search

signalapp / libsignal-protocol-c

GNU General Public License v3.0
1.41k stars 295 forks source link

Potential leak in session_cipher_get_remote_registration_id #127

Closed fabricedesre closed 5 years ago

fabricedesre commented 5 years ago

I have:

Bug description

Describe here the issue that you are experiencing.

In https://github.com/signalapp/libsignal-protocol-c/blob/677e5b91f038317595eab1212adb7e7800a20928/src/session_cipher.c#L723 a session_state is allocated but is never freed. I checked that the ref_count is one.

Maybe I'm misusing the library but I don't see a way for callers to release this object.

Thanks!

hartwork commented 4 years ago

It would be great to have a new release with the fixes from 71954c53860b83e358c9d8c4898d003f16ace375 so that they arrive in Linux distros. Thank you!

dkonigsberg commented 4 years ago

This request has been made before, and acting on it is long overdue. As such, I've just stamped the latest code as v2.3.3

hartwork commented 4 years ago

Very cool — thank you! :tada: