1 files changed, 279 insertions, 181 deletions

diff --git a/src/sledjchisl/sledjchisl.c b/src/sledjchisl/sledjchisl.c
index 6a971c8..11b5fb2 100644
--- a/src/sledjchisl/sledjchisl.c
+++ b/src/sledjchisl/sledjchisl.c
@@ -318,6 +318,7 @@ static void newValidFunc(char *name, char *title, fieldValidFunc func)
   validFunc *vf = xmalloc(sizeof(validFunc));
   vf->name = name;      vf->title = title;      vf->func = func;
   fieldValidFuncs->put(fieldValidFuncs, vf->name, vf, sizeof(validFunc));
+  free(vf);
 }
 
 typedef void *(*pageFunction)           (char *file, reqData *Rd, HTMLfile *thisFile);
@@ -333,6 +334,7 @@ static void newDynPage(char *name, pageFunction func)
   dynPage *dp = xmalloc(sizeof(dynPage));
   dp->name = name;      dp->func = func;
   dynPages->put(dynPages, dp->name, dp, sizeof(dynPage));
+  free(dp);
 }
 
 typedef void *(*pageBuildFunction)      (reqData *Rd, char *message);
@@ -348,6 +350,7 @@ static void newBuildPage(char *name, pageBuildFunction func, pageBuildFunction e
   buildPage *bp = xmalloc(sizeof(buildPage));
   bp->name = name;      bp->func = func;        bp->eFunc = eFunc;
   buildPages->put(buildPages, bp->name, bp, sizeof(buildPage));
+  free(bp);
 }
 
 
@@ -434,6 +437,10 @@ static void showSesh(qgrow_t *reply, sesh *shs)
 
 
 char toybuf[4096];
+lua_State *L;
+qhashtbl_t *configs;
+MYSQL *database, *dbconn;
+gridStats *stats;
 boolean  isTmux = 0;
 boolean  isWeb = 0;
 char *pwd = "";
@@ -460,6 +467,7 @@ int newbieTimeOut = 30;
 float loadAverageInc = 0.5;
 int  simTimeOut = 45;
 qhashtbl_t *mimeTypes;
+qlist_t *dbRequests;
 
 
 // TODO - log to file.  The problem is we don't know where to log until after we have loaded the configs, and before that we are spewing log messages.
@@ -941,6 +949,7 @@ d("Getting field metadata for %s", table);
             fld->flags    =     fields[i].flags;
             fld->decimals =     fields[i].decimals;
             ret->put(ret, fld->name, fld, sizeof(*fld));
+            free(fld);
           }
           tables->put(tables, table, ret, sizeof(*ret));
         }
@@ -958,9 +967,11 @@ void dbFreeFields(qlisttbl_t *flds)
   qlisttbl_obj_t obj;
   memset((void *) &obj, 0, sizeof(obj));
   flds->lock(flds);
+d("Freeing fields.");
   while(flds->getnext(flds, &obj, NULL, false) == true)
   {
     dbField *fld = (dbField *) obj.data;
+d("Freeing field %s", fld->name);
     free(fld->name);
   }
   flds->unlock(flds);
@@ -1014,6 +1025,7 @@ void dbDoSomething(dbRequest *req, boolean count, ...)
     }
     if (0 == i)
     {
+      free(select);
       if (count)
         select = xmprintf(",Count(*)");
       else
@@ -1505,6 +1517,7 @@ d("Execute %s", req->sql);
             {
               char *t = xmprintf("%d", (int) *((int *) req->outBind[i].buffer));
               flds->putstr(flds, req->rows->fieldNames[i], t);
+              free(t);
               break;
             }
 
@@ -1512,6 +1525,7 @@ d("Execute %s", req->sql);
             {
               char *t = xmprintf("%d", (int) *((int *) req->outBind[i].buffer));
               flds->putstr(flds, req->rows->fieldNames[i], t);
+              free(t);
               break;
             }
 
@@ -1525,6 +1539,7 @@ d("Execute %s", req->sql);
               char *t = xmprintf("%d", (int) *((int *) (req->outBind[i].buffer)));
 //d("Setting %i %s %s", i, fld->name, t);
               flds->putstr(flds, req->rows->fieldNames[i], t);
+              free(t);
               break;
             }
 
@@ -1532,6 +1547,7 @@ d("Execute %s", req->sql);
             {
               char *t = xmprintf("%d", (int) *((int *) req->outBind[i].buffer));
               flds->putstr(flds, req->rows->fieldNames[i], t);
+              free(t);
               break;
             }
 
@@ -1584,11 +1600,10 @@ d("Execute %s", req->sql);
           }
         }
         else
-        {
           D("Not setting data %s, coz it's NULL", fld->name);
-        }
       }
-      req->rows->rows->addlast(req->rows->rows, flds, sizeof(*flds));
+      req->rows->rows->addlast(req->rows->rows, flds, sizeof(qhashtbl_t));
+      free(flds);
     }
   }
 
@@ -1618,22 +1633,22 @@ void dbPull(reqData *Rd, char *table, rowData *rows)
 
   memset((void*)&obj, 0, sizeof(obj));
   me->lock(me);
-  while(me->getnext(me, &obj, true) == true)
+  while(me->getnext(me, &obj, false) == true)
   {
     where = xmprintf("%s.%s", table, obj.name);
     Rd->database->putstr(Rd->database, where, (char *) obj.data);
-    me->remove(me, obj.name);
+//    me->remove(me, obj.name);
     free(where);
   }
   me->unlock(me);
-  free(me);
+  me->free(me);
 }
 
-/*
 void dbFreeRequest(dbRequest *req)
 {
   int i;
 
