From: Richard Mudgett <rmudgett@digium.com>
Date: Tue, 17 Mar 2015 16:25:23 +0000 (+0000)
Subject: Multiple revisions 431583,433005
X-Git-Tag: certified/13.1-cert3-rc1~41
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cd4e18c4cc15d4b9d8f3f658c7afac5bed6ad801;p=thirdparty%2Fasterisk.git

Multiple revisions 431583,433005

........
  r431583 | sgriepentrog | 2015-02-06 15:26:12 -0600 (Fri, 06 Feb 2015) | 10 lines

  various: cleanup issues found during leak hunt

  In this collection of small patches to prevent
  Valgrind errors are: fixes for reference leaks
  in config hooks, evaluating a parameter beyond
  bounds, and accessing a structure after a lock
  where it could have been already free'd.

  Review: https://reviewboard.asterisk.org/r/4407/
........
  r433005 | rmudgett | 2015-03-17 11:10:39 -0500 (Tue, 17 Mar 2015) | 1 line

  res_pjsip: Add reason comment.
........

Merged revisions 431583,433005 from http://svn.asterisk.org/svn/asterisk/branches/13


git-svn-id: https://origsvn.digium.com/svn/asterisk/certified/branches/13.1@433025 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/main/config.c b/main/config.c
index fe3ad3f9a6..3d6e93c900 100644
--- a/main/config.c
+++ b/main/config.c
@@ -3799,6 +3799,9 @@ static void config_shutdown(void)
 	AST_LIST_UNLOCK(&cfmtime_head);
 
 	ast_cli_unregister_multiple(cli_config, ARRAY_LEN(cli_config));
+
+	ao2_cleanup(cfg_hooks);
+	cfg_hooks = NULL;
 }
 
 int register_config_cli(void)
@@ -3887,5 +3890,6 @@ int ast_config_hook_register(const char *name,
 	hook->module = ast_strdup(module);
 
 	ao2_link(cfg_hooks, hook);
+	ao2_ref(hook, -1);
 	return 0;
 }
diff --git a/main/utils.c b/main/utils.c
index e3bb36e035..44e993c56f 100644
--- a/main/utils.c
+++ b/main/utils.c
@@ -1856,7 +1856,7 @@ void ast_join_delim(char *s, size_t len, const char * const w[], unsigned int si
 	/* Join words into a string */
 	if (!s)
 		return;
-	for (x = 0; ofs < len && w[x] && x < size; x++) {
+	for (x = 0; ofs < len && x < size && w[x] ; x++) {
 		if (x > 0)
 			s[ofs++] = delim;
 		for (src = w[x]; *src && ofs < len; src++)
diff --git a/res/res_pjsip.c b/res/res_pjsip.c
index 792e9559b3..033f14995c 100644
--- a/res/res_pjsip.c
+++ b/res/res_pjsip.c
@@ -2858,13 +2858,22 @@ struct sync_task_data {
 static int sync_task(void *data)
 {
 	struct sync_task_data *std = data;
+	int ret;
+
 	std->fail = std->task(std->task_data);
 
+	/*
+	 * Once we unlock std->lock after signaling, we cannot access
+	 * std again.  The thread waiting within
+	 * ast_sip_push_task_synchronous() is free to continue and
+	 * release its local variable (std).
+	 */
 	ast_mutex_lock(&std->lock);
 	std->complete = 1;
 	ast_cond_signal(&std->cond);
+	ret = std->fail;
 	ast_mutex_unlock(&std->lock);
-	return std->fail;
+	return ret;
 }
 
 int ast_sip_push_task_synchronous(struct ast_taskprocessor *serializer, int (*sip_task)(void *), void *task_data)