sr-dev January 2012

sr-dev@lists.kamailio.org

25 participants
166 discussions

git:master: modules_k/pua: Last fix (PUA memory leaks) caused crashes in hash-table mode
by Peter Dunkley 25 Jan '12

25 Jan '12

Module: sip-router Branch: master Commit: d9af95bf84ad3ae9ed53ba15c7f518597cefcf3a URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=d9af95b… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Wed Jan 25 17:27:26 2012 +0000 modules_k/pua: Last fix (PUA memory leaks) caused crashes in hash-table mode - Fix by Paul Pankhurst @ Crocodile RCS --- modules_k/pua/send_publish.c | 13 ++++++++++--- modules_k/pua/send_subscribe.c | 15 +++++++++++---- 2 files changed, 21 insertions(+), 7 deletions(-) diff --git a/modules_k/pua/send_publish.c b/modules_k/pua/send_publish.c index a43bae7..6205994 100644 --- a/modules_k/pua/send_publish.c +++ b/modules_k/pua/send_publish.c @@ -341,7 +341,7 @@ void publ_cback_func(struct cell *t, int type, struct tmcb_params *ps) } size= sizeof(ua_pres_t)+ sizeof(str)+ (hentity->pres_uri->len+ hentity->tuple_id.len + - hentity->id.len + etag.len)* sizeof(char); + hentity->id.len)* sizeof(char); if(hentity->extra_headers) size+= sizeof(str)+ hentity->extra_headers->len* sizeof(char); @@ -391,10 +391,14 @@ void publ_cback_func(struct cell *t, int type, struct tmcb_params *ps) presentity->flag|= hentity->flag; presentity->event|= hentity->event; - presentity->etag.s= (char*)presentity+ size; + presentity->etag.s= (char*)shm_malloc(etag.len* sizeof(char)); + if(presentity->etag.s== NULL) + { + LM_ERR("No more share memory\n"); + goto error; + } memcpy(presentity->etag.s, etag.s, etag.len); presentity->etag.len= etag.len; - size+= presentity->etag.len; if (dbmode==PUA_DB_ONLY) { @@ -417,7 +421,10 @@ done: *ps->param= NULL; } if(dbmode==PUA_DB_ONLY && presentity) + { + shm_free(presentity->etag.s); shm_free(presentity); + } free_results_puadb(res); return; diff --git a/modules_k/pua/send_subscribe.c b/modules_k/pua/send_subscribe.c index eebb1a4..4269bd0 100644 --- a/modules_k/pua/send_subscribe.c +++ b/modules_k/pua/send_subscribe.c @@ -564,7 +564,7 @@ void subs_cback_func(struct cell *t, int cb_type, struct tmcb_params *ps) size= sizeof(ua_pres_t)+ 2*sizeof(str)+( pto->uri.len+ pfrom->uri.len+ pto->tag_value.len+ pfrom->tag_value.len +msg->callid->body.len+ record_route.len+ hentity->contact.len+ - hentity->id.len + contact.len)*sizeof(char); + hentity->id.len )*sizeof(char); if(hentity->extra_headers) size+= sizeof(str)+ hentity->extra_headers->len*sizeof(char); @@ -653,10 +653,13 @@ void subs_cback_func(struct cell *t, int cb_type, struct tmcb_params *ps) } /* write the remote contact filed */ - presentity->remote_contact.s= (char*)presentity+ size; + presentity->remote_contact.s= (char*)shm_malloc(contact.len* sizeof(char)); + if(presentity->remote_contact.s== NULL) + { + ERR_MEM(SHARE_MEM); + } memcpy(presentity->remote_contact.s, contact.s, contact.len); presentity->remote_contact.len= contact.len; - size+= presentity->remote_contact.len; presentity->event|= hentity->event; presentity->flag= hentity->flag; @@ -693,7 +696,11 @@ error: if (presentity!=NULL) { delete_temporary_dialog_puadb(presentity); - if (need_to_free) shm_free(presentity); + if (need_to_free) + { + if (presentity->remote_contact.s) shm_free(presentity->remote_contact.s); + shm_free(presentity); + } } } else

1 0

git:master: modules_k/pua: Fixes to memory leaks in PUA when using database only mode
by Peter Dunkley 25 Jan '12