+  D("Cleaning up prepared database request %s - %s", req->table, req->where);
   if (NULL != req->outBind)
   {
     for (i = 0; i < req->outCount; i++)
@@ -1649,6 +1664,7 @@ void dbFreeRequest(dbRequest *req)
   {
     for (i = 0; i < req->inCount; i++)
     {
+// TODO - this leaks for some bizare reason.
       if (NULL != req->inBind[i].buffer)        free(req->inBind[i].buffer);
       if (NULL != req->inBind[i].length)        free(req->inBind[i].length);
       if (NULL != req->inBind[i].error)         free(req->inBind[i].error);
@@ -1659,9 +1675,13 @@ void dbFreeRequest(dbRequest *req)
 
   if (req->freeOutParams)       free(req->outParams);
   if (NULL != req->sql)         free(req->sql);
-  if (NULL != req->prep)        mysql_stmt_close(req->prep);
+  if (NULL != req->prep)
+  {
+    if (0 != mysql_stmt_close(req->prep))
+      C("Unable to close the prepared statement!");
+    free(req->prep);
+  }
 }
-*/
 
 my_ulonglong dbCount(MYSQL *db, char *table, char *where)
 {
@@ -1908,15 +1928,14 @@ gridStats *getStats(MYSQL *db, gridStats *stats)
       rgnSizes->inParams  = szi;
       rgnSizes->outParams = szo;
       rgnSizes->where = "sizeX != 0";
+      dbRequests->addfirst(dbRequests, rgnSizes, sizeof(*rgnSizes));
     }
     dbDoSomething(rgnSizes, FALSE);
     rowData *rows = rgnSizes->rows;
-    qlist_obj_t obj;
-    memset((void*)&obj, 0, sizeof(obj)); // must be cleared before call
-    rows->rows->lock(rows->rows);
-    while (rows->rows->getnext(rows->rows, &obj, false) == true)
+
+    qhashtbl_t *row;
+    while (NULL != (row = rows->rows->getat(rows->rows, 0, NULL, true)))
     {
-      qhashtbl_t *row = (qhashtbl_t *) obj.data;
       my_ulonglong x = 0, y = 0;
 
       tmp = row->getstr(row, "sizeX", false);
@@ -1930,11 +1949,13 @@ gridStats *getStats(MYSQL *db, gridStats *stats)
       else
         y = atoll(tmp);
       simSize += x * y;
-      free(row);
+// TODO - I can't win.  valgrind complains that either something is being freed twice, or not freed at all, no matter what I do.
+//          This seems to keep the memory loss down to a minimum.
+      row->free(row);
+      rows->rows->removefirst(rows->rows);
     }
-    rows->rows->unlock(rows->rows);
-    free(rows->rows);
     free(rows->fieldNames);
+    rows->rows->free(rows->rows);
     free(rows);
 
     tmp = xmprintf("%lu", simSize);
@@ -1986,7 +2007,7 @@ void santize(qhashtbl_t *tbl, bool decode)
 
   memset((void*)&obj, 0, sizeof(obj));
   tbl->lock(tbl);
-  while(tbl->getnext(tbl, &obj, true) == true)
+  while(tbl->getnext(tbl, &obj, false) == true)
   {
     char *n = obj.name, *o = (char *) obj.data;
 
@@ -2004,7 +2025,6 @@ void santize(qhashtbl_t *tbl, bool decode)
     }
 
     tbl->putstr(tbl, n, o);
-    free(o);
   }
   tbl->unlock(tbl);
 }
@@ -2033,7 +2053,7 @@ enum cookieSame
 typedef struct _cookie cookie;
 struct _cookie
 {
-  char *cookie, *value, *domain, *path;
+  char *value, *domain, *path;
   //  char *expires;    // Use maxAge instead, it's far simpler to figure out.
   int maxAge;
   boolean secure, httpOnly;
@@ -2043,23 +2063,30 @@ struct _cookie
 cookie *setCookie(reqData *Rd, char *cki, char *value)
 {
   cookie *ret = xzalloc(sizeof(cookie));
+  char *cook = xstrdup(cki);
   int l, i;
 
-  ret->cookie = xstrdup(cki);
   // Validate this, as there is a limited set of characters allowed.
-  qstrreplace("tr", ret->cookie, "()<>@,;:\\\"/[]?={} \t", "_");
-  l = strlen(ret->cookie);
+  qstrreplace("tr", cook, "()<>@,;:\\\"/[]?={} \t", "_");
+  l = strlen(cook);
   for (i = 0; i < l; i++)
   {
-    if (iscntrl(ret->cookie[i]) != 0)
-      ret->cookie[i] = '_';
+    if (iscntrl(cook[i]) != 0)
+      cook[i] = '_';
   }
-  ret->value = qurl_encode(value, strlen(value));
+  l = strlen(value);
+  if (0 != l)
+    ret->value = qurl_encode(value, l);
+  else
+    ret->value = value;
   ret->httpOnly = TRUE;
   ret->site = CS_STRICT;
   ret->secure = TRUE;
-  ret->path = xstrdup(getStrH(Rd->headers, "SCRIPT_NAME"));
-  Rd->Rcookies->put(Rd->Rcookies, cki, ret, sizeof(*ret));
+  ret->path = getStrH(Rd->headers, "SCRIPT_NAME");
+  Rd->Rcookies->put(Rd->Rcookies, cook, ret, sizeof(cookie));
+  free(ret);
+  ret = Rd->Rcookies->get(Rd->Rcookies, cook, NULL, false);
+  free(cook);
 
