diff options
| author | Corey Farrell <git@cfware.com> | 2014-11-06 09:17:50 +0000 |
|---|---|---|
| committer | Corey Farrell <git@cfware.com> | 2014-11-06 09:17:50 +0000 |
| commit | 433366ab90ba5a53e7b215076dd747e55beec80f (patch) | |
| tree | 23f81cc48bd767e91d2a23f7caf195771e4e228f /main | |
| parent | c056506d848e0b4e1a23a6f88400183ba46c8dd3 (diff) | |
Fix unintential memory retention in stringfields.
* Fix missing / unreachable calls to __ast_string_field_release_active.
* Reset pool->used to zero when the current pool->active reaches zero.
ASTERISK-24307 #close
Reported by: Etienne Lessard
Tested by: ibercom, Etienne Lessard
Review: https://reviewboard.asterisk.org/r/4114/
........
Merged revisions 427380 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........
Merged revisions 427381 from http://svn.asterisk.org/svn/asterisk/branches/11
........
Merged revisions 427382 from http://svn.asterisk.org/svn/asterisk/branches/12
git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/13@427384 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'main')
| -rw-r--r-- | main/utils.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/main/utils.c b/main/utils.c index 3a095ca7b..e3bb36e03 100644 --- a/main/utils.c +++ b/main/utils.c @@ -2099,9 +2099,13 @@ void __ast_string_field_release_active(struct ast_string_field_pool *pool_head, for (pool = pool_head, prev = NULL; pool; prev = pool, pool = pool->prev) { if ((ptr >= pool->base) && (ptr <= (pool->base + pool->size))) { pool->active -= AST_STRING_FIELD_ALLOCATION(ptr); - if ((pool->active == 0) && prev) { - prev->prev = pool->prev; - ast_free(pool); + if (pool->active == 0) { + if (prev) { + prev->prev = pool->prev; + ast_free(pool); + } else { + pool->used = 0; + } } break; } @@ -2150,6 +2154,11 @@ void __ast_string_field_ptr_build_va(struct ast_string_field_mgr *mgr, /* Are we out of memory? */ return; } + if (res == 0) { + __ast_string_field_release_active(*pool_head, *ptr); + *ptr = __ast_string_field_empty; + return; + } needed = (size_t)res + 1; /* NUL byte */ if (needed > available) { |