25 Jan '12

Module: sip-router Branch: master Commit: 91e2af3efafd3f3143830399e159331648d96763 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=91e2af3… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Wed Jan 25 14:54:37 2012 +0000 modules_k/pua: Fixes to memory leaks in PUA when using database only mode - Found and fixed by Paul Pankhurst @ Crocodile RCS --- modules_k/pua/send_publish.c | 14 ++++++-------- modules_k/pua/send_subscribe.c | 19 +++++++++++++------ 2 files changed, 19 insertions(+), 14 deletions(-) diff --git a/modules_k/pua/send_publish.c b/modules_k/pua/send_publish.c index 816ff1d..a43bae7 100644 --- a/modules_k/pua/send_publish.c +++ b/modules_k/pua/send_publish.c @@ -341,7 +341,7 @@ void publ_cback_func(struct cell *t, int type, struct tmcb_params *ps) } size= sizeof(ua_pres_t)+ sizeof(str)+ (hentity->pres_uri->len+ hentity->tuple_id.len + - hentity->id.len)* sizeof(char); + hentity->id.len + etag.len)* sizeof(char); if(hentity->extra_headers) size+= sizeof(str)+ hentity->extra_headers->len* sizeof(char); @@ -352,7 +352,6 @@ void publ_cback_func(struct cell *t, int type, struct tmcb_params *ps) goto error; } memset(presentity, 0, size); - memset(&presentity->etag, 0, sizeof(str)); size= sizeof(ua_pres_t); presentity->pres_uri= (str*)((char*)presentity+ size); @@ -392,14 +391,10 @@ void publ_cback_func(struct cell *t, int type, struct tmcb_params *ps) presentity->flag|= hentity->flag; presentity->event|= hentity->event; - presentity->etag.s= (char*)shm_malloc(etag.len* sizeof(char)); - if(presentity->etag.s== NULL) - { - LM_ERR("No more share memory\n"); - goto error; - } + presentity->etag.s= (char*)presentity+ size; memcpy(presentity->etag.s, etag.s, etag.len); presentity->etag.len= etag.len; + size+= presentity->etag.len; if (dbmode==PUA_DB_ONLY) { @@ -421,6 +416,9 @@ done: shm_free(*ps->param); *ps->param= NULL; } + if(dbmode==PUA_DB_ONLY && presentity) + shm_free(presentity); + free_results_puadb(res); return; diff --git a/modules_k/pua/send_subscribe.c b/modules_k/pua/send_subscribe.c index 4fb5529..eebb1a4 100644 --- a/modules_k/pua/send_subscribe.c +++ b/modules_k/pua/send_subscribe.c @@ -241,6 +241,7 @@ void subs_cback_func(struct cell *t, int cb_type, struct tmcb_params *ps) int initial_request = 0; db1_res_t *res=NULL; ua_pres_t dbpres; + int need_to_free=0; str pres_uri={0,0}, watcher_uri={0,0}, extra_headers={0,0}; memset(&dbpres, 0, sizeof(dbpres)); @@ -563,7 +564,7 @@ void subs_cback_func(struct cell *t, int cb_type, struct tmcb_params *ps) size= sizeof(ua_pres_t)+ 2*sizeof(str)+( pto->uri.len+ pfrom->uri.len+ pto->tag_value.len+ pfrom->tag_value.len +msg->callid->body.len+ record_route.len+ hentity->contact.len+ - hentity->id.len )*sizeof(char); + hentity->id.len + contact.len)*sizeof(char); if(hentity->extra_headers) size+= sizeof(str)+ hentity->extra_headers->len*sizeof(char); @@ -576,6 +577,11 @@ void subs_cback_func(struct cell *t, int cb_type, struct tmcb_params *ps) pkg_free(record_route.s); goto done; } + else + { + need_to_free=1; + } + memset(presentity, 0, size); size= sizeof(ua_pres_t); @@ -647,13 +653,10 @@ void subs_cback_func(struct cell *t, int cb_type, struct tmcb_params *ps) } /* write the remote contact filed */ - presentity->remote_contact.s= (char*)shm_malloc(contact.len* sizeof(char)); - if(presentity->remote_contact.s== NULL) - { - ERR_MEM(SHARE_MEM); - } + presentity->remote_contact.s= (char*)presentity+ size; memcpy(presentity->remote_contact.s, contact.s, contact.len); presentity->remote_contact.len= contact.len; + size+= presentity->remote_contact.len; presentity->event|= hentity->event; presentity->flag= hentity->flag; @@ -688,7 +691,10 @@ error: if (dbmode == PUA_DB_ONLY) { if (presentity!=NULL) + { delete_temporary_dialog_puadb(presentity); + if (need_to_free) shm_free(presentity); + } } else { @@ -1082,6 +1088,7 @@ insert: if (dbmode==PUA_DB_ONLY) { insert_puadb(presentity); + shm_free(presentity); } else {