   return ret;
 }
@@ -2388,6 +2415,7 @@ static void HTMLfooter(qgrow_t *reply)
 fragment *newFragment(enum fragmentType type, char *text, int len)
 {
   fragment *frg = xmalloc(sizeof(fragment));
+
   frg->type = type;
   frg->length = len;
   frg->text = xmalloc(len + 1);
@@ -2435,8 +2463,10 @@ qlist_t *fragize(char *mm, size_t length)
                         i += 4;
                     }
                     frg0 = newFragment(FT_TEXT, &mm[k], m - k);
-                    fragments->addlast(fragments, frg0, sizeof(*frg0));
-                    fragments->addlast(fragments, frg1, sizeof(*frg1));
+                    fragments->addlast(fragments, frg0, sizeof(fragment));
+                    fragments->addlast(fragments, frg1, sizeof(fragment));
+                    free(frg0);
+                    free(frg1);
                     k = i;
                     break;
                   }
@@ -2450,11 +2480,12 @@ qlist_t *fragize(char *mm, size_t length)
   }
   frg0 = newFragment(FT_TEXT, &mm[k], length - k);
   fragments->addlast(fragments, frg0, sizeof(*frg0));
+  free(frg0);
 
   return fragments;
 }
 
-void unfragize(qlist_t *fragments, reqData *Rd)
+void unfragize(qlist_t *fragments, reqData *Rd, boolean fre)
 {
   qlist_obj_t   lobj;
   memset((void *) &lobj, 0, sizeof(lobj));
@@ -2468,8 +2499,12 @@ void unfragize(qlist_t *fragments, reqData *Rd)
       continue;
     }
     HTMLfill(Rd, frg->type, frg->text, frg->length);
+    if (fre)
+      free(frg->text);
   }
   fragments->unlock(fragments);
+  if (fre)
+    fragments->free(fragments);
 }
 
 HTMLfile *checkHTMLcache(char *file)
@@ -2876,6 +2911,7 @@ static void freeSesh(reqData *Rd, boolean linky, boolean wipe)
   }
   else
     shs->leaf[0] = '\0';
+  free(file);
 }
 
 static void setToken_n_munchie(reqData *Rd, boolean linky)
@@ -2900,8 +2936,8 @@ static void setToken_n_munchie(reqData *Rd, boolean linky)
 
   if (!linky)
   {
-    cookie *ck = setCookie(Rd, "toke_n_munchie", shs->toke_n_munchie);
-    cookie *ckh = setCookie(Rd, "hashish", shs->hashish);
+    setCookie(Rd, "toke_n_munchie", shs->toke_n_munchie);
+    setCookie(Rd, "hashish", shs->hashish);
   }
   char *tnm0 = xmprintf( "toke_n_munchie = \n"
                         "{\n"
@@ -2953,6 +2989,8 @@ t("stuff %s = %s", obj.name, (char *) obj.data);
   // Set the mtime on the file.
   futimens(fd, shs->timeStamp);
   xclose(fd);
+  free(tnm1);
+  free(tnm0);
   free(file);
 }
 
@@ -3052,14 +3090,18 @@ d("New sesh");
   }
   else
   {
-    qstrcpy(ret->salt, sizeof(ret->salt), qhex_encode(buf, sizeof(buf)));
+    t0 = qhex_encode(buf, sizeof(buf));
+    qstrcpy(ret->salt, sizeof(ret->salt), t0);
+    free(t0);
 //d("salt %s", ret->salt);
     numBytes = getrandom((void *)buf, sizeof(buf), GRND_NONBLOCK);
     if (-1 == numBytes)
       perror_msg("Unable to generate a suitable random number.");
     else
     {
-      qstrcpy(ret->seshID, sizeof(ret->seshID), qhex_encode(buf, sizeof(buf)));
+      t0 = qhex_encode(buf, sizeof(buf));
+      qstrcpy(ret->seshID, sizeof(ret->seshID), t0);
+      free(t0);
 //d("seshID %s", ret->seshID);
 
       ret->timeStamp[0].tv_nsec = UTIME_OMIT;
@@ -3079,14 +3121,17 @@ d("New sesh");
         qstrcpy(ret->munchie, sizeof(ret->munchie), munchie);
 //d("munchie %s", ret->munchie);
         t0 = xmprintf("%s%s", getStrH(Rd->stuff, "UUID"), munchie);
+        free(munchie);
         toke_n_munchie = myHMAC(t0, FALSE);
         free(t0);
         qstrcpy(ret->toke_n_munchie, sizeof(ret->toke_n_munchie), toke_n_munchie);
 //d("toke_n_munchie %s", ret->toke_n_munchie);
         hashish = myHMACkey(ret->salt, toke_n_munchie, FALSE);
+        free(toke_n_munchie);
         qstrcpy(ret->hashish, sizeof(ret->hashish), hashish);
 //d("hashish %s", ret->hashish);
         t0 = myHMACkey(getStrH(Rd->configs, "pepper"), hashish, TRUE);
+        free(hashish);
         qstrcpy(ret->leaf, sizeof(ret->leaf), t0);
 //d("leaf %s", ret->leaf);
         free(t0);
@@ -3182,9 +3227,7 @@ static int validateSesh(reqData *Rd, qhashtbl_t *data, char *name)
     return ret;
   }
 
-  char  *toke_n_munchie = "", *munchie = "", *hashish = "",
-        *leaf, *timeStamp = "", *seshion = "", *seshID = "",
-        *t0, *t1;
+  char  *toke_n_munchie = "", *munchie = "", *hashish = "", *leaf = "", *timeStamp = "", *seshion = "", *seshID = "", *t0, *t1;
 
