len, 4095 - out_len);
if (bytes_read <= 0) {
if (LIBSSH2_ERROR_EAGAIN == bytes_read && ret++ < 3) {
continue;
} else {
send_resp_obj(out_str, -1);
return -1;
}
} else {
out_len += bytes_read;
if (4095 == out_len && EAGAIN == errno) {
send_resp_obj(out_str, 0);
}
}
} while( !libssh2_channel_eof(channel));
send_resp_obj(out_str, 0);
return 0;
}
int main()
{
int twe = 25;
while(twe--)
{
main2();
printf("\t%d doine\n", twe);
}
return 0;
}

"

and here is the log for valgrind

"

valgrind --tool=memcheck --leak-check=full ./a.out
==10793== Memcheck, a memory error detector
==10793== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==10793== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info
==10793== Command: ./a.out
==10793==
24 doine
23 doine
22 doine
21 doine
20 doine
19 doine
18 doine
17 doine
16 doine
15 doine
14 doine
13 doine
12 doine
11 doine
10 doine
9 doine
8 doine
7 doine
6 doine
5 doine
4 doine
3 doine
2 doine
1 doine
0 doine
==10793==
==10793== HEAP SUMMARY:
==10793== in use at exit: 1,100,965 bytes in 880 blocks
==10793== total heap usage: 6,686 allocs, 5,806 frees, 2,212,545 bytes allocated
==10793==
==10793== 1,030,302 (981,360 direct, 48,942 indirect) bytes in 18 blocks are definitely lost in loss record 540 of 540
==10793== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10793== by 0x4E48A1D: libssh2_session_init_ex (session.c:487)
==10793== by 0x400FA0: main2() (temp.cpp:35)
==10793== by 0x401212: main (temp.cpp:76)
==10793==
==10793== LEAK SUMMARY:
==10793== definitely lost: 981,360 bytes in 18 blocks
==10793== indirectly lost: 48,942 bytes in 342 blocks
==10793== possibly lost: 0 bytes in 0 blocks
==10793== still reachable: 70,663 bytes in 520 blocks
==10793== suppressed: 0 bytes in 0 blocks
==10793== Reachable blocks (those to which a pointer was found) are not shown.
==10793== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==10793==
==10793== For counts of detected and suppressed errors, rerun with: -v
==10793== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

"

thanks,
swapnil

from libssh2.

for recheck

i put "free(session);"
in send_resp_obj function and check in valgrind then it gives me log as below

