Skip to content

Commit 5a42e9f

Browse files
wqlicemanwqliceman
committed
[fixed]修复内存管理，确保在读取和写入操作后释放数据，避免内存泄漏
1 parent f0fa825 commit 5a42e9f

File tree

1 file changed

+162
-136
lines changed

1 file changed

+162
-136
lines changed

‎ab_plc_cip_net/ab_cip_helper.c‎

Lines changed: 162 additions & 136 deletions
Original file line numberDiff line numberDiff line change
@@ -15,70 +15,77 @@ byte_array_info build_read_core_command(const char* address, int length)
1515
size_t addr_adjust_length = addr_length;
1616
if (addr_adjust_length % 2 == 1)
1717
addr_adjust_length += 1;
18-
19-
char* temp_address = (char*)malloc(addr_adjust_length);
20-
memset(temp_address, 0, addr_adjust_length);
21-
memcpy(temp_address, address, strlen(address));
22-
23-
const ushort command_len = 9 + 26 + (ushort)addr_adjust_length + 1 + 24;
18+
ushort command_len = 9 + 26 + (ushort)addr_adjust_length + 1 + 24;
2419
byte* command = (byte*)malloc(command_len);
25-
memset(command, 0, command_len);
26-
27-
command[0] = 0x6F; // 命令
28-
command[2] = (byte)((command_len - 24) % 256);
29-
command[3] = (byte)((command_len - 24) / 256); // 长度
30-
31-
char temp_session[4] = { 0 };
32-
uint2bytes(g_session, temp_session);
33-
command[4] = temp_session[0];
34-
command[5] = temp_session[1];
35-
command[6] = temp_session[2];
36-
command[7] = temp_session[3]; // 会话句柄
37-
38-
command[0 + 24] = 0x00;
39-
command[1 + 24] = 0x00;
40-
command[2 + 24] = 0x00;
41-
command[3 + 24] = 0x00; // 接口句柄，默认为0x00000000（CIP）
42-
command[4 + 24] = 0x01;
43-
command[5 + 24] = 0x0A; // 超时（0x000A）
44-
command[6 + 24] = 0x02;
45-
command[7 + 24] = 0x00; // 项数（0x0002）
46-
command[8 + 24] = 0x00;
47-
command[9 + 24] = 0x00; // 空地址项（0x0000）
48-
command[10 + 24] = 0x00;
49-
command[11 + 24] = 0x00; // 长度（0x0000）
50-
command[12 + 24] = 0xB2; // type id 0xB2:UnConnected Data Item 0xB1:Connected Data Item 0xA1:Connect Address Item
51-
command[13 + 24] = 0x00; // 未连接数据项（0x00b2）
52-
command[14 + 24] = (byte)((command_len - 16 - 24) % 256); // 后面数据包的长度，等全部生成后在赋值
53-
command[15 + 24] = (byte)((command_len - 16 - 24) / 256);
54-
command[16 + 24] = 0x52; // 服务类型（0x03请求服务列表，0x52请求标签数据）
55-
command[17 + 24] = 0x02; // 请求路径大小
56-
command[18 + 24] = 0x20;
57-
command[19 + 24] = 0x06; // 请求路径(0x0620)
58-
command[20 + 24] = 0x24;
59-
command[21 + 24] = 0x01; // 请求路径(0x0124)
60-
command[22 + 24] = 0x0A;
61-
command[23 + 24] = 0xF0;
62-
command[24 + 24] = (byte)((6 + addr_adjust_length) % 256); // CIP指令长度
63-
command[25 + 24] = (byte)((6 + addr_adjust_length) / 256);
64-
65-
command[0 + 24 + 26] = 0x4C; // 读取数据
66-
command[1 + 24 + 26] = (byte)((addr_adjust_length + 2) / 2);
67-
command[2 + 24 + 26] = 0x91;
68-
command[3 + 24 + 26] = (byte)addr_length;
69-
memcpy(command + 4 + 24 + 26, temp_address, addr_adjust_length);
70-
command[4 + 24 + 26 + addr_adjust_length] = (byte)((length) % 256);