1 0

git:master: modules_k/rls: Fixed a small whitespace issue in send_notifies( )
by Peter Dunkley 24 Jan '12

24 Jan '12

Module: sip-router Branch: master Commit: 2edb81dd7fe3ec9564dcd6afac89f068158663ea URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=2edb81d… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Tue Jan 24 18:01:31 2012 +0000 modules_k/rls: Fixed a small whitespace issue in send_notifies() --- modules_k/rls/resource_notify.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules_k/rls/resource_notify.c b/modules_k/rls/resource_notify.c index b450d56..b79e83b 100644 --- a/modules_k/rls/resource_notify.c +++ b/modules_k/rls/resource_notify.c @@ -230,7 +230,7 @@ static void send_notifies(db1_res_t *result, int did_col, int resource_uri_col, /*if first or different*/ if(prev_did==NULL || strcmp(prev_did, curr_did)!=0) { - /* Work out a subscription from the did. */ + /* Work out a subscription from the did. */ get_dialog_from_did(curr_did, &dialog, &hash_code); if(dialog== NULL) { @@ -296,7 +296,7 @@ static void send_notifies(db1_res_t *result, int did_col, int resource_uri_col, else if(auth_state_flag & TERMINATED_STATE) { - len_est += strlen(row_vals[resource_uri_col].val.string_val) + 10; /* reason="[resaon]" */ + len_est += strlen(row_vals[resource_uri_col].val.string_val) + 10; /* reason="[resaon]" */ } if (rls_max_notify_body_len > 0 && len_est > rls_max_notify_body_len)

1 0

git:3.2: modules_k/rls: Removed unnecessary subscription and external_hash arguments from send_notifies ()
by Peter Dunkley 24 Jan '12

24 Jan '12

Module: sip-router Branch: 3.2 Commit: 5e6bf2c7402e5d07d63d7a2a2d584fbdb7cf241f URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=5e6bf2c… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Tue Jan 24 17:59:40 2012 +0000 modules_k/rls: Removed unnecessary subscription and external_hash arguments from send_notifies() - These were not used, or rather, not used in any sensible way in send_notifies() - Fix by Andrew Miller @ Crocodile RCS - Manually merged as all the whitespace changes caused git cherry-pick to fail --- modules_k/rls/resource_notify.c | 229 +++++++++++++++++---------------------- 1 files changed, 100 insertions(+), 129 deletions(-) Diff: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commitdiff;h=5e6…

1 0

git:3.2: modules_k/rls: Fixed memory leak in process_list_and_exec()
by Peter Dunkley 24 Jan '12

24 Jan '12

Module: sip-router Branch: 3.2 Commit: 6acddd35953c7a75d04d03f7a8c177beb08c2a57 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=6acddd3… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Tue Jan 24 17:34:52 2012 +0000 modules_k/rls: Fixed memory leak in process_list_and_exec() - xmlFree was called on rl_doc, but xmlFreeDoc should have been called - Found and fixed by Paul Pankhurst @ Crocodile RCS (cherry picked from commit ca938a37c87782c709b441c682f723d07b05c64c) --- modules_k/rls/notify.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules_k/rls/notify.c b/modules_k/rls/notify.c index b9bad7f..d9a1397 100644 --- a/modules_k/rls/notify.c +++ b/modules_k/rls/notify.c @@ -979,7 +979,7 @@ int process_list_and_exec(xmlNodePtr list_node, str username, str domain, LM_DBG("calling myself for rl_node\n"); res = process_list_and_exec(rl_node, username, domain, function, param); xmlFree(uri); - xmlFree(rl_doc); + xmlFreeDoc(rl_doc); } else {

1 0

git:3.2: modules_k/rls: Fixed memory leak in send_full_notify()
by Peter Dunkley 24 Jan '12

