[sr-dev] mem leak in sdpops

[Vicente Hernando]

Sorry, previous attachment did not work.

On 08/31/2012 02:06 PM, Vicente Hernando wrote:
> Hello,
>
> within w_get_sdp function in modules/sdpops/sdpops_mod.c
>
>     } else {
>         avp_val.s.s = pkg_malloc(sdp->raw_sdp.len);
>         avp_val.s.len = sdp->raw_sdp.len;
>         if (avp_val.s.s == NULL)
>
> I do not find anywhere where avp_val.s.s variable is freed.
>
>
> So I attach two possible patches to solve that in two different ways.
>
> Kind regards,
> Vicente.
>
> _______________________________________________
> sr-dev mailing list
> sr-dev at lists.sip-router.org
> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev
>

-------------- next part --------------
diff --git modules/sdpops/sdpops_mod.c modules/sdpops/sdpops_mod.c
index df7d6e6..9f662dc 100644
--- modules/sdpops/sdpops_mod.c
+++ modules/sdpops/sdpops_mod.c
@@ -987,8 +987,10 @@ static int w_get_sdp(sip_msg_t* msg, char *avp)
 	if (add_avp(AVP_VAL_STR | avp_type, avp_name, avp_val) != 0)
 	{
 	  LM_ERR("Failed to add SDP avp");
+	  pkg_free(avp_val.s.s);
 	  return -1;
 	}
+	pkg_free(avp_val.s.s);
 	
 	return 1;
 }
-------------- next part --------------
diff --git modules/sdpops/sdpops_mod.c modules/sdpops/sdpops_mod.c
index df7d6e6..b70b553 100644
--- modules/sdpops/sdpops_mod.c
+++ modules/sdpops/sdpops_mod.c
@@ -974,14 +974,8 @@ static int w_get_sdp(sip_msg_t* msg, char *avp)
 		LM_DBG("No SDP\n");
 		return -2;
 	} else {
-		avp_val.s.s = pkg_malloc(sdp->raw_sdp.len);
+		avp_val.s.s = sdp->raw_sdp.s;
 		avp_val.s.len = sdp->raw_sdp.len;
-		if (avp_val.s.s == NULL)
-		{
-		  LM_ERR("Failed to alloc memory for SDP");
-		  return -1;
-		}
-		memcpy(avp_val.s.s, sdp->raw_sdp.s, avp_val.s.len);
 		LM_DBG("Found SDP %.*s\n", sdp->raw_sdp.len, sdp->raw_sdp.s);
 	}
 	if (add_avp(AVP_VAL_STR | avp_type, avp_name, avp_val) != 0)