P4: Standalone web API leaks the parsed body of every request
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start in code/network/stand_gui-unix.cpp at the request handler where json_loads fills context.requestEntity, and check where that pointer is released. Build with -DGCC_ENABLE_ADDRESS_SANITIZER=ON, run the standalone server, and send several POST /api/1/chat requests. Done when AddressSanitizer reports no leaks from the web API; the issue lists three possible fixes, so pick the simplest one that frees the entity on every path.
Written by the indexing model from the issue text.
Description
Problem
This is minor: a small leak on a server that stays up a long time.
The standalone server's web API never frees the parsed body of a request. Every request with a body (for example each chat message sent from the web panel) leaks a few hundred bytes, so a long-running server with an active panel slowly grows.
Steps to reproduce
- Build current master (8afa31842) with
-DGCC_ENABLE_ADDRESS_SANITIZER=ONon Linux. - Start a standalone server with MediaVPs 5.0.2 and its web panel.
- Send 20 chat messages through the web API (POST /api/1/chat with
{"message": "..."}), then stop the server.
Expected vs. actual behavior
Expected: no leaks from the web API.
Actual: AddressSanitizer reports leaks of 21 objects each (one per request with a body) allocated inside json_loads, called from the request handler in code/network/stand_gui-unix.cpp.
Proposed fixes
- Call
json_decref(context.requestEntity)after the handler returns (it accepts NULL, so no check is needed). - Give the request context a destructor that releases the entity, so every path frees it.
- Parse into a holder that frees itself (a small RAII wrapper around the jansson pointer) and pass handlers a borrowed pointer.
- Dominant language
- C++
- Stars
- 488
- Forks
- 184
- Avg merge
- 6d 3m
- Merged PRs (30d)
- 41
Getting set up
We have not checked this project's setup files yet. Start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from scp-fs2open/fs2open.github.com
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
scp-fs2open/fs2open.github.com#7983 ·
Maintainers usually reply within 2 days
-
P4: Standalone web API can read past its request buffer on a large request bodyPossibly taken @dustinspace217 claimed this 5 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
scp-fs2open/fs2open.github.com#7965 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
scp-fs2open/fs2open.github.com#7956 ·
Maintainers usually reply within 2 days
-
bug HUD LLM-suggested
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
scp-fs2open/fs2open.github.com#7953 ·
Maintainers usually reply within 2 days
-
P4: Lua io.AxisInverted always failsPossibly taken @Goober5000 claimed this 31 days ago. Openbug controls LLM-suggested
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
scp-fs2open/fs2open.github.com#7946 · 3 comments ·
Maintainers usually reply within 2 days
All issues in scp-fs2open/fs2open.github.com
Similar issues
-
Difficulty 1/5 1-3 hours Newbie friendliness 68/100
eic/TimeframeBuilder#102 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
AcademySoftwareFoundation/OpenImageIO#5662 ·
Maintainers usually reply within 2 days
-
python
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
OpenChemistry/avogadrolibs#3295 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Tracktion/tracktion_engine#482 ·
Maintainers usually reply within 1 day