24 Jan '12

Module: sip-router Branch: 3.2 Commit: a9553f0e0f8c0fac159bc1c4da77501132ebac82 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=a9553f0… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Tue Jan 24 17:31:27 2012 +0000 modules_k/rls: Fixed memory leak in send_full_notify() - Package memory is allocated for URIs in add_resource_to_list() but never freed. - It should be freed in send_full_notify() at the same time as the memory allocated for the list itself is freed. - Found and fixed by Paul Pankhurst @ Crocodile RCS (cherry picked from commit 19abd6497cc1431d97383eeea76c34c4a1c5a9da) --- modules_k/rls/notify.c | 112 ++++++++++++++++++++++++----------------------- 1 files changed, 57 insertions(+), 55 deletions(-) diff --git a/modules_k/rls/notify.c b/modules_k/rls/notify.c index d9a1397..6cc3226 100644 --- a/modules_k/rls/notify.c +++ b/modules_k/rls/notify.c @@ -87,18 +87,18 @@ int send_full_notify(subs_t* subs, xmlNodePtr rl_node, str* rl_uri, unsigned int hash_code) { xmlDocPtr rlmi_body= NULL; - xmlNodePtr list_node= NULL; + xmlNodePtr list_node= NULL; db_key_t query_cols[2], update_cols[2], result_cols[7]; db_val_t query_vals[2], update_vals[2]; db1_res_t *result= NULL; int n_result_cols= 0; char* boundary_string; str rlsubs_did= {0, 0}; - str* rlmi_cont= NULL; - uri_link_t *uri_list_head = NULL; - int len_est; - res_param_t param; - int resource_added = 0; /* Flag to indicate that we have added at least one resource */ + str* rlmi_cont= NULL; + uri_link_t *uri_list_head = NULL; + int len_est; + res_param_t param; + int resource_added = 0; /* Flag to indicate that we have added at least one resource */ LM_DBG("start\n"); /* query in alfabetical order */ @@ -135,7 +135,7 @@ int send_full_notify(subs_t* subs, xmlNodePtr rl_node, str* rl_uri, if(result== NULL) goto error; - /* Allocate an initial buffer for the multipart body. + /* Allocate an initial buffer for the multipart body. * This buffer will be reallocated if neccessary */ multipart_body= (str*)pkg_malloc(sizeof(str)); if(multipart_body== NULL) @@ -143,8 +143,8 @@ int send_full_notify(subs_t* subs, xmlNodePtr rl_node, str* rl_uri, ERR_MEM(PKG_MEM_STR); } - multipart_body_size = BUF_REALLOC_SIZE; - multipart_body->s = (char *)pkg_malloc(multipart_body_size); + multipart_body_size = BUF_REALLOC_SIZE; + multipart_body->s = (char *)pkg_malloc(multipart_body_size); if(multipart_body->s== NULL) { @@ -153,13 +153,13 @@ int send_full_notify(subs_t* subs, xmlNodePtr rl_node, str* rl_uri, multipart_body->len= 0; - /* Create an empty rlmi document */ + /* Create an empty rlmi document */ len_est = create_empty_rlmi_doc(&rlmi_body, &list_node, rl_uri, subs->version, 1); xmlDocSetRootElement(rlmi_body, list_node); - /* Find all the uri's to which we are subscribed */ + /* Find all the uri's to which we are subscribed */ param.next = &uri_list_head; - if( process_list_and_exec(rl_node, subs->from_user, subs->from_domain, add_resource_to_list,(void*)(&param))< 0) + if(process_list_and_exec(rl_node, subs->from_user, subs->from_domain, add_resource_to_list,(void*)(&param))< 0) { LM_ERR("in process_list_and_exec