Skip to content

Memory leak: CAsyncDNS thread object leaked when thread creation fails #876

Description

@ngosang

File: src/ServerUDPSocket.cpp, CServerUDPSocket::SendQueue(), ~line 429
Severity: Low (only triggers on wxThread Create/Run failure)
Type: new without matching cleanup on an error path

Description

A detached CAsyncDNS thread (class CAsyncDNS : public wxThread, constructed
with wxTHREAD_DETACHED) is allocated to resolve a server hostname before
sending a queued UDP packet. If Create() or Run() fails, the code drops the
packet and continues the loop without cleaning the object up. For a detached
wxThread that never started running, Delete() is the required cleanup, so the
heap object leaks.

CAsyncDNS* dns = new CAsyncDNS(item.addr, DNS_UDP, theApp, this);
if ((dns->Create() != wxTHREAD_NO_ERROR) || (dns->Run() != wxTHREAD_NO_ERROR)) {
    // Not much we can do here, just drop the packet.
    m_queue.pop_front();
    continue;                           // <-- leaks dns
}

Impact

Leaks one CAsyncDNS object per DNS-thread creation failure during server UDP
sends. Rare in normal operation, but unbounded under thread-exhaustion
conditions.

Reference (correct pattern already used elsewhere in the codebase)

src/DownloadQueue.cpp (~line 1400) handles the identical failure correctly:

if ((dns->Create() != wxTHREAD_NO_ERROR) || (dns->Run() != wxTHREAD_NO_ERROR)) {
    dns->Delete();
    m_toresolve.pop_front();
} else {
    break;
}

The fix should mirror that: call dns->Delete() before continue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions