res_rtp_asterisk: Fix ref leaks in ast_rtcp_read().

Moved rtcp_report RAII_VAR declaration into the loop so it is unref'ed
after every loop.  Moved message_blob to loop and switched it to a regular
variable.  The regular variable was used since message_blob is used in a
very contained way.

(closes issue ASTERISK-22565)
Reported by: Corey Farrell
Patches:
      rtcp_report-leak.patch (license #5909) patch uploaded by Corey Farrell
Tested by: Corey Farrell

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@399607 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/res/res_rtp_asterisk.c b/res/res_rtp_asterisk.c
index edc53f56b81648109b7a72b3a71037d7d1e1f849..a5990c60f4ae9895892c6294432fe9086b8d5a4a 100644 (file)
--- a/res/res_rtp_asterisk.c
+++ b/res/res_rtp_asterisk.c
@@ -3210,10 +3210,6 @@ static struct ast_frame *ast_rtcp_read(struct ast_rtp_instance *instance)
        int res, packetwords, position = 0;
        int report_counter = 0;
        struct ast_rtp_rtcp_report_block *report_block;
-       RAII_VAR(struct ast_rtp_rtcp_report *, rtcp_report,
-                       NULL,
-                       ao2_cleanup);
-       RAII_VAR(struct ast_json *, message_blob, NULL, ast_json_unref);
        struct ast_frame *f = &ast_null_frame;
 
        /* Read in RTCP data from the socket */
@@ -3274,6 +3270,8 @@ static struct ast_frame *ast_rtcp_read(struct ast_rtp_instance *instance)
        while (position < packetwords) {
                int i, pt, rc;
                unsigned int length;
+               struct ast_json *message_blob;
+               RAII_VAR(struct ast_rtp_rtcp_report *, rtcp_report, NULL, ao2_cleanup);
 
                i = position;
                length = ntohl(rtcpheader[i]);
@@ -3397,6 +3395,7 @@ static struct ast_frame *ast_rtcp_read(struct ast_rtp_instance *instance)
                        ast_rtp_publish_rtcp_message(instance, ast_rtp_rtcp_received_type(),
                                        rtcp_report,
                                        message_blob);
+                       ast_json_unref(message_blob);
                        break;
                case RTCP_PT_FUR:
                /* Handle RTCP FIR as FUR */