Fix memory leaks in app_voicemail when using IMAP storage or realtime config

This patch fixes two memory leaks:

1. When find_user is called with NULL as its first parameter, the voicemail
   user returned is allocated on the heap.  The inboxcount2 function uses
   find_user in such a fashion when counting new messages, and fails to free
   the resulting voicemail user object.

2. When populate_defaults is called on a voicemail user, it wipes whatever
   flags have been set on the object by copying over the global flags object.
   If the VM_ALLOCED flag was ste on the voicemail user prior to doing so,
   that flag is removed.  This leaks the voicemail user when free_user is later
   called.

(closes issue ASTERISK-19155)
Reported by: Filip Jenicek
patches:
  asterisk.patch2 uploaded by Filip Jenicek (license 6277)

Patch slightly modified for this commit.

Review: https://reviewboard.asterisk.org/r/2096
........

Merged revisions 372268 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 372288 from http://svn.asterisk.org/svn/asterisk/branches/10
........

Merged revisions 372289 from http://svn.asterisk.org/svn/asterisk/branches/11


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@372302 65c4cc65-6c06-0410-ace0-fbb531ad65f3

1 files changed, 17 insertions, 10 deletions

diff --git a/apps/app_voicemail.c b/apps/app_voicemail.c
index a4deb9b9b..e80a60398 100644
--- a/apps/app_voicemail.c
+++ b/apps/app_voicemail.c
@@ -1577,17 +1577,21 @@ static struct ast_vm_user *find_user_realtime(struct ast_vm_user *ivm, const cha
 	struct ast_vm_user *retval;
 
 	if ((retval = (ivm ? ivm : ast_calloc(1, sizeof(*retval))))) {
-		if (!ivm)
-			ast_set_flag(retval, VM_ALLOCED);	
-		else
+		if (ivm) {
 			memset(retval, 0, sizeof(*retval));
-		if (mailbox) 
-			ast_copy_string(retval->mailbox, mailbox, sizeof(retval->mailbox));
+		}
 		populate_defaults(retval);
-		if (!context && ast_test_flag((&globalflags), VM_SEARCH))
+		if (!ivm) {
+			ast_set_flag(retval, VM_ALLOCED);
+		}
+		if (mailbox) {
+			ast_copy_string(retval->mailbox, mailbox, sizeof(retval->mailbox));
+		}
+		if (!context && ast_test_flag((&globalflags), VM_SEARCH)) {
 			var = ast_load_realtime("voicemail", "mailbox", mailbox, SENTINEL);
-		else
+		} else {
 			var = ast_load_realtime("voicemail", "mailbox", mailbox, "context", context, SENTINEL);
+		}
 		if (var) {
 			apply_options_full(retval, var);
 			ast_variables_destroy(var);
@@ -2660,8 +2664,10 @@ static int inboxcount2(const char *mailbox_context, int *urgentmsgs, int *newmsg
 			return -1;
 		}
 		if ((*newmsgs = __messagecount(context, mailboxnc, vmu->imapfolder)) < 0) {
+			free_user(vmu);
 			return -1;
 		}
+		free_user(vmu);
 	}
 	if (oldmsgs) {
 		if ((*oldmsgs = __messagecount(context, mailboxnc, "Old")) < 0) {
@@ -2979,8 +2985,9 @@ static struct ast_vm_user *find_user_realtime_imapuser(const char *imapuser)
 	vmu = ast_calloc(1, sizeof *vmu);
 	if (!vmu)
 		return NULL;
-	ast_set_flag(vmu, VM_ALLOCED);
+
 	populate_defaults(vmu);
+	ast_set_flag(vmu, VM_ALLOCED);
 
 	var = ast_load_realtime("voicemail", "imapuser", imapuser, NULL);
 	if (var) {
@@ -11742,8 +11749,8 @@ AST_TEST_DEFINE(test_voicemail_vmuser)
 	if (!(vmu = ast_calloc(1, sizeof(*vmu)))) {
 		return AST_TEST_NOT_RUN;
 	}
-	ast_set_flag(vmu, VM_ALLOCED);
 	populate_defaults(vmu);
+	ast_set_flag(vmu, VM_ALLOCED);
 
 	apply_options(vmu, options_string);
 
@@ -11871,7 +11878,7 @@ AST_TEST_DEFINE(test_voicemail_vmuser)
 		res = 1;
 	}
 	if (strcasecmp(vmu->imapfolder, "INBOX")) {
-		ast_test_status_update(test, "Parse failure for imappasswd option\n");
+		ast_test_status_update(test, "Parse failure for imapfolder option\n");
 		res = 1;
 	}
 	if (strcasecmp(vmu->imapvmshareid, "6000")) {