71-
command[5 + 24 + 26 + addr_adjust_length] = (byte)((length) / 256);
72-
73-
command[6 + 24 + 26 + addr_adjust_length] = 0x01;
74-
command[7 + 24 + 26 + addr_adjust_length] = 0x00;
75-
command[8 + 24 + 26 + addr_adjust_length] = 0x01;
76-
command[9 + 24 + 26 + addr_adjust_length] = g_plc_slot;
20+
if (command != NULL)
21+
{
22+
memset(command, 0, command_len);
23+
24+
char* temp_address = (char*)malloc(addr_adjust_length);
25+
if (temp_address != NULL)
26+
{
27+
memset(temp_address, 0, addr_adjust_length);
28+
memcpy(temp_address, address, strlen(address));
29+
30+
command[0] = 0x6F; // 命令
31+
command[2] = (byte)((command_len - 24) % 256);
32+
command[3] = (byte)((command_len - 24) / 256); // 长度
33+
34+
char temp_session[4] = { 0 };
35+
uint2bytes(g_session, temp_session);
36+
command[4] = temp_session[0];
37+
command[5] = temp_session[1];
38+
command[6] = temp_session[2];
39+
command[7] = temp_session[3]; // 会话句柄
40+
41+
command[0 + 24] = 0x00;
42+
command[1 + 24] = 0x00;
43+
command[2 + 24] = 0x00;
44+
command[3 + 24] = 0x00; // 接口句柄，默认为0x00000000（CIP）
45+
command[4 + 24] = 0x01;
46+
command[5 + 24] = 0x0A; // 超时（0x000A）
47+
command[6 + 24] = 0x02;
48+
command[7 + 24] = 0x00; // 项数（0x0002）
49+
command[8 + 24] = 0x00;
50+
command[9 + 24] = 0x00; // 空地址项（0x0000）
51+
command[10 + 24] = 0x00;
52+
command[11 + 24] = 0x00; // 长度（0x0000）
53+
command[12 + 24] = 0xB2; // type id 0xB2:UnConnected Data Item 0xB1:Connected Data Item 0xA1:Connect Address Item
54+
command[13 + 24] = 0x00; // 未连接数据项（0x00b2）
55+
command[14 + 24] = (byte)((command_len - 16 - 24) % 256); // 后面数据包的长度，等全部生成后在赋值
56+
command[15 + 24] = (byte)((command_len - 16 - 24) / 256);
57+
command[16 + 24] = 0x52; // 服务类型（0x03请求服务列表，0x52请求标签数据）
58+
command[17 + 24] = 0x02; // 请求路径大小
59+
command[18 + 24] = 0x20;
60+
command[19 + 24] = 0x06; // 请求路径(0x0620)
61+
command[20 + 24] = 0x24;
62+
command[21 + 24] = 0x01; // 请求路径(0x0124)
63+
command[22 + 24] = 0x0A;
64+
command[23 + 24] = 0xF0;
65+
command[24 + 24] = (byte)((6 + addr_adjust_length) % 256); // CIP指令长度
66+
command[25 + 24] = (byte)((6 + addr_adjust_length) / 256);
67+
68+
command[0 + 24 + 26] = 0x4C; // 读取数据
69+
command[1 + 24 + 26] = (byte)((addr_adjust_length + 2) / 2);
70+
command[2 + 24 + 26] = 0x91;
71+
command[3 + 24 + 26] = (byte)addr_length;
72+
memcpy(command + 4 + 24 + 26, temp_address, addr_adjust_length);
73+
command[4 + 24 + 26 + addr_adjust_length] = (byte)((length) % 256);
74+
command[5 + 24 + 26 + addr_adjust_length] = (byte)((length) / 256);
75+
76+
command[6 + 24 + 26 + addr_adjust_length] = 0x01;
77+
command[7 + 24 + 26 + addr_adjust_length] = 0x00;
78+
command[8 + 24 + 26 + addr_adjust_length] = 0x01;
79+
command[9 + 24 + 26 + addr_adjust_length] = g_plc_slot;
80+
}
81+
RELEASE_DATA(temp_address);
82+
}
83+
else
84+
command_len = 0;
7785

