From 67fe32672b60afd6cf91f7a3ccc969259dc68a19 Mon Sep 17 00:00:00 2001
From: Tatsuzo Osawa <tatsuzo.osawa@gmail.com>
Date: Thu, 24 Aug 2017 12:22:33 +0000
Subject: [PATCH] Fix subs memory issue.

Patches retrieved from: https://github.com/eclipse/mosquitto/pull/531

Both patches have been merged in a single one as second patch is putting
back code that is wrongly deleted in first patch.
First patch needs also an update to apply on version 1.5

Signed-off-by: Tatsuzo Osawa <tatsuzo.osawa@gmail.com>
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
 src/database.c                  | 16 ++++++++++++----
 src/mosquitto_broker_internal.h |  4 ++--
 src/subs.c                      | 21 ++++++++++++---------
 3 files changed, 26 insertions(+), 15 deletions(-)

diff --git a/src/database.c b/src/database.c
index 670cf710..9e02de2d 100644
--- a/src/database.c
+++ b/src/database.c
@@ -12,6 +12,7 @@ and the Eclipse Distribution License is available at
  
 Contributors:
    Roger Light - initial implementation and documentation.
+   Tatsuzo Osawa - Fix subs memory issue.
 */
 
 #include <assert.h>
@@ -121,10 +122,10 @@ int db__open(struct mosquitto__config *config, struct mosquitto_db *db)
 
 	db->subs = NULL;
 
-	subhier = sub__add_hier_entry(&db->subs, "", strlen(""));
+	subhier = sub__add_hier_entry(NULL, &db->subs, "", strlen(""));
 	if(!subhier) return MOSQ_ERR_NOMEM;
 
-	subhier = sub__add_hier_entry(&db->subs, "$SYS", strlen("$SYS"));
+	subhier = sub__add_hier_entry(NULL, &db->subs, "$SYS", strlen("$SYS"));
 	if(!subhier) return MOSQ_ERR_NOMEM;
 
 	db->unpwd = NULL;
diff --git a/src/mosquitto_broker_internal.h b/src/mosquitto_broker_internal.h
index 3508c555..808b4f2b 100644
--- a/src/mosquitto_broker_internal.h
+++ b/src/mosquitto_broker_internal.h
@@ -12,7 +12,7 @@ and the Eclipse Distribution License is available at
  
 Contributors:
    Roger Light - initial implementation and documentation.
-   Tatsuzo Osawa - Add epoll.
+   Tatsuzo Osawa - Add epoll. Fix subs memory issue.
 */
 
 #ifndef MOSQUITTO_BROKER_INTERNAL_H
@@ -547,7 +547,7 @@ void sys_tree__update(struct mosquitto_db *db, int interval, time_t start_time);
  * Subscription functions
  * ============================================================ */
 int sub__add(struct mosquitto_db *db, struct mosquitto *context, const char *sub, int qos, struct mosquitto__subhier **root);
-struct mosquitto__subhier *sub__add_hier_entry(struct mosquitto__subhier **parent, const char *topic, size_t len);
+struct mosquitto__subhier *sub__add_hier_entry(struct mosquitto__subhier *parent, struct mosquitto__subhier **head, const char *topic, size_t len);
 int sub__remove(struct mosquitto_db *db, struct mosquitto *context, const char *sub, struct mosquitto__subhier *root);
 void sub__tree_print(struct mosquitto__subhier *root, int level);
 int sub__clean_session(struct mosquitto_db *db, struct mosquitto *context);
diff --git a/src/subs.c b/src/subs.c
index 7b9b457c..b1c0fc78 100644
--- a/src/subs.c
+++ b/src/subs.c
@@ -12,6 +12,7 @@ and the Eclipse Distribution License is available at
  
 Contributors:
    Roger Light - initial implementation and documentation.
+   Tatsuzo Osawa - Fix subs memory issue.
 */
 
 /* A note on matching topic subscriptions.
@@ -314,7 +315,7 @@ static int sub__add_recurse(struct mosquitto_db *db, struct mosquitto *context,
 		return sub__add_recurse(db, context, qos, branch, tokens->next);
 	}else{
 		/* Not found */
-		branch = sub__add_hier_entry(&subhier->children, UHPA_ACCESS_TOPIC(tokens), tokens->topic_len+1);
+		branch = sub__add_hier_entry(subhier, &subhier->children, UHPA_ACCESS_TOPIC(tokens), tokens->topic_len+1);
 		if(!branch) return MOSQ_ERR_NOMEM;
 
 		return sub__add_recurse(db, context, qos, branch, tokens->next);
@@ -406,18 +407,18 @@ static void sub__search(struct mosquitto_db *db, struct mosquitto__subhier *subh
 }
 
 
-struct mosquitto__subhier *sub__add_hier_entry(struct mosquitto__subhier **parent, const char *topic, size_t len)
+struct mosquitto__subhier *sub__add_hier_entry(struct mosquitto__subhier *parent, struct mosquitto__subhier **head, const char *topic, size_t len)
 {
 	struct mosquitto__subhier *child;
 
-	assert(parent);
+	assert(head);
 
 	child = mosquitto__malloc(sizeof(struct mosquitto__subhier));
 	if(!child){
 		log__printf(NULL, MOSQ_LOG_ERR, "Error: Out of memory.");
 		return NULL;
 	}
-	child->parent = *parent;
+	child->parent = parent;
 	child->topic_len = strlen(topic);
 	if(UHPA_ALLOC_TOPIC(child) == 0){
 		child->topic_len = 0;
@@ -433,13 +434,13 @@ struct mosquitto__subhier *sub__add_hier_entry(struct mosquitto__subhier **paren
 
 	if(child->topic_len+1 > sizeof(child->topic.array)){
 		if(child->topic.ptr){
-			HASH_ADD_KEYPTR(hh, *parent, child->topic.ptr, child->topic_len, child);
+			HASH_ADD_KEYPTR(hh, *head, child->topic.ptr, child->topic_len, child);
 		}else{
 			mosquitto__free(child);
 			return NULL;
 		}
 	}else{
-		HASH_ADD(hh, *parent, topic.array, child->topic_len, child);
+		HASH_ADD(hh, *head, topic.array, child->topic_len, child);
 	}
 
 	return child;
@@ -460,7 +461,7 @@ int sub__add(struct mosquitto_db *db, struct mosquitto *context, const char *sub
 
 	HASH_FIND(hh, *root, UHPA_ACCESS_TOPIC(tokens), tokens->topic_len, subhier);
 	if(!subhier){
-		subhier = sub__add_hier_entry(root, UHPA_ACCESS_TOPIC(tokens), tokens->topic_len+1);
+		subhier = sub__add_hier_entry(NULL, root, UHPA_ACCESS_TOPIC(tokens), tokens->topic_len+1);
 		if(!subhier){
 			sub__topic_tokens_free(tokens);
 			log__printf(NULL, MOSQ_LOG_ERR, "Error: Out of memory.");
@@ -545,12 +546,14 @@ static struct mosquitto__subhier *tmp_remove_subs(struct mosquitto__subhier *sub
 		return NULL;
 	}
 
-	if(sub->children || sub->subs){
+	if(sub->children || sub->subs || sub->retained){
 		return NULL;
 	}
 
 	parent = sub->parent;
-	HASH_DELETE(hh, parent, sub);
+	HASH_DELETE(hh, parent->children, sub);
+	UHPA_FREE_TOPIC(sub);
+	mosquitto__free(sub);
 
 	if(parent->subs == NULL
 			&& parent->children == NULL