From 617ea7fe4edf56744534eab9c20c3db7f8eb4644 Mon Sep 17 00:00:00 2001 From: fengzero Date: Wed, 1 Jul 2026 09:04:14 +0000 Subject: [PATCH] fix double free --- plugins/ekuiper/read_write.c | 3 ++- plugins/restful/plugin_handle.c | 4 ++-- src/core/manager.c | 22 +++++++++------------- src/parser/neu_json_fn.c | 1 - 4 files changed, 13 insertions(+), 17 deletions(-) diff --git a/plugins/ekuiper/read_write.c b/plugins/ekuiper/read_write.c index cbf2533de..44fb966a6 100644 --- a/plugins/ekuiper/read_write.c +++ b/plugins/ekuiper/read_write.c @@ -274,7 +274,8 @@ static int json_value_to_tag_value(union neu_json_value *req, break; case NEU_JSON_STR: value->type = NEU_TYPE_STRING; - strncpy(value->value.str, req->val_str, sizeof(value->value.str)); + strncpy(value->value.str, req->val_str, sizeof(value->value.str) - 1); + value->value.str[sizeof(value->value.str) - 1] = '\0'; break; case NEU_JSON_DOUBLE: value->type = NEU_TYPE_DOUBLE; diff --git a/plugins/restful/plugin_handle.c b/plugins/restful/plugin_handle.c index 65c8f9b12..1e1c07708 100644 --- a/plugins/restful/plugin_handle.c +++ b/plugins/restful/plugin_handle.c @@ -41,7 +41,7 @@ void handle_add_plugin(nng_aio *aio) header.ctx = aio; header.type = NEU_REQ_ADD_PLUGIN; header.otel_trace_type = NEU_OTEL_TRACE_TYPE_REST_COMM; - strncpy(cmd.library, req->library, NEU_PLUGIN_LIBRARY_LEN); + strncpy(cmd.library, req->library, NEU_PLUGIN_LIBRARY_LEN - 1); cmd.schema_file = req->schema_file; cmd.so_file = req->so_file; ret = neu_plugin_op(plugin, header, &cmd); @@ -66,7 +66,7 @@ void handle_update_plugin(nng_aio *aio) header.ctx = aio; header.type = NEU_REQ_UPDATE_PLUGIN; header.otel_trace_type = NEU_OTEL_TRACE_TYPE_REST_COMM; - strncpy(cmd.library, req->library, NEU_PLUGIN_LIBRARY_LEN); + strncpy(cmd.library, req->library, NEU_PLUGIN_LIBRARY_LEN - 1); cmd.schema_file = req->schema_file; cmd.so_file = req->so_file; ret = neu_plugin_op(plugin, header, &cmd); diff --git a/src/core/manager.c b/src/core/manager.c index 959787139..ef42cba28 100644 --- a/src/core/manager.c +++ b/src/core/manager.c @@ -1486,21 +1486,18 @@ static int manager_loop(enum neu_event_io_type type, int fd, void *usr_data) UT_array *apps = neu_subscribe_manager_find( manager->subscribe_manager, cmd->driver, cmd->group); - forward_msg(manager, header, header->receiver); neu_subscribe_manager_remove(manager->subscribe_manager, cmd->driver, cmd->group); - if (NULL == apps) { - break; - } - - // notify app node about group deletion - utarray_foreach(apps, neu_app_subscribe_t *, app) - { - forward_msg_copy(manager, header, app->app_name); + if (NULL != apps) { + utarray_foreach(apps, neu_app_subscribe_t *, app) + { + forward_msg_copy(manager, header, app->app_name); + } + utarray_free(apps); } - utarray_free(apps); + forward_msg(manager, header, header->receiver); } break; } @@ -1518,13 +1515,10 @@ static int manager_loop(enum neu_event_io_type type, int fd, void *usr_data) neu_msg_exchange(header); reply(manager, header, &e); } else { - forward_msg(manager, header, header->receiver); - UT_array *apps = neu_subscribe_manager_find( manager->subscribe_manager, cmd->driver, cmd->group); if (NULL != apps) { - // notify app nodes about tag deletion utarray_foreach(apps, neu_app_subscribe_t *, app) { neu_msg_t *msg_copy = neu_msg_copy((neu_msg_t *) header); @@ -1538,6 +1532,8 @@ static int manager_loop(enum neu_event_io_type type, int fd, void *usr_data) utarray_free(apps); } + + forward_msg(manager, header, header->receiver); } break; diff --git a/src/parser/neu_json_fn.c b/src/parser/neu_json_fn.c index 04dd042fe..35d97cf2d 100644 --- a/src/parser/neu_json_fn.c +++ b/src/parser/neu_json_fn.c @@ -110,7 +110,6 @@ int neu_parse_param(const char *buf, char **err_param, int n, int ret = 0; if (neu_json_decode_value(json, ¶ms_ele) != 0) { - neu_json_decode_free(json); if (err_param) { *err_param = strdup("params"); }