Fix more memory leaks

This patch adds to what was fixed in r366880.  Specifically, it addresses the
following:

* chan_sip:  dispose of an allocated frame in off nominal code paths in
             sip_rtp_read
* func_odbc: when disposing of an allocated resultset, ensure that any rows
             that were appended to that resultset are also disposed of
* cli:       free the created return string buffer in another off nominal code
             path

(issue ASTERISK-19665)
Reported by: Matt Jordan

Review: https://reviewboard.asterisk.org/r/1922/
........

Merged revisions 366944 from http://svn.asterisk.org/svn/asterisk/branches/1.8

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10@366948 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index 60fd68f26dfb51ef1f1fe4dae2cf7ca0ff8ac9fa..17181c21f2cd65f0826d7a7a5425c4d4a27598bb 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -7498,6 +7498,7 @@ static struct ast_frame *sip_rtp_read(struct ast_channel *ast, struct sip_pvt *p
        if (f && (f->frametype == AST_FRAME_DTMF_BEGIN || f->frametype == AST_FRAME_DTMF_END) &&
            (ast_test_flag(&p->flags[0], SIP_DTMF) != SIP_DTMF_RFC2833)) {
                ast_debug(1, "Ignoring DTMF (%c) RTP frame because dtmfmode is not RFC2833\n", f->subclass.integer);
+               ast_frfree(f);
                return &ast_null_frame;
        }
 
@@ -7510,6 +7511,7 @@ static struct ast_frame *sip_rtp_read(struct ast_channel *ast, struct sip_pvt *p
                if (!ast_format_cap_iscompatible(p->jointcaps, &f->subclass.format)) {
                        ast_debug(1, "Bogus frame of format '%s' received from '%s'!\n",
                                ast_getformatname(&f->subclass.format), p->owner->name);
+                       ast_frfree(f);
                        return &ast_null_frame;
                }
                ast_debug(1, "Oooh, format changed to %s\n",

diff --git a/funcs/func_odbc.c b/funcs/func_odbc.c
index 667e093b30c5e6aa9ce4b9219c203237a0aee9dc..e2a6a62d5b61d5ba788fabd3b581cdf9fbf8f184 100644 (file)
--- a/funcs/func_odbc.c
+++ b/funcs/func_odbc.c
@@ -151,6 +151,11 @@ static void odbc_datastore_free(void *data)
 {
        struct odbc_datastore *result = data;
        struct odbc_datastore_row *row;
+
+       if (!result) {
+               return;
+       }
+
        AST_LIST_LOCK(result);
        while ((row = AST_LIST_REMOVE_HEAD(result, list))) {
                ast_free(row);
@@ -539,7 +544,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
                        pbx_builtin_setvar_helper(chan, "ODBCROWS", rowcount);
                        ast_autoservice_stop(chan);
                }
-               ast_free(resultset);
+               odbc_datastore_free(resultset);
                return -1;
        }
 
@@ -554,7 +559,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
                        pbx_builtin_setvar_helper(chan, "ODBCROWS", rowcount);
                        ast_autoservice_stop(chan);
                }
-               ast_free(resultset);
+               odbc_datastore_free(resultset);
                return -1;
        }
 
@@ -580,7 +585,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
                        pbx_builtin_setvar_helper(chan, "ODBCSTATUS", status);
                        ast_autoservice_stop(chan);
                }
-               ast_free(resultset);
+               odbc_datastore_free(resultset);
                return res1;
        }
 
@@ -594,7 +599,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
                        char *ptrcoldata;
 
                        if (!coldata) {
-                               ast_free(resultset);
+                               odbc_datastore_free(resultset);
                                SQLCloseCursor(stmt);
                                SQLFreeHandle(SQL_HANDLE_STMT, stmt);
                                ast_odbc_release_obj(obj);
@@ -627,7 +632,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
                                        void *tmp = ast_realloc(resultset, sizeof(*resultset) + ast_str_strlen(colnames) + 1);
                                        if (!tmp) {
                                                ast_log(LOG_ERROR, "No space for a new resultset?\n");
-                                               ast_free(resultset);
+                                               odbc_datastore_free(resultset);
                                                SQLCloseCursor(stmt);
                                                SQLFreeHandle(SQL_HANDLE_STMT, stmt);
                                                ast_odbc_release_obj(obj);

diff --git a/main/cli.c b/main/cli.c
index 5802c1d54c6800b7b8e012d9c0a35ce89b6e1939..89ec3c47677e1a138d2a7c109d53628754787a74 100644 (file)
--- a/main/cli.c
+++ b/main/cli.c
@@ -2350,8 +2350,10 @@ char **ast_cli_completion_matches(const char *text, const char *word)
 
        /* ensure that the array is NULL terminated */
        if (matches + 1 >= match_list_len) {
-               if (!(match_list = ast_realloc(match_list, (match_list_len + 1) * sizeof(*match_list))))
+               if (!(match_list = ast_realloc(match_list, (match_list_len + 1) * sizeof(*match_list)))) {
+                       ast_free(retstr);
                        return NULL;
+               }
        }
        match_list[matches + 1] = NULL;