Fix a variety of memory leaks

This patch addresses a number of memory leaks in a variety of modules that were
found by a static analysis tool.  A brief summary of the changes:

* app_minivm:       free ast_str objects on off nominal paths
* app_page:         free the ast_dial object if the requested channel technology
                    cannot be appended to the dialing structure
* app_queue:        if a penalty rule failed to match any existing rule list
                    names, the created rule would not be inserted and its memory
                    would be leaked
* app_read:         dispose of the created silence detector in the presence of
                    off nominal circumstances
* app_voicemail:    dispose of an allocated unique ID field for MWI event
                    un-subscribe requests in off nominal paths; dispose of
                    configuration objects when using the secret.conf option
* chan_dahdi:       dispose of the allocated frame produced by ast_dsp_process
* chan_iax2:        properly unref peer in CLI command "iax2 unregister"
* chan_sip:         dispose of the allocated frame produced by sip_rtp_read's
                    call of ast_dsp_process; free memory in parse unit tests
* func_dialgroup:   properly deref ao2 object grhead in nominal path of
                    dialgroup_read
* func_odbc:        free resultset in off nominal paths of odbc_read
* cli:              free match_list in off nominal paths of CLI match completion
* config:           free comment_buffer/list_buffer when configuration file load
                    is unchanged; free the same buffers any time they were
                    created and config files were processed
* data:             free XML nodes in various places
* enum:             free context buffer in off nominal paths
* features:         free ast_call_feature in off nominal paths of applicationmap
                    config processing
* netsock2:         users of ast_sockaddr_resolve pass in an ast_sockaddr struct
                    that is allocated by the method.  Failures in
                    ast_sockaddr_resolve could result in the users of the method
                    not knowing whether or not the buffer was allocated.  The
                    method will now not allocate the ast_sockaddr struct if it
                    will return failure.
* pbx:              cleanup hash table traversals in off nominal paths; free
                    ignore pattern buffer if it already exists for the specified
                    context
* xmldoc:           cleanup various nodes when we no longer need them
* main/editline:    various cleanup of pointers not being freed before being
                    assigned to other memory, cleanup along off nominal paths
* menuselect/mxml:  cleanup of value buffer for an attribute when that attribute
                    did not specify a value
* res_calendar*:    responses are allocated via the various *_request method
                    returns and should not be allocated in the various
                    write_event methods; ensure attendee buffer is freed if no
                    data exists in the parsed node; ensure that calendar objects
                    are de-ref'd appropriately
* res_jabber:       free buffer in off nominal path
* res_musiconhold:  close the DIR* object in off nominal paths
* res_rtp_asterisk: if we run out of ports, close the rtp socket object and free
                    the rtp object
* res_srtp:         if we fail to create the session in libsrtp, destroy the
                    temporary ast_srtp object

(issue ASTERISK-19665)
Reported by: Matt Jordan

Review: https://reviewboard.asterisk.org/r/1922
........

Merged revisions 366880 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 366881 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@366917 65c4cc65-6c06-0410-ace0-fbb531ad65f3

11 files changed, 51 insertions, 8 deletions

diff --git a/main/cli.c b/main/cli.c
index 6c79c7bb2..c54d89e87 100644
--- a/main/cli.c
+++ b/main/cli.c
@@ -2350,8 +2350,10 @@ char **ast_cli_completion_matches(const char *text, const char *word)
 		max_equal = i;
 	}
 
-	if (!(retstr = ast_malloc(max_equal + 1)))
+	if (!(retstr = ast_malloc(max_equal + 1))) {
+		ast_free(match_list);
 		return NULL;
+	}
 
 	ast_copy_string(retstr, match_list[1], max_equal + 1);
 	match_list[0] = retstr;
diff --git a/main/config.c b/main/config.c
index 249cf0403..7f7f35558 100644
--- a/main/config.c
+++ b/main/config.c
@@ -1491,6 +1491,8 @@ static struct ast_config *config_text_file_load(const char *database, const char
 
 			if (unchanged) {
 				AST_LIST_UNLOCK(&cfmtime_head);
+				ast_free(comment_buffer);
+				ast_free(lline_buffer);
 				return CONFIG_STATUS_FILEUNCHANGED;
 			}
 		}
@@ -1643,7 +1645,7 @@ static struct ast_config *config_text_file_load(const char *database, const char
 		}
 #endif
 
-	if (cfg && cfg != CONFIG_STATUS_FILEUNCHANGED && cfg != CONFIG_STATUS_FILEINVALID && cfg->include_level == 1 && ast_test_flag(&flags, CONFIG_FLAG_WITHCOMMENTS)) {
+	if (ast_test_flag(&flags, CONFIG_FLAG_WITHCOMMENTS)) {
 		ast_free(comment_buffer);
 		ast_free(lline_buffer);
 		comment_buffer = NULL;
diff --git a/main/data.c b/main/data.c
index 146b15453..3a7d5e92c 100644
--- a/main/data.c
+++ b/main/data.c
@@ -1042,6 +1042,7 @@ static int data_search_cmp_ptr(const struct ast_data_search *root, const char *n
 	cmp_type = child->cmp_type;
 
 	if (sscanf(child->value, "%p", &node_ptr) <= 0) {
+		ao2_ref(child, -1);
 		return 1;
 	}
 
