session: Added API function to free session internals

This fixes a possible memory leak when working with sessions (especially with some non-mainline fcgi patches). Quoting from the ticket: The global variable `sess_fname` is a pointer to dynamically allocated memory which happens either in `sess_generate_id()` or in `cgi_session_start()`. However this memory is never freed. To not expose the variable globally or even just to `cgi.c` where e.g. `cgi_end()` could access it, a new API function is introduced. We leave bumping the API version up to a follow up commit. Fixes: rafaelsteil#25 Signed-off-by: Alexander Dahl <[email protected]>
LeSpocky · Jul 12, 2018 · 9531f70 · 9531f70
1 parent f8808df
commit 9531f70
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 1 deletion.
diff --git a/src/cgi.h b/src/cgi.h
@@ -115,6 +115,17 @@ extern void cgi_session_cookie_name(const char *cookie_name);
 extern char *cgi_session_var(const char *name);
 extern void cgi_session_save_path(const char *path);
 
+/**
+ *	Free all remaining things explicitly or implicitly allocated by a
+ *	session.
+ *
+ *	@note	This is some kind of workaround, you still have to call
+ *			cgi_end(), but maybe not cgi_destroy() … :-/
+ *
+ *	@see	https://github.com/rafaelsteil/libcgi/issues/25
+ */
+void cgi_session_free( void );
+
 #ifdef __cplusplus
 }
 #endif

diff --git a/src/session.c b/src/session.c
@@ -56,6 +56,7 @@
 * @{
 */
 
+#include <stddef.h>
 #include <stdio.h>
 #include <string.h>
 #include <sys/time.h>
@@ -76,7 +77,7 @@
 FILE *sess_file;
 
 static char sess_id[SESS_ID_LEN + 1];
-static char *sess_fname;
+static char *sess_fname = NULL;
 static unsigned int save_path_len;
 
 char SESSION_SAVE_PATH[255] = "/tmp/";
@@ -550,6 +551,12 @@ int cgi_session_start()
 	return 1;
 }
 
+void cgi_session_free( void )
+{
+	free( sess_fname );
+	sess_fname = NULL;
+}
+
 /**
 * @}
 */