| 
      
      
      From: Dan E. <Dan...@ne...> - 2006-08-24 08:39:41
      
     | 
| Adam Kropelin wrote:
> On Wed, Aug 23, 2006 at 04:11:55PM +0100, Dan Ellis wrote:
>> There's a small memory leak in usb_control_msg, in the case that
>> usb_io_sync fails and it's an OUT, then the malloced block doesn't
>> get freed:
>=20
> Hi, Dan,
>=20
> Thanks for posting about this bug and others. Have you considered
> posting patches to fix the bugs? That way myself and other users
> could try them out and Stephan, who I am sure is very busy, could
> review and apply the changes without having to implement them.  =20
Good idea, here are the fixes for the memory leak and the corruption.
The diff :
Index: src/windows.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- windows.c	2006/08/08 16:16:03	1.52
+++ windows.c	2006/08/20 17:00:38	(working copy)
@@ -784,6 +784,11 @@
     {
       usb_error("usb_control_msg: sending control message failed, "
                 "win error: %s", usb_win_error_to_string());
+     =20
+      if(!(requesttype & USB_ENDPOINT_IN))
+	{
+	free(out);
+	}
       return -usb_win_error_to_errno();
     }
=20
@@ -1102,6 +1107,7 @@
           free(bus->root_dev->children);
         }
=20
+      bus->root_dev->num_children =3D 0;
       for(dev =3D bus->devices; dev; dev =3D dev->next)
         bus->root_dev->num_children++;
=20
 |