   // In this case the session stuff has to come from specific places.
   hashish        = getStrH(Rd->queries, "hashish");
@@ -3224,141 +3267,143 @@ static int validateSesh(reqData *Rd, qhashtbl_t *data, char *name)
 
     if (0 == ret)
     {
+      // This is apparently controversial, I added it coz some of the various security docs suggested it's a good idea.
+      // https://security.stackexchange.com/questions/139952/why-arent-sessions-exclusive-to-an-ip-address?rq=1
+      //        Includes various reasons why it's bad.
+      // Another good reason why it is bad, TOR.
+      // So should make this a user option, like Mantis does.
+      if (strcmp(getStrH(Rd->headers, "REMOTE_ADDR"), getStrH(tnm, "IP")) != 0)
       {
-        {
-          // This is apparently controversial, I added it coz some of the various security docs suggested it's a good idea.
-          // https://security.stackexchange.com/questions/139952/why-arent-sessions-exclusive-to-an-ip-address?rq=1
-          //    Includes various reasons why it's bad.
-          // Another good reason why it is bad, TOR.
-          // So should make this a user option, like Mantis does.
-          if (strcmp(getStrH(Rd->headers, "REMOTE_ADDR"), getStrH(tnm, "IP")) != 0)
+        bitchSession(Rd, "Wrong IP for session.", "Session IP doesn't match.");
+        ret++;
+      }
+      else
+      {
+        timeStamp = xmprintf("%ld.%ld", (long) st.st_mtim.tv_sec, st.st_mtim.tv_nsec);
+//d("timeStamp %s", timeStamp);
+        seshion = xmprintf("%s%s", tnm->getstr(tnm, "seshID", false), timeStamp);
+//d("sesh %s", seshion);
+        t0 = myHMAC(seshion, FALSE);
+        munchie = xmprintf("%s%s", t0, timeStamp);
+//d("munchie %s", munchie);
+        free(t0);
+        free(timeStamp);
+        t1 = getStrH(Rd->body, "munchie");
+        if ('\0' != t1[0])
+        {
+          if (strcmp(t1, munchie) != 0)
           {
-            bitchSession(Rd, "Wrong IP for session.", "Session IP doesn't match.");
+            bitchSession(Rd, "Wrong munchie for session.", "HMAC(seshID + timeStamp) != munchie");
             ret++;
           }
           else
           {
-            timeStamp = xmprintf("%ld.%ld", (long) st.st_mtim.tv_sec, st.st_mtim.tv_nsec);
-//d("timeStamp %s", timeStamp);
-            seshion = xmprintf("%s%s", tnm->getstr(tnm, "seshID", false), timeStamp);
-//d("sesh %s", seshion);
-            t0 = myHMAC(seshion, FALSE);
-            munchie = xmprintf("%s%s", t0, timeStamp);
-//d("munchie %s", munchie);
+            t0 = xmprintf("%s%s", getStrH(tnm, "UUID"), munchie);
+            t1 = myHMAC(t0, FALSE);
             free(t0);
-            t1 = getStrH(Rd->body, "munchie");
-            if ('\0' != t1[0])
-            {
-              if (strcmp(t1, munchie) != 0)
-              {
-                bitchSession(Rd, "Wrong munchie for session.", "HMAC(seshID + timeStamp) != munchie");
-                ret++;
-              }
-              else
-              {
-                t0 = xmprintf("%s%s", getStrH(tnm, "UUID"), munchie);
-                t1 = myHMAC(t0, FALSE);
-                free(t0);
 
 //d("toke_n_munchie %s", t1);
-                if (strcmp(t1, toke_n_munchie) != 0)
-                {
-                  bitchSession(Rd, "Wrong toke_n_munchie for session.", "HMAC(UUID + munchie) != toke_n_munchie");
-                  ret++;
-                }
-                free(t1);
-              }
+            if (strcmp(t1, toke_n_munchie) != 0)
+            {
+              bitchSession(Rd, "Wrong toke_n_munchie for session.", "HMAC(UUID + munchie) != toke_n_munchie");
+              ret++;
             }
+            free(t1);
+          }
+        }
 
-              if (0 == ret)
-              {
-                if (linky)
-                {
-                  t0 = xmprintf("%s%s", getStrH(tnm, "UUID"), munchie);
-                  t1 = myHMAC(t0, FALSE);
-                  free(t0);
-                  toke_n_munchie = t1;
+        if (0 == ret)
+        {
+          if (linky)
+          {
+            t0 = xmprintf("%s%s", getStrH(tnm, "UUID"), munchie);
+            t1 = myHMAC(t0, FALSE);
+            free(t0);
+            toke_n_munchie = t1;
 //d("toke_n_munchie %s", t1);
-                }
-                t1 = myHMACkey(getStrH(tnm, "salt"), toke_n_munchie, FALSE);
+          }
+          t1 = myHMACkey(getStrH(tnm, "salt"), toke_n_munchie, FALSE);
 //d("hashish %s", t1);
-                if (strcmp(t1, hashish) != 0)
-                {
-                  bitchSession(Rd, "Wrong hashish for session.", "HMAC(toke_n_munchie + salt) != hashish");
-                  ret++;
-                }
+          if (strcmp(t1, hashish) != 0)
+          {
+            bitchSession(Rd, "Wrong hashish for session.", "HMAC(toke_n_munchie + salt) != hashish");
+            ret++;
+          }
+          free(t1);
 
-                if (now.tv_sec > st.st_mtim.tv_sec + idleTimeOut)
-                {
-                  W("Session idled out.");
-                  Rd->vegOut = TRUE;
-                }
-                else
-                {
-                  if (now.tv_sec > st.st_mtim.tv_sec + seshTimeOut)
-                  {
-                    W("Session timed out.");
-                    Rd->vegOut = TRUE;
-                  }
-                  else
-                  {
+          if (now.tv_sec > st.st_mtim.tv_sec + idleTimeOut)
+          {
+            W("Session idled out.");
+            Rd->vegOut = TRUE;
+          }
+          else
+          {
+            if (now.tv_sec > st.st_mtim.tv_sec + seshTimeOut)
+            {
+              W("Session timed out.");
+              Rd->vegOut = TRUE;
+            }
+            else
+            {
 W("Validated session.");
-                    sesh *shs = &Rd->shs;
+              sesh *shs = &Rd->shs;
 