function\n"); goto error; @@ -167,52 +167,54 @@ int send_full_notify(subs_t* subs, xmlNodePtr rl_node, str* rl_uri, boundary_string= generate_string((int)time(NULL), BOUNDARY_STRING_LEN); - while (uri_list_head) + while (uri_list_head) { - uri_link_t *last = uri_list_head; - if (add_resource(uri_list_head->uri, list_node, boundary_string, result, &len_est) >0) - { - if (resource_added == 0) - { - /* We have exceeded our length estimate without adding any resource. - We cannot send this resource, move on. */ - LM_ERR("Failed to add a single resource %d vs %d\n", len_est, rls_max_notify_body_len); - uri_list_head = uri_list_head->next; - pkg_free(last); - } - else - { - LM_DBG("send_full_notify estimate exceeded %d vs %d\n", len_est, rls_max_notify_body_len); - /* If add_resource returns > 0 the resource did not fit in our size limit */ - rlmi_cont= (str*)pkg_malloc(sizeof(str)); - if(rlmi_cont== NULL) - { - ERR_MEM(PKG_MEM_STR); - } - /* Where we are worried about length we won't use padding */ - xmlDocDumpFormatMemory(rlmi_body,(xmlChar**)(void*)&rlmi_cont->s, - &rlmi_cont->len, 0); - xmlFreeDoc(rlmi_body); - - if(agg_body_sendn_update(rl_uri, boundary_string, rlmi_cont, - multipart_body, subs, hash_code)< 0) - { - LM_ERR("in function agg_body_sendn_update\n"); - goto error; - } + uri_link_t *last = uri_list_head; + if (add_resource(uri_list_head->uri, list_node, boundary_string, result, &len_est) >0) + { + if (resource_added == 0) + { + /* We have exceeded our length estimate without adding any resource. + We cannot send this resource, move on. */ + LM_ERR("Failed to add a single resource %d vs %d\n", len_est, rls_max_notify_body_len); + uri_list_head = uri_list_head->next; + if (last->uri) pkg_free(last->uri); + pkg_free(last); + } + else + { + LM_DBG("send_full_notify estimate exceeded %d vs %d\n", len_est, rls_max_notify_body_len); + /* If add_resource returns > 0 the resource did not fit in our size limit */ + rlmi_cont= (str*)pkg_malloc(sizeof(str)); + if(rlmi_cont== NULL) + { + ERR_MEM(PKG_MEM_STR); + } + /* Where we are worried about length we won't use padding */ + xmlDocDumpFormatMemory(rlmi_body,(xmlChar**)(void*)&rlmi_cont->s, + &rlmi_cont->len, 0); + xmlFreeDoc(rlmi_body); + + if(agg_body_sendn_update(rl_uri, boundary_string, rlmi_cont, + multipart_body, subs, hash_code)< 0) + { + LM_ERR("in function agg_body_sendn_update\n"); + goto error; + } - /* Create a new rlmi body, but not a full_state one this time */ - len_est = create_empty_rlmi_doc(&rlmi_body, &list_node, rl_uri, subs->version, 0); - xmlDocSetRootElement(rlmi_body, list_node); - multipart_body->len = 0; - resource_added = 0; - } - } - else + /* Create a new rlmi body, but not a full_state one this time */ + len_est = create_empty_rlmi_doc(&rlmi_body, &list_node, rl_uri, subs->version, 0); + xmlDocSetRootElement(rlmi_body, list_node); + multipart_body->len = 0; + resource_added = 0; + } + } + else { - resource_added = 1; - uri_list_head = uri_list_head->next; - pkg_free(last); + resource_added = 1; + uri_list_head = uri_list_head->next; + if (last->uri) pkg_free(last->uri); + pkg_free(last); } }

