Mosquitto 1.3.4 has a memory leak

Bug #1423037 reported by Roger Light
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
mosquitto (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

If a client publishes to the broker using a topic with a leading slash, e.g. "/foo" this can lead to a memory leak.

The problem is fixed in v1.3.5 or v1.4, the best thing would be to update to either of those. I have prepared a new branch with support for 1.4.

Related branches

Revision history for this message
Roger Light (roger.light) wrote :

The proposed branch depends on bug #1422623.

tags: added: patch upgrade-software-version
Revision history for this message
Roger Light (roger.light) wrote :

This is a debdiff to update to version 1.4. It is the same as the bzr branch, but doesn't have the file conflicts of course.

Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "update.debdiff.bz2" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

Revision history for this message
Didier Roche-Tolomelli (didrocks) wrote :

Some reviews on teh patch:
* You shouldn't add the binary dependency on libwebsockets3 explicitely on the binary package. ${shlibs:Depends} should expands automatically to it. (and you build-dep on libwebsockets). That way, it's easier to transition to the libwebsockets4 when it becomes available.
* if python isn't part of upstream release at all, you should remove as well:
  - X-Python-Version: >= 2.6
  - python-all build-dep.
* debian/mosquitto.postinst : the change isn't listed in debian/changelog, why this one?
* debian/patches/enable-websockets.patch:
   - please explain in the description a little bit more why the libwebsockets is needed (and states that explicitly in debian/changelog). Why shouldn't that we forwarded and enabled upstream?
* debian/upstream/signing-key.asc: this file changed without any reason, isn't it? Only the Version: header was removed, please don't change it then.

The feature freeze exception needs to explain why the websockets support added is risk-free and needed I guess.

Changed in mosquitto (Ubuntu):
status: New → Fix Committed
Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

Vivid is going EOL soon (in the next 2-3 weeks), and wily is fixed.

I don't see much effort in fixing something that will be EOL next month.

G.

Changed in mosquitto (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.