[RFC] Resouce leak/Denial of service in bb_boxc.c

In boxc_sender (), the code

    /* wait for smsbox identification */
    if (bb_status != BB_DEAD && conn->alive && conn->is_wap == 0) {
        mutex_lock(conn->boxc_id_mutex);
        debug("bb.boxc", 0, "boxc_sender: sender unlocked");
        mutex_unlock(conn->boxc_id_mutex);
    }

means that this thread waits until a cmd_identity message is received.
However, if a client simply connects and disconnects to the SMS Box
port, then this thread never exits. This is easy to test with a simple
script that makes a TCP connect() to the port and then closes immediately.

I think some code is needed in boxc_receive() to cater for this; ie.

	msg = read_from_box(conn);

	if (msg == NULL) {	/* garbage/connection lost */
	    conn->alive = 0;
		if (conn -> boxc_id == NULL)
            	mutex_unlock(conn->boxc_id_mutex);
	    break;
	}

so if the boxc_id is NULL, no cmd_identity message has been received and the
corresponding boxc_sender() thread is still blocked on the
conn->boxc_id_mutex
mutex.

Paul Keogh
ANAM Wireless Internet Solutions
http://www.anam.com
+353 1 284 7555 (wired)               +353 86 234 6047 (wireless)
Castle Yard, Saint Patrick's Road, Dalkey, County Dublin, Ireland