-                    qstrcpy(shs->leaf,          sizeof(shs->leaf),              leaf);
-                    if (linky)
-                    {
+              qstrcpy(shs->leaf,                sizeof(shs->leaf),              leaf);
+              if (linky)
+              {
 W("Validated session linky.");
-                      addStrL(Rd->messages, "Congratulations, you have validated your new account.  Now you can log onto the web site.");
-                      addStrL(Rd->messages, "NOTE - you wont be able to log onto the grid until your new account has been approved.");
-                      Rd->lnk = xzalloc(sizeof(sesh));
-                      qstrcpy(Rd->lnk->leaf, sizeof(Rd->lnk->leaf), leaf);
-                      Rd->chillOut = TRUE;
-                      freeSesh(Rd, linky, FALSE);
-                      qstrcpy(Rd->lnk->leaf, sizeof(Rd->lnk->leaf), "");
-                      Rd->func = (pageBuildFunction) loginPage;
-                      Rd->doit = "logout";
+                addStrL(Rd->messages, "Congratulations, you have validated your new account.  Now you can log onto the web site.");
+                addStrL(Rd->messages, "NOTE - you wont be able to log onto the grid until your new account has been approved.");
+                Rd->lnk = xzalloc(sizeof(sesh));
+                qstrcpy(Rd->lnk->leaf, sizeof(Rd->lnk->leaf), leaf);
+                Rd->chillOut = TRUE;
+                freeSesh(Rd, linky, FALSE);
+                qstrcpy(Rd->lnk->leaf, sizeof(Rd->lnk->leaf), "");
+                Rd->func = (pageBuildFunction) loginPage;
+                Rd->doit = "logout";
 // TODO - we might want to delete their old .lua session as well.  Maybe?  Don't think we have any suitable codes to find it.
-                    }
-                    else
-                    {
-                      qstrcpy(shs->sesh,                sizeof(shs->sesh),              seshion);
-                      qstrcpy(shs->toke_n_munchie,      sizeof(shs->toke_n_munchie),    toke_n_munchie);
-                      qstrcpy(shs->hashish,             sizeof(shs->hashish),           hashish);
-                      qstrcpy(shs->munchie,             sizeof(shs->munchie),           munchie);
-                      qstrcpy(shs->salt,                sizeof(shs->salt),              tnm->getstr(tnm, "salt",   false));
-                      qstrcpy(shs->seshID,              sizeof(shs->seshID),            tnm->getstr(tnm, "seshID", false));
-                      shs->timeStamp[0].tv_nsec = UTIME_OMIT;
-                      shs->timeStamp[0].tv_sec  = UTIME_OMIT;
-                      memcpy(&shs->timeStamp[1], &st.st_mtim, sizeof(struct timespec));
-                      t0 = tnm->getstr(tnm, "linky-hashish", false);
-                      if (NULL != t0)
-                        Rd->stuff->putstr(Rd->stuff, "linky-hashish",                   t0);
-                    }
-                  }
+              }
+              else
+              {
+                qstrcpy(shs->sesh,              sizeof(shs->sesh),              seshion);
+                qstrcpy(shs->toke_n_munchie,    sizeof(shs->toke_n_munchie),    toke_n_munchie);
+                qstrcpy(shs->hashish,           sizeof(shs->hashish),           hashish);
+                qstrcpy(shs->munchie,           sizeof(shs->munchie),           munchie);
+                qstrcpy(shs->salt,              sizeof(shs->salt),              tnm->getstr(tnm, "salt",   false));
+                qstrcpy(shs->seshID,            sizeof(shs->seshID),            tnm->getstr(tnm, "seshID", false));
+                shs->timeStamp[0].tv_nsec = UTIME_OMIT;
+                shs->timeStamp[0].tv_sec  = UTIME_OMIT;
+                memcpy(&shs->timeStamp[1], &st.st_mtim, sizeof(struct timespec));
+                t0 = tnm->getstr(tnm, "linky-hashish", false);
+                if (NULL != t0)
+                  Rd->stuff->putstr(Rd->stuff, "linky-hashish",                 t0);
+              }
+            }
 
-                  qhashtbl_obj_t obj;
+            qhashtbl_obj_t obj;
 
-                  memset((void*)&obj, 0, sizeof(obj));
-                  tnm->lock(tnm);
-                  while(tnm->getnext(tnm, &obj, false) == true)
-                  {
-                    char *n = obj.name;
+            memset((void*)&obj, 0, sizeof(obj));
+            tnm->lock(tnm);
+            while(tnm->getnext(tnm, &obj, false) == true)
+            {
+              char *n = obj.name;
 
-                    if ((strcmp("salt", n) != 0) && (strcmp("seshID", n) != 0))
-                    {
+              if ((strcmp("salt", n) != 0) && (strcmp("seshID", n) != 0))
+              {
 t("Lua %s = %s", n, (char *) obj.data);
-                      Rd->stuff->putstr(Rd->stuff, obj.name, (char *) obj.data);
-                    }
-                  }
-                  tnm->unlock(tnm);
-                  Rd->database->putstr(Rd->database, "UserAccounts.PrincipalID", tnm->getstr(tnm, "UUID", true));
-                }
+                Rd->stuff->putstr(Rd->stuff, obj.name, (char *) obj.data);
               }
+            }
+            tnm->unlock(tnm);
+            Rd->database->putstr(Rd->database, "UserAccounts.PrincipalID", tnm->getstr(tnm, "UUID", true));
           }
         }
+        free(munchie);
+        free(seshion);
       }
     }
+    free(leaf);
+    tnm->free(tnm);
   }
 