valgrind --tool=memcheck --leak-check=full ./a.out
==11004== Memcheck, a memory error detector
==11004== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==11004== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info
==11004== Command: ./a.out
==11004==
24 doine
==11004== Invalid free() / delete / delete[] / realloc()
==11004== at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11004== by 0x400F20: send_resp_obj(char_, int) (temp.cpp:19)
==11004== by 0x401189: main2() (temp.cpp:59)
==11004== by 0x401221: main (temp.cpp:77)
==11004== Address 0x5c465c0 is 0 bytes inside a block of size 54,520 free'd
==11004== at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11004== by 0x4E49FB7: libssh2_session_free (session.c:1061)
==11004== by 0x400F11: send_resp_obj(char_, int) (temp.cpp:18)
==11004== by 0x401189: main2() (temp.cpp:59)
==11004== by 0x401221: main (temp.cpp:77)
==11004==
23 doine
22 doine
21 doine
20 doine
19 doine
18 doine
17 doine
16 doine
15 doine
14 doine
13 doine
12 doine
11 doine
10 doine
9 doine
8 doine
7 doine
6 doine
5 doine
4 doine
3 doine
2 doine
1 doine
0 doine
==11004==
==11004== HEAP SUMMARY:
==11004== in use at exit: 59,647 bytes in 823 blocks
==11004== total heap usage: 6,686 allocs, 5,871 frees, 2,212,550 bytes allocated
==11004==
==11004== 340 bytes in 17 blocks are definitely lost in loss record 503 of 521
==11004== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11004== by 0x4E41E2E: diffie_hellman_sha1 (kex.c:459)
==11004== by 0x4E423E6: kex_method_diffie_hellman_group14_sha1_key_exchange (kex.c:806)
==11004== by 0x4E42EC9: _libssh2_kex_exchange (kex.c:1777)
==11004== by 0x4E498C6: libssh2_session_handshake (session.c:723)
==11004== by 0x400FCA: main2() (temp.cpp:37)
==11004== by 0x401221: main (temp.cpp:77)
==11004==
==11004== 357 bytes in 17 blocks are definitely lost in loss record 504 of 521
==11004== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11004== by 0x4E49862: libssh2_session_handshake (session.c:172)
==11004== by 0x400FCA: main2() (temp.cpp:37)
==11004== by 0x401221: main (temp.cpp:77)
==11004==
==11004== 680 bytes in 17 blocks are definitely lost in loss record 507 of 521
==11004== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11004== by 0x4E41891: diffie_hellman_sha1 (kex.c:574)
==11004== by 0x4E423E6: kex_method_diffie_hellman_group14_sha1_key_exchange (kex.c:806)
==11004== by 0x4E42EC9: _libssh2_kex_exchange (kex.c:1777)
==11004== by 0x4E498C6: libssh2_session_handshake (session.c:723)
==11004== by 0x400FCA: main2() (temp.cpp:37)
==11004== by 0x401221: main (temp.cpp:77)
==11004==
==11004== 680 bytes in 17 blocks are definitely lost in loss record 508 of 521
==11004== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11004== by 0x4E41B51: diffie_hellman_sha1 (kex.c:600)
==11004== by 0x4E423E6: kex_method_diffie_hellman_group14_sha1_key_exchange (kex.c:806)
==11004== by 0x4E42EC9: _libssh2_kex_exchange (kex.c:1777)
==11004== by 0x4E498C6: libssh2_session_handshake (session.c:723)
==11004== by 0x400FCA: main2() (temp.cpp:37)
==11004== by 0x401221: main (temp.cpp:77)
==11004==
==11004== 2,567 bytes in 17 blocks are definitely lost in loss record 514 of 521
==11004== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11004== by 0x4E40ED1: diffie_hellman_sha1 (kex.c:206)
==11004== by 0x4E423E6: kex_method_diffie_hellman_group14_sha1_key_exchange (kex.c:806)
==11004== by 0x4E42EC9: _libssh2_kex_exchange (kex.c:1777)
==11004== by 0x4E498C6: libssh2_session_handshake (session.c:723)
==11004== by 0x400FCA: main2() (temp.cpp:37)
==11004== by 0x401221: main (temp.cpp:77)
==11004==
==11004== 7,616 (3,128 direct, 4,488 indirect) bytes in 17 blocks are definitely lost in loss record 518 of 521
==11004== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11004== by 0x4E4019C: crypt_init (crypt.c:80)
==11004== by 0x4E4159B: diffie_hellman_sha1 (kex.c:498)
==11004== by 0x4E423E6: kex_method_diffie_hellman_group14_sha1_key_exchange (kex.c:806)
==11004== by 0x4E42EC9: _libssh2_kex_exchange (kex.c:1777)
==11004== by 0x4E498C6: libssh2_session_handshake (session.c:723)
==11004== by 0x400FCA: main2() (temp.cpp:37)
==11004== by 0x401221: main (temp.cpp:77)
==11004==
==11004== 7,616 (3,128 direct, 4,488 indirect) bytes in 17 blocks are definitely lost in loss record 519 of 521
==11004== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11004== by 0x4E4019C: crypt_init (crypt.c:80)
==11004== by 0x4E41802: diffie_hellman_sha1 (kex.c:545)
==11004== by 0x4E423E6: kex_method_diffie_hellman_group14_sha1_key_exchange (kex.c:806)
==11004== by 0x4E42EC9: _libssh2_kex_exchange (kex.c:1777)
==11004== by 0x4E498C6: libssh2_session_handshake (session.c:723)
==11004== by 0x400FCA: main2() (temp.cpp:37)
==11004== by 0x401221: main (temp.cpp:77)
==11004==
==11004== 11,120 (11,008 direct, 112 indirect) bytes in 16 blocks are definitely lost in loss record 520 of 521
==11004== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11004== by 0x4E44604: _libssh2_calloc (misc.c:625)
==11004== by 0x4E3CBD6: _libssh2_channel_open (channel.c:161)
==11004== by 0x4E3CEAE: libssh2_channel_open_ex (channel.c:349)
==11004== by 0x401050: main2() (temp.cpp:39)
==11004== by 0x401221: main (temp.cpp:77)
==11004==
==11004== 14,552 (2,856 direct, 11,696 indirect) bytes in 17 blocks are definitely lost in loss record 521 of 521
==11004== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11004== by 0x5486D72: CRYPTO_malloc (in /lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==11004== by 0x54EF82E: RSA_new_method (in /lib/x86_64-linux-gnu/libcrypto.so.1.0.0)
==11004== by 0x4E55876: _libssh2_rsa_new (openssl.c:69)
==11004== by 0x4E408A5: hostkey_method_ssh_rsa_init (hostkey.c:95)
==11004== by 0x4E40F5A: diffie_hellman_sha1 (kex.c:274)
==11004== by 0x4E423E6: kex_method_diffie_hellman_group14_sha1_key_exchange (kex.c:806)
==11004== by 0x4E42EC9: _libssh2_kex_exchange (kex.c:1777)
==11004== by 0x4E498C6: libssh2_session_handshake (session.c:723)
==11004== by 0x400FCA: main2() (temp.cpp:37)
==11004== by 0x401221: main (temp.cpp:77)
==11004==
==11004== LEAK SUMMARY:
==11004== definitely lost: 24,744 bytes in 152 blocks
==11004== indirectly lost: 20,784 bytes in 169 blocks
==11004== possibly lost: 0 bytes in 0 blocks
==11004== still reachable: 14,119 bytes in 502 blocks
==11004== suppressed: 0 bytes in 0 blocks
==11004== Reachable blocks (those to which a pointer was found) are not shown.
==11004== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==11004==
==11004== For counts of detected and suppressed errors, rerun with: -v
==11004== ERROR SUMMARY: 17 errors from 10 contexts (suppressed: 0 from 0)

from libssh2.

I am observing that if my channel is blocking then there is no leak but if i make channel as non-blocking then there is leak.

from libssh2.

hey buddy,
If the channel is blocking then there is no issue for memleak but for non-blocking channel there is memleak. that is what I find :)

thanks,
Swapnil

from libssh2.

In non-blocking mode, you need to check the return value of libssh2_session_free and handle LIBSSH2_ERROR_EAGAIN in your code. Otherwise you are leaking resources in case any blocking happens during the cleanup.

from libssh2.