[sr-dev] git:5.2:cb58a13f: htable: fix infinite loop during dmq sync of large tables

[Charles Chance]

Module: kamailio
Branch: 5.2
Commit: cb58a13f3a7594e721c08ef9aff458108e05db57
URL: https://github.com/kamailio/kamailio/commit/cb58a13f3a7594e721c08ef9aff458108e05db57

Author: Charles Chance <charles.chance at sipcentric.com>
Committer: Charles Chance <charles.chance at sipcentric.com>
Date: 2019-02-28T19:17:36Z

htable: fix infinite loop during dmq sync of large tables

- reported by Enrico Bandiera (GH #1863)

(cherry picked from commit a176ad4fb4167e21b01974e6a5caba330b1d7e14)

---

Modified: src/modules/htable/ht_dmq.c

---

Diff:  https://github.com/kamailio/kamailio/commit/cb58a13f3a7594e721c08ef9aff458108e05db57.diff
Patch: https://github.com/kamailio/kamailio/commit/cb58a13f3a7594e721c08ef9aff458108e05db57.patch

---

diff --git a/src/modules/htable/ht_dmq.c b/src/modules/htable/ht_dmq.c
index 986c2c769a..1f27e97684 100644
--- a/src/modules/htable/ht_dmq.c
+++ b/src/modules/htable/ht_dmq.c
@@ -139,36 +139,43 @@ static int ht_dmq_cell_group_flush(dmq_node_t* node) {
 
 	srjson_doc_t *jdoc = &ht_dmq_jdoc_cell_group.jdoc;
 	srjson_t *jdoc_cells = ht_dmq_jdoc_cell_group.jdoc_cells;
+	int ret = 0;
 
 	srjson_AddItemToObject(jdoc, jdoc->root, "cells", jdoc_cells);
 
-	LM_DBG("json[%s]\n", srjson_PrintUnformatted(jdoc, jdoc->root));
+	LM_DBG("jdoc size[%d]\n", ht_dmq_jdoc_cell_group.size);
 	jdoc->buf.s = srjson_PrintUnformatted(jdoc, jdoc->root);
 	if(jdoc->buf.s==NULL) {
 		LM_ERR("unable to serialize data\n");
-		return -1;
+		ret = -1;
+		goto cleanup;
 	}
 	jdoc->buf.len = strlen(jdoc->buf.s);
 
 	LM_DBG("sending serialized data %.*s\n", jdoc->buf.len, jdoc->buf.s);
 	if (ht_dmq_send(&jdoc->buf, node)!=0) {
 		LM_ERR("unable to send data\n");
-		return -1;
+		ret = -1;
 	}
 
-	LM_DBG("jdoc size[%d]\n", ht_dmq_jdoc_cell_group.size);
+cleanup:
+
+	srjson_DeleteItemFromObject(jdoc, jdoc->root, "cells");
+	ht_dmq_jdoc_cell_group.count = 0;
+	ht_dmq_jdoc_cell_group.size = dmq_cell_group_empty_size;
+
+	if(jdoc->buf.s!=NULL) {
+		jdoc->free_fn(jdoc->buf.s);
+		jdoc->buf.s = NULL;
+	}
 
-	srjson_Delete(jdoc, jdoc_cells);
 	ht_dmq_jdoc_cell_group.jdoc_cells = srjson_CreateArray(&ht_dmq_jdoc_cell_group.jdoc);
 	if (ht_dmq_jdoc_cell_group.jdoc_cells==NULL) {
 		LM_ERR("cannot re-create json cells array! \n");
-		return -1;
+		ret = -1;
 	}
 
-	ht_dmq_jdoc_cell_group.count = 0;
-	ht_dmq_jdoc_cell_group.size = dmq_cell_group_empty_size;
-
-	return 0;
+	return ret;
 }
 
 static void ht_dmq_cell_group_destroy() {