   return ret;
@@ -3597,6 +3642,7 @@ static int validateName(reqData *Rd, qhashtbl_t *data, char *nm)
         acnts->inParams  = szi;
         acnts->outParams = szo;
         acnts->where = "FirstName=? and LastName=?";
+        dbRequests->addfirst(dbRequests, acnts, sizeof(*acnts));
       }
       dbDoSomething(acnts, FALSE, name, s);
       rowData *rows = acnts->rows;
@@ -3621,8 +3667,8 @@ static int validateName(reqData *Rd, qhashtbl_t *data, char *nm)
           }
           else
           {
-             W("More than one UserAccounts record with that name.");
-             ret++;
+            W("More than one UserAccounts record with that name.");
+            ret++;
           } 
           bitch(Rd, "Login failed.", "Could not find user record.");
         }
@@ -3645,8 +3691,8 @@ static int validateName(reqData *Rd, qhashtbl_t *data, char *nm)
             Rd->database->putstr(Rd->database, "auth.passwordHash",             getStrH(tnm, "passwordHash"));
             tnm->free(tnm);
           }
-          Rd->stuff->putstr(Rd->stuff, "UUID",  xstrdup(getStrH(Rd->database, "UserAccounts.PrincipalID")));
-          Rd->stuff->putstr(Rd->stuff, "level", xstrdup(getStrH(Rd->database, "UserAccounts.Userlevel")));
+          Rd->stuff->putstr(Rd->stuff, "UUID",  getStrH(Rd->database, "UserAccounts.PrincipalID"));
+          Rd->stuff->putstr(Rd->stuff, "level", getStrH(Rd->database, "UserAccounts.Userlevel"));
           if (s)        {s--;  *s = ' ';  s++;}
           Rd->stuff->putstr(Rd->stuff,   "name",                        xstrdup(name));
           if (s)        {s--;  *s = '\0';  s++;}
@@ -3696,12 +3742,14 @@ static int validateName(reqData *Rd, qhashtbl_t *data, char *nm)
           Rd->stuff->putstr(Rd->stuff,   "name",                        xstrdup(name));
         }
       }
-      free(rows->rows);
       free(rows->fieldNames);
+      rows->rows->free(rows->rows);
       free(rows);
+      tnm->free(tnm);
       if (s)    {s--;  *s = ' ';  s++;}
     }
   }
+  free(name);
 
   badBoy(ret, Rd, data, "name", NULL);
   return ret;
@@ -3733,6 +3781,7 @@ static int validatePassword(reqData *Rd, qhashtbl_t *data, char *name)
       auth->inParams  = szi;
       auth->outParams = szo;
       auth->where = "UUID=?";
+      dbRequests->addfirst(dbRequests, auth, sizeof(*auth));
     }
     dbDoSomething(auth, FALSE, UUID);
     rowData *rows = auth->rows;
@@ -3776,11 +3825,15 @@ static int validatePassword(reqData *Rd, qhashtbl_t *data, char *name)
               ret++;
             }
             Rd->stuff->putstr(Rd->stuff, "passwordHash", md5ascii);
-            free(md5ascii);
           }
+          free(md5ascii);
           free(where);
         }
+        free(me);
       }
+      free(rows->fieldNames);
+      rows->rows->free(rows->rows);
+      free(rows);
     }
   }
   else if (create)
@@ -3827,6 +3880,7 @@ static int validatePassword(reqData *Rd, qhashtbl_t *data, char *name)
         }
         else
         {
+          free(salt);
           salt = qhex_encode(md5hash, 16);
           hash = xmprintf("%s:%s", salt, getStrH(Rd->stuff, "passwordSalt"));
           if (!qhashmd5((void *) hash, strlen(hash), md5hash))
@@ -3836,10 +3890,13 @@ static int validatePassword(reqData *Rd, qhashtbl_t *data, char *name)
           }
           else
           {
+            free(hash);
             hash = qhex_encode(md5hash, 16);
             Rd->stuff->putstr(Rd->stuff, "passwordHash", hash);
             Rd->chillOut = TRUE;
           }
+          free(hash);
+          free(salt);
         }
       }
     }
@@ -3866,7 +3923,7 @@ static int validatePassword(reqData *Rd, qhashtbl_t *data, char *name)
       {
         pswd = qhex_encode(md5hash, 16);
         hash = xmprintf("%s:%s", pswd, Osalt);
-
+        free(pswd);
         if (!qhashmd5((void *) hash, strlen(hash), md5hash))
         {
           bitch(Rd, "Internal session error.", "Confirm - qhashmd5(passwordSalt) failed.");
@@ -3874,12 +3931,14 @@ static int validatePassword(reqData *Rd, qhashtbl_t *data, char *name)
         }
         else
         {
+          free(hash);
           hash = qhex_encode(md5hash, 16);
           if (strcmp(hash, Ohash) != 0)
           {
             bitch(Rd, "Passwords are not the same.", "");
             ret++;
           }
+          free(hash);
         }
       }
     }
@@ -3920,6 +3979,7 @@ static int validateUUID(reqData *Rd, qhashtbl_t *data, char *name)
     uuids->inParams  = szi;
     uuids->outParams = szo;
     uuids->where = "PrincipalID=?";
+    dbRequests->addfirst(dbRequests, uuids, sizeof(*uuids));
   }
 
   if ((strcmp("cancel", Rd->doit) == 0) || (strcmp("logout", Rd->doit) == 0))
@@ -4017,13 +4077,14 @@ static int validateUUID(reqData *Rd, qhashtbl_t *data, char *name)
 
 void loginPage(reqData *Rd, char *message)
 {
-  char *name = xstrdup(getStrH(Rd->stuff, "name"));
+  char *name = xstrdup(getStrH(Rd->stuff, "name")), *linky = checkLinky(Rd);
 
