[sr-dev] git:4.1: tm: safety check for cases when xavps for serial forking fail to be added to root list

[Daniel-Constantin Mierla]

Module: sip-router
Branch: 4.1
Commit: 1c28c45facf8c87e805aff62e7f4da1a03c9aa8a
URL:    http://git.sip-router.org/cgi-bin/gitweb.cgi/sip-router/?a=commit;h=1c28c45facf8c87e805aff62e7f4da1a03c9aa8a

Author: Daniel-Constantin Mierla <miconda at gmail.com>
Committer: Daniel-Constantin Mierla <miconda at gmail.com>
Date:   Tue Apr 15 18:19:19 2014 +0200

tm: safety check for cases when xavps for serial forking fail to be added to root list

- in error cases remove xavp group from the root list instead of local destroy, otherwise it
  stays linked in root list and can cause invalid memory access
- discovered on investigating memory leak issue reported by Geoffrey M.

(cherry picked from commit 4f95cfa6266bd66a1516629ed3445d98da433b2b)

---

 modules/tm/t_serial.c |   24 ++++++++++++++++--------
 1 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/modules/tm/t_serial.c b/modules/tm/t_serial.c
index 62200ad..0db4535 100644
--- a/modules/tm/t_serial.c
+++ b/modules/tm/t_serial.c
@@ -155,7 +155,11 @@ void add_contacts_avp(str *uri, str *dst_uri, str *path, str *sock_str,
 
 	val.type = SR_XTYPE_XAVP;
 	val.v.xavp = record;
-	xavp_add_value(&contacts_avp, &val, NULL);
+	if(xavp_add_value(&contacts_avp, &val, NULL)) {
+		/* failed to add xavps to root list */
+		LM_ERR("failed to add xavps to root list\n");
+		xavp_destroy_list(&record);
+	}
 }
 
 /* 
@@ -383,7 +387,11 @@ void add_contact_flows_avp(str *uri, str *dst_uri, str *path, str *sock_str,
 
 	val.type = SR_XTYPE_XAVP;
 	val.v.xavp = record;
-	xavp_add_value(&contact_flows_avp, &val, NULL);
+	if(xavp_add_value(&contact_flows_avp, &val, NULL)==NULL) {
+		/* failed to add xavps to root list */
+		LM_ERR("failed to add xavps to root list\n");
+		xavp_destroy_list(&record);
+	}
 }
 
 /*
@@ -449,13 +457,13 @@ int t_next_contacts(struct sip_msg* msg, char* key, char* value)
 		if (parse_phostport(sock_str.s, &host.s, &host.len, &port, &proto)
 				!= 0) {
 			LM_ERR("parsing of socket info <%s> failed\n", sock_str.s);
-			xavp_destroy_list(&xavp_list);
+			xavp_rm(xavp_list, NULL);
 			return -1;
 		}
 		sock = grep_sock_info(&host, (unsigned short)port,
 				(unsigned short)proto);
 		if (sock == 0) {
-			xavp_destroy_list(&xavp_list);
+			xavp_rm(xavp_list, NULL);
 			return -1;
 		}
 	} else {
@@ -574,14 +582,14 @@ int t_next_contacts(struct sip_msg* msg, char* key, char* value)
 					!= 0) {
 				LM_ERR("parsing of socket info <%s> failed\n", sock_str.s);
 				free_instance_list(il);
-				xavp_destroy_list(&xavp_list);
+				xavp_rm(xavp_list, NULL);
 				return -1;
 			}
 			sock = grep_sock_info(&host, (unsigned short)port,
 					(unsigned short)proto);
 			if (sock == 0) {
 				free_instance_list(il);
-				xavp_destroy_list(&xavp_list);
+				xavp_rm(xavp_list, NULL);
 				return -1;
 			}
 		} else {
@@ -659,7 +667,7 @@ int t_next_contacts(struct sip_msg* msg, char* key, char* value)
 					&ruid, &location_ua) != 1) {
 			LM_ERR("appending branch failed\n");
 			free_instance_list(il);
-			xavp_destroy_list(&xavp_list);
+			xavp_rm(xavp_list, NULL);
 			return -1;
 		}
 
@@ -795,7 +803,7 @@ int t_next_contact_flow(struct sip_msg* msg, char* key, char* value)
 		if (append_branch(msg, &uri, &dst_uri, &path, 0, flags, sock, &instance, 0,
 					&ruid, &location_ua) != 1) {
 			LM_ERR("appending branch failed\n");
-			xavp_destroy_list(&xavp_list);
+			xavp_rm(xavp_list, NULL);
 			return -1;
 		}