Merge "res_pjsip: Fix tdata leaks in off nominal paths." into 13

3 files changed, 12 insertions, 11 deletions

diff --git a/res/res_pjsip.c b/res/res_pjsip.c
index 153352f9f..8ac63204b 100644
--- a/res/res_pjsip.c
+++ b/res/res_pjsip.c
@@ -3555,6 +3555,7 @@ static pj_status_t endpt_send_request(struct ast_sip_endpoint *endpoint,
 				pj_strbuf(&tdata->msg->line.req.method.name),
 				endpoint ? ast_sorcery_object_get_id(endpoint) : "<unknown>");
 			ao2_t_ref(req_wrapper, -2, "Drop timer and routine ref");
+			pjsip_tx_data_dec_ref(tdata);
 			return ret_val;
 		}
 
diff --git a/res/res_pjsip_outbound_registration.c b/res/res_pjsip_outbound_registration.c
index 6f17b2072..ff6619477 100644
--- a/res/res_pjsip_outbound_registration.c
+++ b/res/res_pjsip_outbound_registration.c
@@ -514,6 +514,7 @@ static pj_status_t registration_client_send(struct sip_outbound_registration_cli
 
 	callback_invoked = ast_threadstorage_get(&register_callback_invoked, sizeof(int));
 	if (!callback_invoked) {
+		pjsip_tx_data_dec_ref(tdata);
 		return PJ_ENOMEM;
 	}
 	*callback_invoked = 0;
@@ -567,6 +568,7 @@ static int handle_client_registration(void *data)
 			/* insert a new Supported header */
 			hdr = pjsip_supported_hdr_create(tdata->pool);
 			if (!hdr) {
+				pjsip_tx_data_dec_ref(tdata);
 				return -1;
 			}
 
diff --git a/res/res_pjsip_pubsub.c b/res/res_pjsip_pubsub.c
index 2fa7f34e3..f6b6efcf5 100644
--- a/res/res_pjsip_pubsub.c
+++ b/res/res_pjsip_pubsub.c
@@ -1824,6 +1824,7 @@ static int sip_subscription_send_request(struct sip_subscription_tree *sub_tree,
 
 	if (allocate_tdata_buffer(tdata)) {
 		ast_log(LOG_ERROR, "SIP request %s is too large to send.\n", tdata->info);
+		pjsip_tx_data_dec_ref(tdata);
 		return -1;
 	}
 
@@ -2977,7 +2978,6 @@ static struct ast_sip_publication *sip_create_publication(struct ast_sip_endpoin
 static int sip_publication_respond(struct ast_sip_publication *pub, int status_code,
 		pjsip_rx_data *rdata)
 {
-	pj_status_t status;
 	pjsip_tx_data *tdata;
 	pjsip_transaction *tsx;
 
@@ -2986,26 +2986,24 @@ static int sip_publication_respond(struct ast_sip_publication *pub, int status_c
 	}
 
 	if (PJSIP_IS_STATUS_IN_CLASS(status_code, 200)) {
-		RAII_VAR(char *, entity_tag, NULL, ast_free_ptr);
-		RAII_VAR(char *, expires, NULL, ast_free_ptr);
+		char buf[30];
 
-		if ((ast_asprintf(&entity_tag, "%d", pub->entity_tag) < 0) ||
-			(ast_asprintf(&expires, "%d", pub->expires) < 0)) {
-			pjsip_tx_data_dec_ref(tdata);
-			return -1;
-		}
+		snprintf(buf, sizeof(buf), "%d", pub->entity_tag);
+		ast_sip_add_header(tdata, "SIP-ETag", buf);
 
-		ast_sip_add_header(tdata, "SIP-ETag", entity_tag);
-		ast_sip_add_header(tdata, "Expires", expires);
+		snprintf(buf, sizeof(buf), "%d", pub->expires);
+		ast_sip_add_header(tdata, "Expires", buf);
 	}
 
-	if ((status = pjsip_tsx_create_uas(&pubsub_module, rdata, &tsx)) != PJ_SUCCESS) {
+	if (pjsip_tsx_create_uas(&pubsub_module, rdata, &tsx) != PJ_SUCCESS) {
+		pjsip_tx_data_dec_ref(tdata);
 		return -1;
 	}
 
 	pjsip_tsx_recv_msg(tsx, rdata);
 
 	if (pjsip_tsx_send_msg(tsx, tdata) != PJ_SUCCESS) {
+		pjsip_tx_data_dec_ref(tdata);
 		return -1;
 	}