   Rd->stuff->remove(Rd->stuff, "UUID");
   HTMLheader(Rd->reply, "<!--#echo var=\"grid\" --> account manager");
   HTMLdebug(Rd->reply);
   Rd->reply->addstrf(Rd->reply, "<h1><!--#echo var=\"grid\" --> account manager</h1>\n");
-  Rd->reply->addstr(Rd->reply, checkLinky(Rd));
+  Rd->reply->addstr(Rd->reply, linky);
+  free(linky);
   if (0 != Rd->errors->size(Rd->messages))
     HTMLlist(Rd->reply, "messages -", Rd->messages);
   HTMLform(Rd->reply, "", Rd->shs.munchie);
@@ -4044,7 +4105,7 @@ void loginPage(reqData *Rd, char *message)
 
 void accountCreationPage(reqData *Rd, char *message)
 {
-  char *name = getStrH(Rd->body, "name");
+  char *name = getStrH(Rd->body, "name"), *linky = checkLinky(Rd);
   char *toke_n_munchie = getCookie(Rd->Rcookies, "toke_n_munchie");
   char *tmp = xmalloc(16), *t;
   int i, d;
@@ -4058,7 +4119,8 @@ void accountCreationPage(reqData *Rd, char *message)
   HTMLdebug(Rd->reply);
   Rd->reply->addstrf(Rd->reply, "<h1><!--#echo var=\"grid\" --> account manager</h1>\n");
   Rd->reply->addstrf(Rd->reply, "<h2>Creating <!--#echo var=\"grid\" --> account for %s</h2>\n", name);
-  Rd->reply->addstr(Rd->reply, checkLinky(Rd));
+  Rd->reply->addstr(Rd->reply, linky);
+  free(linky);
   if (0 != Rd->errors->size(Rd->messages))
     HTMLlist(Rd->reply, "messages -", Rd->messages);
 // TODO - set this to autocomplete="off".
@@ -4124,14 +4186,15 @@ void accountCreationPage(reqData *Rd, char *message)
 
 void loggedOnPage(reqData *Rd, char *message)
 {
-  char *name = getStrH(Rd->stuff, "name");
+  char *name = getStrH(Rd->stuff, "name"), *linky = checkLinky(Rd);
   char *toke_n_munchie = getCookie(Rd->Rcookies, "toke_n_munchie");
 
   HTMLheader(Rd->reply, "<!--#echo var=\"grid\" --> account manager");
   HTMLdebug(Rd->reply);
   Rd->reply->addstrf(Rd->reply, "<h1><!--#echo var=\"grid\" --> account manager</h1>\n");
   Rd->reply->addstrf(Rd->reply, "<h2><!--#echo var=\"grid\" --> account for %s</h2>\n", name);
-  Rd->reply->addstr(Rd->reply, checkLinky(Rd));
+  Rd->reply->addstr(Rd->reply, linky);
+  free(linky);
   if (0 != Rd->errors->size(Rd->messages))
     HTMLlist(Rd->reply, "messages -", Rd->messages);
   HTMLform(Rd->reply, "", Rd->shs.munchie);
@@ -4163,14 +4226,15 @@ void loggedOnPage(reqData *Rd, char *message)
 void listPage(reqData *Rd, char *message)
 {
 // TODO - should check if the user is a god before allowing this.
-  char *name = getStrH(Rd->stuff, "name");
+  char *name = getStrH(Rd->stuff, "name"), *linky = checkLinky(Rd);
   char *toke_n_munchie = getCookie(Rd->Rcookies, "toke_n_munchie");
 
   HTMLheader(Rd->reply, "<!--#echo var=\"grid\" --> account manager");
   HTMLdebug(Rd->reply);
   Rd->reply->addstrf(Rd->reply, "<h1><!--#echo var=\"grid\" --> account manager</h1>\n");
   Rd->reply->addstrf(Rd->reply, "<h1><!--#echo var=\"grid\" --> member accounts</h1>\n");
-  Rd->reply->addstr(Rd->reply, checkLinky(Rd));
+  Rd->reply->addstr(Rd->reply, linky);
+  free(linky);
   if (0 != Rd->errors->size(Rd->messages))
     HTMLlist(Rd->reply, "messages -", Rd->messages);
   HTMLtable(Rd->reply, Rd->db,
@@ -4368,24 +4432,59 @@ void account_html(char *file, reqData *Rd, HTMLfile *thisFile)
 }
 
 
+static void cleanup(void) 
+{
+  C("Caught signal, cleaning up.");
+  dbRequest *req = NULL;
+
+  while (NULL != (req = (dbRequest *) dbRequests->getat(dbRequests, 0, NULL, false)))
+  {
+    if (NULL != req->flds)
+      dbFreeFields(req->flds);
+    else
+      D("No fields to clean up for %s - %s.", req->table, req->where);
+    dbFreeRequest(req);
+    dbRequests->removefirst(dbRequests);
+  }
+  if (fieldValidFuncs)  fieldValidFuncs->free(fieldValidFuncs);
+  if (dynPages)         dynPages->free(dynPages);
+  if (buildPages)       buildPages->free(buildPages);
+  if (HTMLfileCache)    HTMLfileCache->free(HTMLfileCache);
+  if (HTMLfileCache)    mimeTypes->free(mimeTypes);
+  if (dbRequests)       dbRequests->free(dbRequests);
+  if (database)         mysql_close(database);
+  mysql_library_end();
+  lua_close(L);
+  if (stats)
+  {
+    if (stats->stats)   stats->stats->free(stats->stats);
+    free(stats);
+  }
+  if (configs)          configs->free(configs);
+}
+
 void sledjchisl_main(void)
 {
   char *cmd = *toys.optargs;
   char *tmp;
-  qhashtbl_t *configs = qhashtbl(0, 0);
-  lua_State *L = luaL_newstate();
   MYSQL *database = NULL, *dbconn = NULL;
   gridStats *stats = NULL;
   struct stat statbuf;
   int status, result, i;
   void *vd;
 
+  configs = qhashtbl(0, 0);
+  L = luaL_newstate();
+
   I("libfcgi version: %s", FCGI_VERSION);
   I("Lua version: %s", LUA_RELEASE);
   I("LuaJIT version: %s", LUAJIT_VERSION);
   I("MariaDB / MySQL client version: %s", mysql_get_client_info());
   I("toybox version: %s", TOYBOX_VERSION);
 