7886
byte_array_info ret = { 0 };
7987
ret.data = command;
8088
ret.length = command_len;
81-
RELEASE_DATA(temp_address);
8289
return ret;
8390
}
8491

@@ -93,72 +100,80 @@ byte_array_info build_write_core_command(const char* address, ushort typeCode, i
93100
if (addr_adjust_length % 2 == 1)
94101
addr_adjust_length += 1;
95102

96-
char* temp_address = (char*)malloc(addr_adjust_length);
97-
memset(temp_address, 0, addr_adjust_length);
98-
memcpy(temp_address, address, strlen(address));
99-
100-
const ushort command_len = 8 + 26 + (ushort)addr_adjust_length + val_len + 4 + 24;
103+
ushort command_len = 8 + 26 + (ushort)addr_adjust_length + val_len + 4 + 24;
101104
byte* command = (byte*)malloc(command_len);
102-
memset(command, 0, command_len);
103-
104-
command[0] = 0x6F; // 命令
105-
command[2] = (byte)((command_len - 24) % 256);
106-
command[3] = (byte)((command_len - 24) / 256); // 长度
107-
108-
char temp_session[4] = { 0 };
109-
uint2bytes(g_session, temp_session);
110-
command[4] = temp_session[0];
111-
command[5] = temp_session[1];
112-
command[6] = temp_session[2];
113-
command[7] = temp_session[3]; // 会话句柄
114-
115-
command[0 + 24] = 0x00;
116-
command[1 + 24] = 0x00;
117-
command[2 + 24] = 0x00;
118-
command[3 + 24] = 0x00; // 接口句柄，默认为0x00000000（CIP）
119-
command[4 + 24] = 0x01;
120-
command[5 + 24] = 0x0A; // 超时（0x0001）
121-
command[6 + 24] = 0x02;
122-
command[7 + 24] = 0x00; // 项数（0x0002）
123-
command[8 + 24] = 0x00;
124-
command[9 + 24] = 0x00;
125-
command[10 + 24] = 0x00;
126-
command[11 + 24] = 0x00; // 空地址项（0x0000）
127-
command[12 + 24] = 0xB2;
128-
command[13 + 24] = 0x00; // 未连接数据项（0x00b2）
129-
command[14 + 24] = (byte)((command_len - 16 - 24) % 256); // 后面数据包的长度，等全部生成后在赋值
130-
command[15 + 24] = (byte)((command_len - 16 - 24) / 256);
131-
command[16 + 24] = 0x52; // 服务类型（0x03请求服务列表，0x52请求标签数据）
132-
command[17 + 24] = 0x02; // 请求路径大小
133-
command[18 + 24] = 0x20;
134-
command[19 + 24] = 0x06; // 请求路径(0x0620)
135-
command[20 + 24] = 0x24;
136-
command[21 + 24] = 0x01; // 请求路径(0x0124)
137-
command[22 + 24] = 0x0A;
138-
command[23 + 24] = 0xF0;
139-
command[24 + 24] = (byte)((8 + val_len + addr_adjust_length) % 256); // CIP指令长度
140-
command[25 + 24] = (byte)((8 + val_len + addr_adjust_length) / 256);
141-
142-
command[0 + 26 + 24] = 0x4D; // 写数据
143-
command[1 + 26 + 24] = (byte)((addr_adjust_length + 2) / 2);
144-
command[2 + 26 + 24] = 0x91;
145-
command[3 + 26 + 24] = (byte)addr_length;
146-
memcpy(command + 4 + 26 + 24, temp_address, addr_adjust_length);
147-
command[4 + 26 + 24 + addr_adjust_length] = (byte)(typeCode % 256);
148-
command[5 + 26 + 24 + addr_adjust_length] = (byte)(typeCode) / 256;
149-
command[6 + 26 + 24 + addr_adjust_length] = (byte)(length % 256); // TODO length ??
150-
command[7 + 26 + 24 + addr_adjust_length] = (byte)(length / 256);
151-
memcpy(command + 8 + 26 + 24 + addr_adjust_length, value.data, value.length);
152-
153-
command[8 + 26 + 24 + addr_adjust_length + val_len] = 0x01;
154-
