This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC3220SF: GetEntireFile in OtaArchive.c free is not called after malloc

Part Number: CC3220SF

Hi,

    I think there's a memory leak ,Please help to confirm

ti\simplelink_cc32xx_sdk_6_10_00_05_\source\ti\net\ota\source\OtaArchive.c Line:123

int16_t GetEntireFile(uint8_t *pRecvBuf, int16_t RecvBufLen, int16_t *ProcessedSize, uint32_t FileSize, char **pFile)
{
    int16_t        copyLen = 0;
    static bool    firstRun = TRUE;
    static int16_t TotalRecvBufLen = 0;
    
	if (firstRun)
    {
        TotalRecvBufLen = RecvBufLen;
        firstRun = FALSE;
        if (TotalRecvBufLen < FileSize)
        {
             /* verify that FileSize  not bigger then the max uint32_t value */
            if (FileSize >= (uint32_t)MaxUint32_t)
            {
                return ARCHIVE_STATUS_ERROR_BUNDLE_CMD_FILE_NAME_MAX_LEN;
            }
            /* Didn't receive the entire file in the first run. */
            /* Allocate a buffer in the size of the entire file and fill it in each round. */
            pTempBuf = (char*)malloc(FileSize+1);
            if (pTempBuf == NULL)
            {
                /* Allocation failed, return error. */
                return -1;
            }
            memcpy(pTempBuf, (char *)pRecvBuf, RecvBufLen);
            *ProcessedSize = RecvBufLen;

            /* didn't receive the entire file, try in the next packet */
            return GET_ENTIRE_FILE_CONTINUE;
        }
        else
        {
            /* Received the entire file in the first run. */
            /* No additional memory allocation is needed. */
            *ProcessedSize = FileSize;
            *pFile = (char *)pRecvBuf;
        }
    }
    else
    {
        /* Avoid exceeding buffer size (FileSize + 1) */
        if (RecvBufLen > ((FileSize + 1) -TotalRecvBufLen))
        {
            copyLen = ((FileSize + 1) -TotalRecvBufLen);
        }
        else
        {
            copyLen = RecvBufLen;
        }

        /* Copy the received buffer from where we stopped the previous copy */
        memcpy(&(pTempBuf[TotalRecvBufLen]), (char *)pRecvBuf, copyLen);

        *ProcessedSize = copyLen;
        TotalRecvBufLen += copyLen;

        if (TotalRecvBufLen < FileSize)
        {
            /* didn't receive the entire file, try in the next packet */
            return GET_ENTIRE_FILE_CONTINUE;
        }

        /* At this point we have the whole file */
        *pFile = (char *)pTempBuf;
    }

    /* Set static variables to initial values to allow retry in case of a warning during the OTA process */
    firstRun = TRUE;
    TotalRecvBufLen = 0;

    return GET_ENTIRE_FILE_DONE;
}

  • Hi,

    It definitely looks like the buffer is not released. I guess that is what you meant.

    Have you tested and verified this?

    We are planning a long-term SDK soon and we will try to push the fix but it is probably too late so I'll add the fix here (once we verify the bug and the fix). 

    Br,

    Kobi

  • Please note that the priority of this will be low - as a successful OTA ends with a soft reset so the impact of the leak will only be relevant for the rare cases where OTA processing starts but fails.