File: src/ServerUDPSocket.cpp, CServerUDPSocket::SendQueue(), ~line 429
Severity: Low (only triggers on wxThread Create/Run failure)
Type: new without matching cleanup on an error path
Description
A detached CAsyncDNS thread (class CAsyncDNS : public wxThread, constructed
with wxTHREAD_DETACHED) is allocated to resolve a server hostname before
sending a queued UDP packet. If Create() or Run() fails, the code drops the
packet and continues the loop without cleaning the object up. For a detached
wxThread that never started running, Delete() is the required cleanup, so the
heap object leaks.
CAsyncDNS* dns = new CAsyncDNS(item.addr, DNS_UDP, theApp, this);
if ((dns->Create() != wxTHREAD_NO_ERROR) || (dns->Run() != wxTHREAD_NO_ERROR)) {
// Not much we can do here, just drop the packet.
m_queue.pop_front();
continue; // <-- leaks dns
}
Impact
Leaks one CAsyncDNS object per DNS-thread creation failure during server UDP
sends. Rare in normal operation, but unbounded under thread-exhaustion
conditions.
Reference (correct pattern already used elsewhere in the codebase)
src/DownloadQueue.cpp (~line 1400) handles the identical failure correctly:
if ((dns->Create() != wxTHREAD_NO_ERROR) || (dns->Run() != wxTHREAD_NO_ERROR)) {
dns->Delete();
m_toresolve.pop_front();
} else {
break;
}
The fix should mirror that: call dns->Delete() before continue.
File:
src/ServerUDPSocket.cpp,CServerUDPSocket::SendQueue(), ~line 429Severity: Low (only triggers on
wxThreadCreate/Run failure)Type:
newwithout matching cleanup on an error pathDescription
A detached
CAsyncDNSthread (class CAsyncDNS : public wxThread, constructedwith
wxTHREAD_DETACHED) is allocated to resolve a server hostname beforesending a queued UDP packet. If
Create()orRun()fails, the code drops thepacket and
continues the loop without cleaning the object up. For a detachedwxThreadthat never started running,Delete()is the required cleanup, so theheap object leaks.
Impact
Leaks one
CAsyncDNSobject per DNS-thread creation failure during server UDPsends. Rare in normal operation, but unbounded under thread-exhaustion
conditions.
Reference (correct pattern already used elsewhere in the codebase)
src/DownloadQueue.cpp(~line 1400) handles the identical failure correctly:The fix should mirror that: call
dns->Delete()beforecontinue.