command[9 + 26 + 24 + addr_adjust_length + val_len] = 0x00;
155-
command[10 + 26 + 24 + addr_adjust_length + val_len] = 0x01;
156-
command[11 + 26 + 24 + addr_adjust_length + val_len] = g_plc_slot;
105+
if (command != NULL)
106+
{
107+
memset(command, 0, command_len);
108+
109+
char* temp_address = (char*)malloc(addr_adjust_length);
110+
if (temp_address != NULL)
111+
{
112+
memset(temp_address, 0, addr_adjust_length);
113+
memcpy(temp_address, address, strlen(address));
114+
115+
command[0] = 0x6F; // 命令
116+
command[2] = (byte)((command_len - 24) % 256);
117+
command[3] = (byte)((command_len - 24) / 256); // 长度
118+
119+
char temp_session[4] = { 0 };
120+
uint2bytes(g_session, temp_session);
121+
command[4] = temp_session[0];
122+
command[5] = temp_session[1];
123+
command[6] = temp_session[2];
124+
command[7] = temp_session[3]; // 会话句柄
125+
126+
command[0 + 24] = 0x00;
127+
command[1 + 24] = 0x00;
128+
command[2 + 24] = 0x00;
129+
command[3 + 24] = 0x00; // 接口句柄，默认为0x00000000（CIP）
130+
command[4 + 24] = 0x01;
131+
command[5 + 24] = 0x0A; // 超时（0x0001）
132+
command[6 + 24] = 0x02;
133+
command[7 + 24] = 0x00; // 项数（0x0002）
134+
command[8 + 24] = 0x00;
135+
command[9 + 24] = 0x00;
136+
command[10 + 24] = 0x00;
137+
command[11 + 24] = 0x00; // 空地址项（0x0000）
138+
command[12 + 24] = 0xB2;
139+
command[13 + 24] = 0x00; // 未连接数据项（0x00b2）
140+
command[14 + 24] = (byte)((command_len - 16 - 24) % 256); // 后面数据包的长度，等全部生成后在赋值
141+
command[15 + 24] = (byte)((command_len - 16 - 24) / 256);
142+
command[16 + 24] = 0x52; // 服务类型（0x03请求服务列表，0x52请求标签数据）
143+
command[17 + 24] = 0x02; // 请求路径大小
144+
command[18 + 24] = 0x20;
145+
command[19 + 24] = 0x06; // 请求路径(0x0620)
146+
command[20 + 24] = 0x24;
147+
command[21 + 24] = 0x01; // 请求路径(0x0124)
148+
command[22 + 24] = 0x0A;
149+
command[23 + 24] = 0xF0;
150+
command[24 + 24] = (byte)((8 + val_len + addr_adjust_length) % 256); // CIP指令长度
151+
command[25 + 24] = (byte)((8 + val_len + addr_adjust_length) / 256);
152+
153+
command[0 + 26 + 24] = 0x4D; // 写数据
154+
command[1 + 26 + 24] = (byte)((addr_adjust_length + 2) / 2);
155+
command[2 + 26 + 24] = 0x91;
156+
command[3 + 26 + 24] = (byte)addr_length;
157+
memcpy(command + 4 + 26 + 24, temp_address, addr_adjust_length);
158+
command[4 + 26 + 24 + addr_adjust_length] = (byte)(typeCode % 256);
159+
command[5 + 26 + 24 + addr_adjust_length] = (byte)(typeCode) / 256;
160+
command[6 + 26 + 24 + addr_adjust_length] = (byte)(length % 256); // TODO length ??
161+
command[7 + 26 + 24 + addr_adjust_length] = (byte)(length / 256);
162+
memcpy(command + 8 + 26 + 24 + addr_adjust_length, value.data, value.length);
163+
164+
command[8 + 26 + 24 + addr_adjust_length + val_len] = 0x01;
165+
command[9 + 26 + 24 + addr_adjust_length + val_len] = 0x00;
166+
command[10 + 26 + 24 + addr_adjust_length + val_len] = 0x01;
167+
command[11 + 26 + 24 + addr_adjust_length + val_len] = g_plc_slot;
168+
}
169+
RELEASE_DATA(temp_address);
170+
}
171+
else
172+
command_len = 0;
157173