1 0

git:3.2: modules_k/presence_xml: Fixed memory leak in pres_watcher_allowed( )
by Peter Dunkley 24 Jan '12

24 Jan '12

Module: sip-router Branch: 3.2 Commit: 44eed062fa8d82ff0975b7d02e2360abd4e85364 URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=44eed06… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Tue Jan 24 17:18:34 2012 +0000 modules_k/presence_xml: Fixed memory leak in pres_watcher_allowed() - xmlFreeDoc() never called for xcap_tree - Found and fixed by Paul Pankhurst @ Crocodile RCS (cherry picked from commit fcd33bdfa3e5a08f22f4c77fbbf1db53d0afb4bd) --- modules_k/presence_xml/xcap_auth.c | 13 ++++++++++--- 1 files changed, 10 insertions(+), 3 deletions(-) diff --git a/modules_k/presence_xml/xcap_auth.c b/modules_k/presence_xml/xcap_auth.c index e9f2ad8..9838a06 100644 --- a/modules_k/presence_xml/xcap_auth.c +++ b/modules_k/presence_xml/xcap_auth.c @@ -83,13 +83,17 @@ int pres_watcher_allowed(subs_t* subs) node= get_rule_node(subs, xcap_tree); if(node== NULL) + { + xmlFreeDoc(xcap_tree); return 0; + } /* process actions */ actions_node = xmlNodeGetChildByName(node, "actions"); if(actions_node == NULL) { LM_DBG("actions_node NULL\n"); + xmlFreeDoc(xcap_tree); return 0; } LM_DBG("actions_node->name= %s\n", @@ -99,6 +103,7 @@ int pres_watcher_allowed(subs_t* subs) if(sub_handling_node== NULL) { LM_DBG("sub_handling_node NULL\n"); + xmlFreeDoc(xcap_tree); return 0; } sub_handling = (char*)xmlNodeGetContent(sub_handling_node); @@ -110,6 +115,7 @@ int pres_watcher_allowed(subs_t* subs) if(sub_handling== NULL) { LM_ERR("Couldn't get sub-handling content\n"); + xmlFreeDoc(xcap_tree); return -1; } if( strncmp((char*)sub_handling, "block",5 )==0) @@ -130,9 +136,9 @@ int pres_watcher_allowed(subs_t* subs) subs->reason.s= "polite-block"; subs->reason.len = 12; } - else + else if( strncmp((char*)sub_handling , "allow",5 )==0) - { + { subs->status = ACTIVE_STATUS; subs->reason.s = NULL; } @@ -140,11 +146,12 @@ int pres_watcher_allowed(subs_t* subs) { LM_ERR("unknown subscription handling action\n"); xmlFree(sub_handling); + xmlFreeDoc(xcap_tree); return -1; } xmlFree(sub_handling); - + xmlFreeDoc(xcap_tree); return 0; }

1 0

git:master: modules_k/rls: Fixed memory leak in send_full_notify()
by Peter Dunkley 24 Jan '12

