fixed a memleak, a static string free, an access of freed memory etc

3 files changed, 14 insertions, 8 deletions

diff --git a/src/cadet/gnunet-service-cadet_connection.c b/src/cadet/gnunet-service-cadet_connection.c
index 9dfecf043..babb00d66 100644
--- a/src/cadet/gnunet-service-cadet_connection.c
+++ b/src/cadet/gnunet-service-cadet_connection.c
@@ -3482,6 +3482,13 @@ GCC_send_prebuilt_message (const struct GNUNET_MessageHeader *message,
   int droppable;
 
   GCC_check_connections ();
+  fc = fwd ? &c->fwd_fc : &c->bck_fc;
+  if (0 == fc->queue_max)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
+
   size = ntohs (message->size);
   data = GNUNET_malloc (size);
   GNUNET_memcpy (data, message, size);
@@ -3490,13 +3497,6 @@ GCC_send_prebuilt_message (const struct GNUNET_MessageHeader *message,
        "--> %s (%s %4u) on conn %s (%p) %s [%5u]\n",
        GC_m2s (type), GC_m2s (payload_type), payload_id, GCC_2s (c), c,
        GC_f2s(fwd), size);
-
-  fc = fwd ? &c->fwd_fc : &c->bck_fc;
-  if (0 == fc->queue_max)
-  {
-    GNUNET_break (0);
-    return NULL;
-  }
   droppable = GNUNET_NO == force;
   switch (type)
   {
diff --git a/src/cadet/gnunet-service-cadet_peer.c b/src/cadet/gnunet-service-cadet_peer.c
index e19c3ca48..fa338f13f 100644
--- a/src/cadet/gnunet-service-cadet_peer.c
+++ b/src/cadet/gnunet-service-cadet_peer.c
@@ -787,7 +787,12 @@ peer_destroy (struct CadetPeer *peer)
     GNUNET_ATS_connectivity_suggest_cancel (peer->connectivity_suggestion);
     peer->connectivity_suggestion = NULL;
   }
-  while (NULL != peer->queue_head)
+    /* Following check was 'while' instead of 'if', but GCP_queue_destroy
+     * frees 'peer->queue_head' so the while checks on freed memory.
+     * Not sure if 'if' is what you wanted, but 'while' can't be
+     * correct. --lynX
+     */
+  if (NULL != peer->queue_head)
   {
     GCP_queue_destroy (peer->queue_head, GNUNET_YES, GNUNET_NO, 0);
   }
diff --git a/src/cadet/gnunet-service-cadet_tunnel.c b/src/cadet/gnunet-service-cadet_tunnel.c
index bdb8a8ea4..565ddf411 100644
--- a/src/cadet/gnunet-service-cadet_tunnel.c
+++ b/src/cadet/gnunet-service-cadet_tunnel.c
@@ -4252,6 +4252,7 @@ GCT_send_connection_acks (struct CadetTunnel *t)
     {
       continue;
     }
+    GNUNET_assert(cs != 0);
     allow_per_connection = to_allow/cs;
     to_allow -= allow_per_connection;
     cs--;