magiclantern_simplified icon indicating copy to clipboard operation
magiclantern_simplified copied to clipboard

EDmac module can leak significant amounts of mem

Open reticulatedpines opened this issue 1 year ago • 0 comments

CreateResLockEntry() returns LockEntry *. modules/edmac/edmac.c can do this in a loop due to find_free_edmac_channels(), and never frees it.

LockEntry has pResources that is also allocated inside CreateResLockEntry(), of variable size (although fixed and small in the case of find_free_edmac_channels()). Max is 32 loops, on 200D 0x28 bytes per loop, 1280 bytes max per call.

Presumably we should free pResources and the LockEntry, although I have not tested this. I think you want to Unlock before the free, to remove avoid dangling pointers in ResourceInfo_global.

Things to check:

  • is it really a leak? I believe this only due to static analysis on 200D, wants to be tested
  • is the free safe on all gens? Only checked 200D code so far
  • audit all other uses of CreateResLockEntry() (quick check suggests we never free, but maybe we only assign once so it doesn't matter, we never lose the ref)

reticulatedpines avatar Dec 26 '23 01:12 reticulatedpines