Fix more memory leaks

This patch adds to what was fixed in r366880.  Specifically, it addresses the
following:

* chan_sip:   dispose of an allocated frame in off nominal code paths in
              sip_rtp_read
* func_odbc:  when disposing of an allocated resultset, ensure that any rows
              that were appended to that resultset are also disposed of
* cli:        free the created return string buffer in another off nominal code
              path
* chan_dahdi: free a frame that was allocated by the dsp layer if we choose
              not to process that frame

(issue ASTERISK-19665)
Reported by: Matt Jordan

Review: https://reviewboard.asterisk.org/r/1922/
........

Merged revisions 366944 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 366948 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@366955 65c4cc65-6c06-0410-ace0-fbb531ad65f3

4 files changed, 16 insertions, 6 deletions

diff --git a/channels/chan_dahdi.c b/channels/chan_dahdi.c
index 77b2eb8f0..38a894395 100644
--- a/channels/chan_dahdi.c
+++ b/channels/chan_dahdi.c
@@ -9321,6 +9321,7 @@ static struct ast_frame *dahdi_read(struct ast_channel *ast)
 			} else if (p->dialtone_detect && !p->outgoing && f->frametype == AST_FRAME_VOICE) {
 				if ((ast_dsp_get_tstate(p->dsp) == DSP_TONE_STATE_DIALTONE) && (ast_dsp_get_tcount(p->dsp) > 9)) {
 					/* Dialtone detected on inbound call; hangup the channel */
+					ast_frfree(f);
 					f = NULL;
 				}
 			} else if (f->frametype == AST_FRAME_DTMF_BEGIN
diff --git a/channels/chan_sip.c b/channels/chan_sip.c
index a21ebf394..e2d2daf5e 100644
--- a/channels/chan_sip.c
+++ b/channels/chan_sip.c
@@ -7582,6 +7582,7 @@ static struct ast_frame *sip_rtp_read(struct ast_channel *ast, struct sip_pvt *p
 	if (f && (f->frametype == AST_FRAME_DTMF_BEGIN || f->frametype == AST_FRAME_DTMF_END) &&
 	    (ast_test_flag(&p->flags[0], SIP_DTMF) != SIP_DTMF_RFC2833)) {
 		ast_debug(1, "Ignoring DTMF (%c) RTP frame because dtmfmode is not RFC2833\n", f->subclass.integer);
+		ast_frfree(f);
 		return &ast_null_frame;
 	}
 
@@ -7594,6 +7595,7 @@ static struct ast_frame *sip_rtp_read(struct ast_channel *ast, struct sip_pvt *p
 		if (!ast_format_cap_iscompatible(p->jointcaps, &f->subclass.format)) {
 			ast_debug(1, "Bogus frame of format '%s' received from '%s'!\n",
 				ast_getformatname(&f->subclass.format), ast_channel_name(p->owner));
+			ast_frfree(f);
 			return &ast_null_frame;
 		}
 		ast_debug(1, "Oooh, format changed to %s\n",
diff --git a/funcs/func_odbc.c b/funcs/func_odbc.c
index 72a87cc0b..5b24878a6 100644
--- a/funcs/func_odbc.c
+++ b/funcs/func_odbc.c
@@ -151,6 +151,11 @@ static void odbc_datastore_free(void *data)
 {
 	struct odbc_datastore *result = data;
 	struct odbc_datastore_row *row;
+
+	if (!result) {
+		return;
+	}
+
 	AST_LIST_LOCK(result);
 	while ((row = AST_LIST_REMOVE_HEAD(result, list))) {
 		ast_free(row);
@@ -539,7 +544,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
 			pbx_builtin_setvar_helper(chan, "ODBCROWS", rowcount);
 			ast_autoservice_stop(chan);
 		}
-		ast_free(resultset);
+		odbc_datastore_free(resultset);
 		return -1;
 	}
 
@@ -554,7 +559,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
 			pbx_builtin_setvar_helper(chan, "ODBCROWS", rowcount);
 			ast_autoservice_stop(chan);
 		}
-		ast_free(resultset);
+		odbc_datastore_free(resultset);
 		return -1;
 	}
 
@@ -580,7 +585,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
 			pbx_builtin_setvar_helper(chan, "ODBCSTATUS", status);
 			ast_autoservice_stop(chan);
 		}
-		ast_free(resultset);
+		odbc_datastore_free(resultset);
 		return res1;
 	}
 
@@ -594,7 +599,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
 			char *ptrcoldata;
 
 			if (!coldata) {
-				ast_free(resultset);
+				odbc_datastore_free(resultset);
 				SQLCloseCursor(stmt);
 				SQLFreeHandle(SQL_HANDLE_STMT, stmt);
 				ast_odbc_release_obj(obj);
@@ -627,7 +632,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
 					void *tmp = ast_realloc(resultset, sizeof(*resultset) + ast_str_strlen(colnames) + 1);
 					if (!tmp) {
 						ast_log(LOG_ERROR, "No space for a new resultset?\n");
-						ast_free(resultset);
+						odbc_datastore_free(resultset);
 						SQLCloseCursor(stmt);
 						SQLFreeHandle(SQL_HANDLE_STMT, stmt);
 						ast_odbc_release_obj(obj);
diff --git a/main/cli.c b/main/cli.c
index c54d89e87..d901e5c83 100644
--- a/main/cli.c
+++ b/main/cli.c
@@ -2360,8 +2360,10 @@ char **ast_cli_completion_matches(const char *text, const char *word)
 
 	/* ensure that the array is NULL terminated */
 	if (matches + 1 >= match_list_len) {
-		if (!(match_list = ast_realloc(match_list, (match_list_len + 1) * sizeof(*match_list))))
+		if (!(match_list = ast_realloc(match_list, (match_list_len + 1) * sizeof(*match_list)))) {
+			ast_free(retstr);
 			return NULL;
+		}
 	}
 	match_list[matches + 1] = NULL;