Stasis: Fix potential memory leak of control data.

When queuing tasks onto the Stasis control queue, you can pass an
arbitrary data pointer and a function to free that data. All ARI
commands that use the Stasis control queue made the assumption that the
destructor function would be called in all paths, whether the task was
queued successfully or not. However, this was not correct. If a task was
queued onto a control structure that was already completed, the
allocated data would not be freed properly.

This patch corrects this by making sure that all return paths call the
data destructor.

Change-Id: Ibf06522094f8e5c4cce652537dc5d7222b1c4fcb

diff --git a/res/stasis/control.c b/res/stasis/control.c
index 87362df16cc7a280158d2e5a882f3810f60f4324..badd991d966e5fdde84733aa2f81711a44a612d2 100644 (file)
--- a/res/stasis/control.c
+++ b/res/stasis/control.c
@@ -746,6 +746,14 @@ static int app_send_command_on_condition(struct stasis_app_control *control,
        RAII_VAR(struct stasis_app_command *, command, NULL, ao2_cleanup);
 
        if (control == NULL || control->is_done) {
+               /* If exec_command_on_condition fails, it calls the data_destructor.
+                * In order to provide consistent behavior, we'll also call the data_destructor
+                * on this error path. This way, callers never have to call the
+                * data_destructor themselves.
+                */
+               if (data_destructor) {
+                       data_destructor(data);
+               }
                return -1;
        }
 
@@ -771,6 +779,14 @@ int stasis_app_send_command_async(struct stasis_app_control *control,
        RAII_VAR(struct stasis_app_command *, command, NULL, ao2_cleanup);
 
        if (control == NULL || control->is_done) {
+               /* If exec_command fails, it calls the data_destructor. In order to
+                * provide consistent behavior, we'll also call the data_destructor
+                * on this error path. This way, callers never have to call the
+                * data_destructor themselves.
+                */
+               if (data_destructor) {
+                       data_destructor(data);
+               }
                return -1;
        }