From: Corey Farrell <git@cfware.com>
Date: Mon, 6 Nov 2017 23:44:01 +0000 (-0500)
Subject: res_pjsip_config_wizard: Fix leaks and add check for malloc failure.
X-Git-Tag: 13.19.0-rc1~149^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4f75655cb679e4bc2b68c90427d9d086d3caf3c5;p=thirdparty%2Fasterisk.git

res_pjsip_config_wizard: Fix leaks and add check for malloc failure.

wizard_apply_handler():
- Free host if we fail to add it to the vector.

wizard_mapped_observer():
- Check for otw allocation failure.
- Free otw if we fail to add it to the vector.

Change-Id: Ib5d3bcabbd9c24dd8a3c9cc692a794a5f60243ad
---

diff --git a/res/res_pjsip_config_wizard.c b/res/res_pjsip_config_wizard.c
index c13ff4aca9..d487c4ddda 100644
--- a/res/res_pjsip_config_wizard.c
+++ b/res/res_pjsip_config_wizard.c
@@ -1003,7 +1003,10 @@ static int wizard_apply_handler(const struct ast_sorcery *sorcery, struct object
 		char *hosts = ast_strdupa(remote_hosts);
 
 		while ((host = ast_strsep(&hosts, ',', AST_STRSEP_TRIM))) {
-			AST_VECTOR_APPEND(&remote_hosts_vector, ast_strdup(host));
+			host = ast_strdup(host);
+			if (host && AST_VECTOR_APPEND(&remote_hosts_vector, host)) {
+				ast_free(host);
+			}
 		}
 	}
 
@@ -1170,15 +1173,22 @@ static void wizard_mapped_observer(const char *name, struct ast_sorcery *sorcery
 	/* We're only interested in memory wizards with the pjsip_wizard tag. */
 	if (wizard_args && !strcmp(wizard_args, "pjsip_wizard")) {
 		otw = ast_malloc(sizeof(*otw) + strlen(object_type) + 1);
+		if (!otw) {
+			return;
+		}
+
 		otw->sorcery = sorcery;
 		otw->wizard = wizard;
 		otw->wizard_data = wizard_data;
 		otw->last_config = NULL;
 		strcpy(otw->object_type, object_type); /* Safe */
 		AST_VECTOR_RW_WRLOCK(&object_type_wizards);
-		AST_VECTOR_APPEND(&object_type_wizards, otw);
+		if (AST_VECTOR_APPEND(&object_type_wizards, otw)) {
+			ast_free(otw);
+		} else {
+			ast_debug(1, "Wizard mapped for object_type '%s'\n", object_type);
+		}
 		AST_VECTOR_RW_UNLOCK(&object_type_wizards);
-		ast_debug(1, "Wizard mapped for object_type '%s'\n", object_type);
 	}
 }