24 Jan '12

Module: sip-router Branch: master Commit: 19abd6497cc1431d97383eeea76c34c4a1c5a9da URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=19abd64… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Tue Jan 24 17:31:27 2012 +0000 modules_k/rls: Fixed memory leak in send_full_notify() - Package memory is allocated for URIs in add_resource_to_list() but never freed. - It should be freed in send_full_notify() at the same time as the memory allocated for the list itself is freed. - Found and fixed by Paul Pankhurst @ Crocodile RCS --- modules_k/rls/notify.c | 112 ++++++++++++++++++++++++----------------------- 1 files changed, 57 insertions(+), 55 deletions(-) diff --git a/modules_k/rls/notify.c b/modules_k/rls/notify.c index 779d262..d73cf0b 100644 --- a/modules_k/rls/notify.c +++ b/modules_k/rls/notify.c @@ -87,18 +87,18 @@ int send_full_notify(subs_t* subs, xmlNodePtr rl_node, str* rl_uri, unsigned int hash_code) { xmlDocPtr rlmi_body= NULL; - xmlNodePtr list_node= NULL; + xmlNodePtr list_node= NULL; db_key_t query_cols[2], update_cols[2], result_cols[7]; db_val_t query_vals[2], update_vals[2]; db1_res_t *result= NULL; int n_result_cols= 0; char* boundary_string; str rlsubs_did= {0, 0}; - str* rlmi_cont= NULL; - uri_link_t *uri_list_head = NULL; - int len_est; - res_param_t param; - int resource_added = 0; /* Flag to indicate that we have added at least one resource */ + str* rlmi_cont= NULL; + uri_link_t *uri_list_head = NULL; + int len_est; + res_param_t param; + int resource_added = 0; /* Flag to indicate that we have added at least one resource */ LM_DBG("start\n"); /* query in alfabetical order */ @@ -135,7 +135,7 @@ int send_full_notify(subs_t* subs, xmlNodePtr rl_node, str* rl_uri, if(result== NULL) goto error; - /* Allocate an initial buffer for the multipart body. + /* Allocate an initial buffer for the multipart body. * This buffer will be reallocated if neccessary */ multipart_body= (str*)pkg_malloc(sizeof(str)); if(multipart_body== NULL) @@ -143,8 +143,8 @@ int send_full_notify(subs_t* subs, xmlNodePtr rl_node, str* rl_uri, ERR_MEM(PKG_MEM_STR); } - multipart_body_size = BUF_REALLOC_SIZE; - multipart_body->s = (char *)pkg_malloc(multipart_body_size); + multipart_body_size = BUF_REALLOC_SIZE; + multipart_body->s = (char *)pkg_malloc(multipart_body_size); if(multipart_body->s== NULL) { @@ -153,13 +153,13 @@ int send_full_notify(subs_t* subs, xmlNodePtr rl_node, str* rl_uri, multipart_body->len= 0; - /* Create an empty rlmi document */ + /* Create an empty rlmi document */ len_est = create_empty_rlmi_doc(&rlmi_body, &list_node, rl_uri, subs->version, 1); xmlDocSetRootElement(rlmi_body, list_node); - /* Find all the uri's to which we are subscribed */ + /* Find all the uri's to which we are subscribed */ param.next = &uri_list_head; - if( process_list_and_exec(rl_node, subs->from_user, subs->from_domain, add_resource_to_list,(void*)(&param))< 0) + if(process_list_and_exec(rl_node, subs->from_user, subs->from_domain, add_resource_to_list,(void*)(&param))< 0) { LM_ERR("in process_list_and_exec function\n"); goto error; @@ -167,52 +167,54 @@ int send_full_notify(subs_t* subs, xmlNodePtr rl_node, str* rl_uri, boundary_string= generate_string((int)time(NULL), BOUNDARY_STRING_LEN); - while (uri_list_head) + while (uri_list_head) { - uri_link_t *last = uri_list_head; - if (add_resource(uri_list_head->uri, list_node, boundary_string, result, &len_est) >0) - { - if (resource_added == 0) - { - /* We have exceeded our length estimate without adding any resource. - We cannot send this resource, move on. */ - LM_ERR("Failed to add a single resource %d vs %d\n", len_est, rls_max_notify_body_len); - uri_list_head = uri_list_head->next; - pkg_free(last); - } - else - { - LM_DBG("send_full_notify estimate exceeded %d vs %d\n", len_est, rls_max_notify_body_len); - /* If add_resource returns > 0 the resource did not fit in our size limit */ - rlmi_cont= (str*)pkg_malloc(sizeof(str)); - if(rlmi_cont== NULL) - { - ERR_MEM(PKG_MEM_STR); - } - /* Where we are worried about length we won't use padding */ - xmlDocDumpFormatMemory(rlmi_body,(xmlChar**)(void*)&rlmi_cont->s, - &rlmi_cont->len, 0); - xmlFreeDoc(rlmi_body); - - if(agg_body_sendn_update(rl_uri, boundary_string, rlmi_cont, - multipart_body, subs, hash_code)< 0) - { - LM_ERR("in function agg_body_sendn_update\n"); - goto error; - } + uri_link_t *last = uri_list_head; + if (add_resource(uri_list_head->uri, list_node, boundary_string, result, &len_est) >0) + { + if (resource_added == 0) + { + /* We have exceeded our length estimate without adding any resource. + We cannot send this resource, move on. */ + LM_ERR("Failed to add a single resource %d vs %d\n", len_est, rls_max_notify_body_len); + uri_list_head = uri_list_head->next; + if (last->uri) pkg_free(last->uri); + pkg_free(last); + } + else + { + LM_DBG("send_full_notify estimate exceeded %d vs %d\n", len_est, rls_max_notify_body_len); + /* If add_resource returns > 0 the resource did not fit in our size limit */ + rlmi_cont= (str*)pkg_malloc(sizeof(str)); + if(rlmi_cont== NULL) + { + ERR_MEM(PKG_MEM_STR); + } + /* Where we are worried about length we won't use padding */ + xmlDocDumpFormatMemory(rlmi_body,(xmlChar**)(void*)&rlmi_cont->s, + &rlmi_cont->len, 0); + xmlFreeDoc(rlmi_body); + + if(agg_body_sendn_update(rl_uri, boundary_string, rlmi_cont, + multipart_body, subs, hash_code)< 0) + { + LM_ERR("in function agg_body_sendn_update\n"); + goto error; + } - /* Create a new rlmi body, but not a full_state one this time */ - len_est = create_empty_rlmi_doc(&rlmi_body, &list_node, rl_uri, subs->version, 0); - xmlDocSetRootElement(rlmi_body, list_node); - multipart_body->len = 0; - resource_added = 0; - } - } - else + /* Create a new rlmi body, but not a full_state one this time */ + len_est = create_empty_rlmi_doc(&rlmi_body, &list_node, rl_uri, subs->version, 0); + xmlDocSetRootElement(rlmi_body, list_node); + multipart_body->len = 0; + resource_added = 0; + } + } + else { - resource_added = 1; - uri_list_head = uri_list_head->next; - pkg_free(last); + resource_added = 1; + uri_list_head = uri_list_head->next; + if (last->uri) pkg_free(last->uri); + pkg_free(last); } }

