Fix more memory leaks

This patch adds to what was fixed in r366880.  Specifically, it addresses the
following:

* chan_sip:   dispose of an allocated frame in off nominal code paths in
              sip_rtp_read
* func_odbc:  when disposing of an allocated resultset, ensure that any rows
              that were appended to that resultset are also disposed of
* cli:        free the created return string buffer in another off nominal code
              path
* chan_dahdi: free a frame that was allocated by the dsp layer if we choose
              not to process that frame

(issue ASTERISK-19665)
Reported by: Matt Jordan

Review: https://reviewboard.asterisk.org/r/1922/
........

Merged revisions 366944 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 366948 from http://svn.asterisk.org/svn/asterisk/branches/10

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@366955 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/channels/chan_dahdi.c b/channels/chan_dahdi.c
index 77b2eb8..38a8943 100644 (file)
--- a/channels/chan_dahdi.c
+++ b/channels/chan_dahdi.c
@@ -9321,6 +9321,7 @@ static struct ast_frame *dahdi_read(struct ast_channel *ast)
                        } else if (p->dialtone_detect && !p->outgoing && f->frametype == AST_FRAME_VOICE) {
                                if ((ast_dsp_get_tstate(p->dsp) == DSP_TONE_STATE_DIALTONE) && (ast_dsp_get_tcount(p->dsp) > 9)) {
                                        /* Dialtone detected on inbound call; hangup the channel */
+                                       ast_frfree(f);
                                        f = NULL;
                                }
                        } else if (f->frametype == AST_FRAME_DTMF_BEGIN

diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index a21ebf3..e2d2daf 100644 (file)
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -7582,6 +7582,7 @@ static struct ast_frame *sip_rtp_read(struct ast_channel *ast, struct sip_pvt *p
        if (f && (f->frametype == AST_FRAME_DTMF_BEGIN || f->frametype == AST_FRAME_DTMF_END) &&
            (ast_test_flag(&p->flags[0], SIP_DTMF) != SIP_DTMF_RFC2833)) {
                ast_debug(1, "Ignoring DTMF (%c) RTP frame because dtmfmode is not RFC2833\n", f->subclass.integer);
+               ast_frfree(f);
                return &ast_null_frame;
        }
 
@@ -7594,6 +7595,7 @@ static struct ast_frame *sip_rtp_read(struct ast_channel *ast, struct sip_pvt *p
                if (!ast_format_cap_iscompatible(p->jointcaps, &f->subclass.format)) {
                        ast_debug(1, "Bogus frame of format '%s' received from '%s'!\n",
                                ast_getformatname(&f->subclass.format), ast_channel_name(p->owner));
+                       ast_frfree(f);
                        return &ast_null_frame;
                }
                ast_debug(1, "Oooh, format changed to %s\n",

diff --git a/funcs/func_odbc.c b/funcs/func_odbc.c
index 72a87cc..5b24878 100644 (file)
--- a/funcs/func_odbc.c
+++ b/funcs/func_odbc.c
@@ -151,6 +151,11 @@ static void odbc_datastore_free(void *data)
 {
        struct odbc_datastore *result = data;
        struct odbc_datastore_row *row;
+
+       if (!result) {
+               return;
+       }
+
        AST_LIST_LOCK(result);
        while ((row = AST_LIST_REMOVE_HEAD(result, list))) {
                ast_free(row);
@@ -539,7 +544,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
                        pbx_builtin_setvar_helper(chan, "ODBCROWS", rowcount);
                        ast_autoservice_stop(chan);
                }
-               ast_free(resultset);
+               odbc_datastore_free(resultset);
                return -1;
        }
 
@@ -554,7 +559,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
                        pbx_builtin_setvar_helper(chan, "ODBCROWS", rowcount);
                        ast_autoservice_stop(chan);
                }
-               ast_free(resultset);
+               odbc_datastore_free(resultset);
                return -1;
        }
 
@@ -580,7 +585,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
                        pbx_builtin_setvar_helper(chan, "ODBCSTATUS", status);
                        ast_autoservice_stop(chan);
                }
-               ast_free(resultset);
+               odbc_datastore_free(resultset);
                return res1;
        }
 
@@ -594,7 +599,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
                        char *ptrcoldata;
 
                        if (!coldata) {
-                               ast_free(resultset);
+                               odbc_datastore_free(resultset);
                                SQLCloseCursor(stmt);
                                SQLFreeHandle(SQL_HANDLE_STMT, stmt);
                                ast_odbc_release_obj(obj);
@@ -627,7 +632,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
                                        void *tmp = ast_realloc(resultset, sizeof(*resultset) + ast_str_strlen(colnames) + 1);
                                        if (!tmp) {
                                                ast_log(LOG_ERROR, "No space for a new resultset?\n");
-                                               ast_free(resultset);
+                                               odbc_datastore_free(resultset);
                                                SQLCloseCursor(stmt);
                                                SQLFreeHandle(SQL_HANDLE_STMT, stmt);
                                                ast_odbc_release_obj(obj);

diff --git a/main/cli.c b/main/cli.c
index c54d89e..d901e5c 100644 (file)
--- a/main/cli.c
+++ b/main/cli.c
@@ -2360,8 +2360,10 @@ char **ast_cli_completion_matches(const char *text, const char *word)
 
        /* ensure that the array is NULL terminated */
        if (matches + 1 >= match_list_len) {
-               if (!(match_list = ast_realloc(match_list, (match_list_len + 1) * sizeof(*match_list))))
+               if (!(match_list = ast_realloc(match_list, (match_list_len + 1) * sizeof(*match_list)))) {
+                       ast_free(retstr);
                        return NULL;
+               }
        }
        match_list[matches + 1] = NULL;