Bug: Server leaks Config in non-multithreaded handler path #158

New Issue

2026-07-29T18:34:59+02:00

TapTap commented

2026-07-29 18:34:59 +02:00

Description

In the server handler (src/server/server.c:77-113), the multithreading path frees the Config via pipeline_context_receiver_destroy(), but the non-multithreading path calls receive_files(config, file_descriptor) and then falls through to close(file_descriptor) without ever freeing config. Every non-multithreaded TCP or SSH connection leaks the entire received configuration.

This is also reachable in --stdio mode, which is the SSH transport path and therefore leaks once per SSH invocation.

Location

src/server/server.c:111 — receive_files(config, file_descriptor); is called without a matching config_delete(config).
src/server/server.c:109 — multithreading path correctly destroys the context.

Suggested fix

Add config_delete(config); after the non-multithreaded receive_files() call.
Refactor the handler so that cleanup is centralized and cannot be missed.

Severity

High

Category

bug

This issue was automatically generated by the issue-creator agent.

## Description In the server handler (`src/server/server.c:77-113`), the multithreading path frees the `Config` via `pipeline_context_receiver_destroy()`, but the non-multithreading path calls `receive_files(config, file_descriptor)` and then falls through to `close(file_descriptor)` without ever freeing `config`. Every non-multithreaded TCP or SSH connection leaks the entire received configuration. This is also reachable in `--stdio` mode, which is the SSH transport path and therefore leaks once per SSH invocation. ## Location - `src/server/server.c:111` — `receive_files(config, file_descriptor);` is called without a matching `config_delete(config)`. - `src/server/server.c:109` — multithreading path correctly destroys the context. ## Suggested fix 1. Add `config_delete(config);` after the non-multithreaded `receive_files()` call. 2. Refactor the handler so that cleanup is centralized and cannot be missed. ## Severity High ## Category bug --- _This issue was automatically generated by the issue-creator agent._

TapTap added the bug needs-triage memory labels 2026-07-29 18:34:59 +02:00

TapTap referenced this issue from a commit

2026-07-29 19:02:14 +02:00

fix: resolve all bug issues (#158, #163, #164, #165, #166, #167, #168, #169)

TapTap referenced this issue from a commit

2026-07-29 19:11:17 +02:00

fix: resolve all bug issues (#158, #163, #164, #165, #166, #167, #168, #169)

TapTap referenced this issue

2026-07-29 19:29:55 +02:00

Comprehensive fix: security, bugs, refactoring, tests, and rsync parity features #173

TapTap closed this issue

2026-07-30 18:17:31 +02:00