1 0

git:master: modules_k/rls: Fixed memory leak in process_list_and_exec()
by Peter Dunkley 24 Jan '12

24 Jan '12

Module: sip-router Branch: master Commit: ca938a37c87782c709b441c682f723d07b05c64c URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=ca938a3… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Tue Jan 24 17:34:52 2012 +0000 modules_k/rls: Fixed memory leak in process_list_and_exec() - xmlFree was called on rl_doc, but xmlFreeDoc should have been called - Found and fixed by Paul Pankhurst @ Crocodile RCS --- modules_k/rls/notify.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/modules_k/rls/notify.c b/modules_k/rls/notify.c index d73cf0b..00240f9 100644 --- a/modules_k/rls/notify.c +++ b/modules_k/rls/notify.c @@ -1008,7 +1008,7 @@ int process_list_and_exec(xmlNodePtr list_node, str username, str domain, LM_DBG("calling myself for rl_node\n"); res = process_list_and_exec(rl_node, username, domain, function, param); xmlFree(uri); - xmlFree(rl_doc); + xmlFreeDoc(rl_doc); } else {

1 0

git:master: modules_k/presence_xml: Fixed memory leak in pres_watcher_allowed()
by Peter Dunkley 24 Jan '12

24 Jan '12

Module: sip-router Branch: master Commit: fcd33bdfa3e5a08f22f4c77fbbf1db53d0afb4bd URL: http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=fcd33bd… Author: pd <peter.dunkley(a)crocodile-rcs.com> Committer: pd <peter.dunkley(a)crocodile-rcs.com> Date: Tue Jan 24 17:18:34 2012 +0000 modules_k/presence_xml: Fixed memory leak in pres_watcher_allowed() - xmlFreeDoc() never called for xcap_tree - Found and fixed by Paul Pankhurst @ Crocodile RCS --- modules_k/presence_xml/xcap_auth.c | 13 ++++++++++--- 1 files changed, 10 insertions(+), 3 deletions(-) diff --git a/modules_k/presence_xml/xcap_auth.c b/modules_k/presence_xml/xcap_auth.c index e9f2ad8..9838a06 100644 --- a/modules_k/presence_xml/xcap_auth.c +++ b/modules_k/presence_xml/xcap_auth.c @@ -83,13 +83,17 @@ int pres_watcher_allowed(subs_t* subs) node= get_rule_node(subs, xcap_tree); if(node== NULL) + { + xmlFreeDoc(xcap_tree); return 0; + } /* process actions */ actions_node = xmlNodeGetChildByName(node, "actions"); if(actions_node == NULL) { LM_DBG("actions_node NULL\n"); + xmlFreeDoc(xcap_tree); return 0; } LM_DBG("actions_node->name= %s\n", @@ -99,6 +103,7 @@ int pres_watcher_allowed(subs_t* subs) if(sub_handling_node== NULL) { LM_DBG("sub_handling_node NULL\n"); + xmlFreeDoc(xcap_tree); return 0; } sub_handling = (char*)xmlNodeGetContent(sub_handling_node); @@ -110,6 +115,7 @@ int pres_watcher_allowed(subs_t* subs) if(sub_handling== NULL) { LM_ERR("Couldn't get sub-handling content\n"); + xmlFreeDoc(xcap_tree); return -1; } if( strncmp((char*)sub_handling, "block",5 )==0) @@ -130,9 +136,9 @@ int pres_watcher_allowed(subs_t* subs) subs->reason.s= "polite-block"; subs->reason.len = 12; } - else + else if( strncmp((char*)sub_handling , "allow",5 )==0) - { + { subs->status = ACTIVE_STATUS; subs->reason.s = NULL; } @@ -140,11 +146,12 @@ int pres_watcher_allowed(subs_t* subs) { LM_ERR("unknown subscription handling action\n"); xmlFree(sub_handling); + xmlFreeDoc(xcap_tree); return -1; } xmlFree(sub_handling); - + xmlFreeDoc(xcap_tree); return 0; }

1 0

← Newer
1
...
4
5
6
7
8
9
10
...
17
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

sr-dev January 2012