+  dbRequests = qlist(0);
+  sigatexit(cleanup);
+
   pwd = getcwd(0, 0);
 
   if (-1 == fstat(STDIN_FILENO, &statbuf))
@@ -4594,6 +4693,7 @@ jit library is loaded or the JIT compiler will not be activated.
     if ((! qfile_exist(scLog))    && (! qfile_mkdir(scLog,      S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP, true)))  C("Unable to create path %s", scLog);
     tmp = xmprintf("%s/sessions", scCache);
     if ((! qfile_exist(tmp))      && (! qfile_mkdir(tmp,        S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP, true)))  C("Unable to create path %s", tmp);
+    free(tmp);
     tmp = xmprintf("%s/users", scData);
     if ((! qfile_exist(tmp))      && (! qfile_mkdir(tmp,        S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IXGRP, true)))  C("Unable to create path %s", tmp);
     free(tmp);
@@ -4632,6 +4732,7 @@ jit library is loaded or the JIT compiler will not be activated.
 // TODO - it looks like OpenSim invented their own half arsed backwards INI file include system.
 //          I doubt qlibc supports it, like it supports what seems to be the standard include system.
 //          Not sure if we need to worry about it just yet.
+// TODO - this leaks memory, but I suspect it's a bug in qLib.
     qlisttbl_t *qconfig = qconfig_parse_file(NULL, toybuf, '=');
     if (NULL == qconfig)
     {
@@ -4688,10 +4789,10 @@ jit library is loaded or the JIT compiler will not be activated.
     else
     {
       dbconn = mysql_real_connect(database,
-                                    configs->getstr(configs, "Data Source",  true),
-                                    configs->getstr(configs, "User ID",  true),
-                                    configs->getstr(configs, "Password",  true),
-                                    configs->getstr(configs, "Database",  true),
+                                    getStrH(configs, "Data Source"),
+                                    getStrH(configs, "User ID"),
+                                    getStrH(configs, "Password"),
+                                    getStrH(configs, "Database"),
 //                                  3036, "/var/run/mysqld/mysqld.sock",
                                     0, NULL,
                                     CLIENT_FOUND_ROWS | CLIENT_LOCAL_FILES | CLIENT_MULTI_STATEMENTS | CLIENT_MULTI_RESULTS);
@@ -4712,6 +4813,7 @@ jit library is loaded or the JIT compiler will not be activated.
 
       stats->stats->putstr(stats->stats, "uri",         toybuf);
     }
+    qconfig->free(qconfig);
   }
 
 
@@ -4779,6 +4881,7 @@ t("HEADERS");
       {
         char *k = xstrdup(*envp);
         char *v = strchr(k, '=');
+
         if (NULL != v)
         {
           *v = '\0';
@@ -4787,6 +4890,7 @@ t("HEADERS");
 if ((strcmp("HTTP_COOKIE", ky) == 0) || (strcmp("CONTENT_LENGTH", ky) == 0) || (strcmp("QUERY_STRING", ky) == 0))
   d("  %s = %s", ky, v + 1);
         }
+        free(k);
       }
 
       // The FCGI paramaters sent from the server, are converted to environment variablse for the fcgi2 SDK.
@@ -4846,6 +4950,7 @@ t("QUERY");
           Length = "0";
 t("BODY");
         Rd->body = toknize(Body,   "=&");
+        free(Body);
         santize(Rd->body, TRUE);
 
 
@@ -4902,8 +5007,9 @@ t("BODY");
 // TODO - maybe cache this?
           qlist_t *fragments = fragize(finl, Rd->reply->datasize(Rd->reply));
           Rd->reply->free(Rd->reply);
-          Rd->reply             = qgrow(QGROW_THREADSAFE);
-          unfragize(fragments, Rd);
+          Rd->reply = qgrow(QGROW_THREADSAFE);
+          unfragize(fragments, Rd, TRUE);
+          free(finl);
 goto sendReply;
         }
 
@@ -4943,7 +5049,7 @@ goto sendReply;
             goto sendReply;
 
         getStats(database, stats);
-        unfragize(thisFile->fragments, Rd);
+        unfragize(thisFile->fragments, Rd, false);
 
 sendReply:
         /* Send headers.
@@ -4969,7 +5075,7 @@ sendReply:
         while (Rd->Rcookies->getnext(Rd->Rcookies, &hobj, false) == true)
         {
           cookie *ck = (cookie *) hobj.data;
-          FCGI_printf("Set-Cookie: %s=%s", ck->cookie, ck->value);
+          FCGI_printf("Set-Cookie: %s=%s", hobj.name, ck->value);
 //        if (NULL      != ck->expires)         FCGI_printf("; Expires=%s", ck->expires);
           if (NULL      != ck->domain)          FCGI_printf("; Domain=%s", ck->domain);
           if (NULL      != ck->path)            FCGI_printf("; Path=%s", ck->path);
@@ -4981,7 +5087,6 @@ sendReply:
           if (CS_NONE   == ck->site)            FCGI_printf("; SameSite=None");
           FCGI_printf("\r\n");
           free(ck->value);
-          free(ck->cookie);
         }
         FCGI_printf("\r\n");
         Rd->cookies->unlock(Rd->cookies);
@@ -5028,6 +5133,7 @@ fcgiDone:
         double n = (now.tv_sec * 1000000000.0) + now.tv_nsec;
         double t = (Rd->then.tv_sec * 1000000000.0) + Rd->then.tv_nsec;
         I("Finished web request, took %lf seconds", (n - t) / 1000000000.0);
+        free(Rd);
     }
 
     FCGI_fprintf(FCGI_stderr, "Stopped SledjChisl web server.\n");
@@ -5209,13 +5315,5 @@ finished:
   puts("");
   fflush(stdout);
 
-  if (database)         mysql_close(database);
-  mysql_library_end();
-  lua_close(L);
-  if (stats)
-  {
-    if (stats->stats)   stats->stats->free(stats->stats);
-    free(stats);
-  }
-  if (configs)          configs->free(configs);
+  cleanup();
 }