158174
byte_array_info ret = { 0 };
159175
ret.data = command;
160176
ret.length = command_len;
161-
RELEASE_DATA(temp_address);
162177
return ret;
163178
}
164179

@@ -177,10 +192,15 @@ cip_error_code_e cip_analysis_read_byte(byte_array_info response, byte_array_inf
177192
{
178193
temp_length = data_length - 6;
179194
ret->data = (byte*)malloc(temp_length);
180-
memset(ret->data, 0, temp_length);
181-
memcpy(ret->data, response.data + 46, temp_length);
182-
ret->type = bytes2ushort(response.data + 44);
183-
ret->length = temp_length;
195+
if (ret->data != NULL)
196+
{
197+
memset(ret->data, 0, temp_length);
198+
memcpy(ret->data, response.data + 46, temp_length);
199+
ret->type = bytes2ushort(response.data + 44);
200+
ret->length = temp_length;
201+
}
202+
else
203+
ret_code = CIP_ERROR_CODE_MALLOC_FAILED;
184204
}
185205
}
186206
else
@@ -223,9 +243,9 @@ cip_error_code_e read_value(int fd, const char* address, int length, byte_array_
223243
{
224244
byte_array_info response = { 0 };
225245
if (cip_read_response(fd, &response))
226-
ret = cip_analysis_read_byte(response, out_bytes);
246+
ret = cip_analysis_read_byte(response, out_bytes);
227247

228-
RELEASE_DATA(response.data);
248+
RELEASE_DATA(response.data);
229249
}
230250
RELEASE_DATA(core_cmd.data);
231251
}
@@ -245,7 +265,7 @@ cip_error_code_e write_value(int fd, const char* address, int length, ushort typ
245265
byte_array_info response = { 0 };
246266
if (cip_read_response(fd, &response))
247267
ret = cip_analysis_write_byte(response);
248-
268+
249269
RELEASE_DATA(response.data);
250270
}
251271
RELEASE_DATA(core_cmd.data);
@@ -262,10 +282,13 @@ bool initialization_on_connect(int fd)
262282
byte_array_info temp = { 0 };
263283
int command_len = sizeof(g_registered_command);
264284
temp.data = (byte*)malloc(command_len);
265-
memcpy(temp.data, g_registered_command, command_len);
266-
temp.length = command_len;
267-
is_ok = read_data_from_server(fd, temp, &g_session);
268-
RELEASE_DATA(temp.data);
285+
if (temp.data != NULL)
286+
{
287+
memcpy(temp.data, g_registered_command, command_len);
288+
temp.length = command_len;
289+
is_ok = read_data_from_server(fd, temp, &g_session);
290+
RELEASE_DATA(temp.data);
291+
}
269292

270293
// Return a successful signal
271294
return is_ok;
@@ -297,11 +320,14 @@ bool cip_read_response(int fd, byte_array_info* response)
297320
{
298321
response->length = HEAD_SIZE + content_size;
299322
response->data = (byte*)malloc(response->length);
300-
memset(response->data, 0, response->length);
301-
memcpy(response->data, head, HEAD_SIZE);
302-
memcpy(response->data + HEAD_SIZE, content, content_size);
303-
304-
is_ok = true;
323+
if (response->data != NULL)
324+
{
325+
memset(response->data, 0, response->length);
326+
memcpy(response->data, head, HEAD_SIZE);
327+
memcpy(response->data + HEAD_SIZE, content, content_size);
328+
329+
is_ok = true;
330+
}
305331
}
306332

307333
RELEASE_DATA(content);

0 commit comments

Comments
 (0)