Fix memory/ref counting leaks in a variety of locations

This patch fixes the following memory leaks:
 * http.c: The structure containing the addresses to bind to was not being
   deallocated when no longer used
 * named_acl.c: The global configuration information was not disposed of
 * config_options.c: An invalid read was occurring for certain option types.
 * res_calendar.c: The loaded calendars on module unload were not being
   properly disposed of.
 * chan_motif.c: The format capabilities needed to be disposed of on module
   unload. In addition, this now specifies the default options for the
   maxpayloads and maxicecandidates in such a way that it doesn't cause the
   invalid read in config_options.c to occur.

(issue ASTERISK-21906)
Reported by: John Hardin
patches:
  http.patch uploaded by jhardin (license 6512)
  named_acl.patch uploaded by jhardin (license 6512)
  config_options.patch uploaded by jhardin (license 6512)
  res_calendar.patch uploaded by jhardin (license 6512)
  chan_motif.patch uploaded by jhardin (license 6512)

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@392810 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_motif.c b/channels/chan_motif.c
index 92710ac2ee0a6449be161d8d42a8f7e597d8b662..86b31e0fb75c160aae0870f9f1facd95625bab28 100644 (file)
--- a/channels/chan_motif.c
+++ b/channels/chan_motif.c
@@ -2555,9 +2555,9 @@ static int load_module(void)
        aco_option_register_custom(&cfg_info, "connection", ACO_EXACT, endpoint_options, NULL, custom_connection_handler, 0);
        aco_option_register_custom(&cfg_info, "transport", ACO_EXACT, endpoint_options, NULL, custom_transport_handler, 0);
        aco_option_register(&cfg_info, "maxicecandidates", ACO_EXACT, endpoint_options, DEFAULT_MAX_ICE_CANDIDATES, OPT_UINT_T, PARSE_DEFAULT,
-                           FLDSET(struct jingle_endpoint, maxicecandidates));
+                           FLDSET(struct jingle_endpoint, maxicecandidates), DEFAULT_MAX_ICE_CANDIDATES);
        aco_option_register(&cfg_info, "maxpayloads", ACO_EXACT, endpoint_options, DEFAULT_MAX_PAYLOADS, OPT_UINT_T, PARSE_DEFAULT,
-                           FLDSET(struct jingle_endpoint, maxpayloads));
+                           FLDSET(struct jingle_endpoint, maxpayloads), DEFAULT_MAX_PAYLOADS);
 
        ast_format_cap_add_all_by_type(jingle_tech.capabilities, AST_FORMAT_TYPE_AUDIO);
 
@@ -2608,6 +2608,8 @@ static int reload(void)
 static int unload_module(void)
 {
        ast_channel_unregister(&jingle_tech);
+       ast_format_cap_destroy(jingle_tech.capabilities);
+       jingle_tech.capabilities = NULL;
        ast_rtp_glue_unregister(&jingle_rtp_glue);
        ast_sched_context_destroy(sched);
        aco_info_destroy(&cfg_info);

diff --git a/main/config_options.c b/main/config_options.c
index 5e76a7a7be3919004e18b33e5fe599ad18932055..e2547e698f12de80cbb791056ae29d3b6fbe0a03 100644 (file)
--- a/main/config_options.c
+++ b/main/config_options.c
@@ -153,14 +153,15 @@ static int link_option_to_types(struct aco_type **types, struct aco_option *opt)
                        return -1;
                }
                if (!ao2_link(type->internal->opts, opt)) {
-                       while (--idx) {
+                       do {
                                ao2_unlink(types[idx]->internal->opts, opt);
-                       }
+                       } while (--idx);
                        return -1;
                }
-               /* The container should hold the only ref to opt */
-               ao2_ref(opt, -1);
        }
+       /* The container(s) should hold the only ref to opt */
+       ao2_ref(opt, -1);
+
        return 0;
 }
 

diff --git a/main/http.c b/main/http.c
index a41e1b4a49583794f495eefd495b109008e2453a..565c41f8e099cf1c9a4413118dc669656db82a2b 100644 (file)
--- a/main/http.c
+++ b/main/http.c
@@ -1024,7 +1024,7 @@ static int __ast_http_load(int reload)
        struct http_uri_redirect *redirect;
        struct ast_flags config_flags = { reload ? CONFIG_FLAG_FILEUNCHANGED : 0 };
        uint32_t bindport = DEFAULT_PORT;
-       struct ast_sockaddr *addrs = NULL;
+       RAII_VAR(struct ast_sockaddr *, addrs, NULL, ast_free);
        int num_addrs = 0;
        int http_tls_was_enabled = 0;
 

diff --git a/main/named_acl.c b/main/named_acl.c
index 59e1d1f94b58e5ba3ee07470241f6d781e4071d7..2ec2d7045dd311cbcf51cbc51701e36b92676d61 100644 (file)
--- a/main/named_acl.c
+++ b/main/named_acl.c
@@ -555,10 +555,18 @@ static struct ast_cli_entry cli_named_acl[] = {
        AST_CLI_DEFINE(handle_show_named_acl_cmd, "Show a named ACL or list all named ACLs"),
 };
 
+static void named_acl_cleanup(void)
+{
+       aco_info_destroy(&cfg_info);
+       ao2_global_obj_release(globals);
+}
+
 int ast_named_acl_init()
 {
        ast_cli_register_multiple(cli_named_acl, ARRAY_LEN(cli_named_acl));
 
+       ast_register_atexit(named_acl_cleanup);
+
        if (aco_info_init(&cfg_info)) {
                return 0;
        }

diff --git a/res/res_calendar.c b/res/res_calendar.c
index 13c95d9a9db32e25c394ef0f531adff600a17ab1..b60d8234d9501754d17a8bfcfc32a8ea7c760063 100644 (file)
--- a/res/res_calendar.c
+++ b/res/res_calendar.c
@@ -1810,6 +1810,8 @@ static int unload_module(void)
 
        /* Remove all calendars */
        ao2_callback(calendars, OBJ_UNLINK | OBJ_NODATA | OBJ_MULTIPLE, NULL, NULL);
+       ao2_cleanup(calendars);
+       calendars = NULL;
 
        ast_mutex_lock(&refreshlock);
        module_unloading = 1;