@@ -2186,6 +2187,7 @@ struct ast_xml_doc *ast_data_get_xml(const struct ast_data_query *query)
 
 	doc = ast_xml_new();
 	if (!doc) {
+		ast_data_free(res);
 		return NULL;
 	}
 
diff --git a/main/editline/readline.c b/main/editline/readline.c
index 4729fa952..77827c3f9 100644
--- a/main/editline/readline.c
+++ b/main/editline/readline.c
@@ -549,6 +549,7 @@ _history_expand_command(const char *command, size_t cmdlen, char **result)
 						from = strdup(search);
 					else {
 						from = NULL;
+						free(line);
 						return (-1);
 					}
 				}
@@ -609,8 +610,13 @@ _history_expand_command(const char *command, size_t cmdlen, char **result)
 		end = max - ((end < -1) ? 1 : 0);
 
 	/* check boundaries ... */
-	if (start > max || end > max || start > end)
+	if (start > max || end > max || start > end) {
+		for (i = 0; i <= max; i++) {
+			free(arr[i]);
+		}
+		free(arr), arr = (char **) NULL;
 		return (-1);
+	}
 
 	for (i = 0; i <= max; i++) {
 		char *temp;
diff --git a/main/editline/term.c b/main/editline/term.c
index fb627cabb..63cec6e43 100644
--- a/main/editline/term.c
+++ b/main/editline/term.c
@@ -472,7 +472,7 @@ term_rebuffer_display(EditLine *el)
 private int
 term_alloc_display(EditLine *el)
 {
-	int i;
+	int i, j;
 	char **b;
 	coord_t *c = &el->el_term.t_size;
 
@@ -481,8 +481,13 @@ term_alloc_display(EditLine *el)
 		return (-1);
 	for (i = 0; i < c->v; i++) {
 		b[i] = (char *) el_malloc((size_t) (sizeof(char) * (c->h + 1)));
-		if (b[i] == NULL)
+		if (b[i] == NULL) {
+			for (j = 0; j < i; j++) {
+				el_free(b[j]);
+			}
+			el_free(b);
 			return (-1);
+		}
 	}
 	b[c->v] = NULL;
 	el->el_display = b;
@@ -492,8 +497,13 @@ term_alloc_display(EditLine *el)
 		return (-1);
 	for (i = 0; i < c->v; i++) {
 		b[i] = (char *) el_malloc((size_t) (sizeof(char) * (c->h + 1)));
-		if (b[i] == NULL)
+		if (b[i] == NULL) {
+			for (j = 0; j < i; j++) {
+				el_free(b[j]);
+			}
+			el_free(b);
 			return (-1);
+		}
 	}
 	b[c->v] = NULL;
 	el->el_vdisplay = b;
diff --git a/main/editline/tokenizer.c b/main/editline/tokenizer.c
index f0de39bc9..67398c686 100644
--- a/main/editline/tokenizer.c
+++ b/main/editline/tokenizer.c
@@ -113,12 +113,17 @@ tok_init(const char *ifs)
 	tok->argc = 0;
 	tok->amax = AINCR;
 	tok->argv = (char **) tok_malloc(sizeof(char *) * tok->amax);
-	if (tok->argv == NULL)
+	if (tok->argv == NULL) {
+		tok_free(tok);
 		return (NULL);
+	}
 	tok->argv[0] = NULL;
 	tok->wspace = (char *) tok_malloc(WINCR);
-	if (tok->wspace == NULL)
+	if (tok->wspace == NULL) {
+		tok_free(tok->argv);
+		tok_free(tok);
 		return (NULL);
+	}
 	tok->wmax = tok->wspace + WINCR;
 	tok->wstart = tok->wspace;
 	tok->wptr = tok->wspace;
diff --git a/main/enum.c b/main/enum.c
index 413085e7f..9c31c93b2 100644
--- a/main/enum.c
+++ b/main/enum.c
@@ -790,6 +790,7 @@ int ast_get_enum(struct ast_channel *chan, const char *number, char *dst, int ds
 
 		if (sdl > strlen(number)) {	/* Number too short for this sdl? */
 			ast_log(LOG_WARNING, "I-ENUM: subdomain location %d behind number %s\n", sdl, number);
+			ast_free(context);
 			return 0;
 		}
 		ast_copy_string(left, number + sdl, sizeof(left));
@@ -802,6 +803,7 @@ int ast_get_enum(struct ast_channel *chan, const char *number, char *dst, int ds
 		/* check the space we need for middle */
 		if ((sdl * 2 + strlen(middle) + 2) > sizeof(middle)) {
 			ast_log(LOG_WARNING, "ast_get_enum: not enough space for I-ENUM rewrite.\n");
+			ast_free(context);
 			return -1;
 		}
 
@@ -819,6 +821,7 @@ int ast_get_enum(struct ast_channel *chan, const char *number, char *dst, int ds
 
 	if (strlen(left) * 2 + 2 > sizeof(domain)) {
 		ast_log(LOG_WARNING, "string to long in ast_get_enum\n");
+		ast_free(context);
 		return -1;
 	}
 
diff --git a/main/features.c b/main/features.c
index 433c1a647..964e53614 100644
--- a/main/features.c
+++ b/main/features.c
@@ -6044,6 +6044,7 @@ static void process_applicationmap_line(struct ast_variable *var)
 	} else {
 		ast_log(LOG_NOTICE, "Invalid 'ActivateOn' specification for feature '%s',"
 			" must be 'self', or 'peer'\n", var->name);
+		ast_free(feature);
 		return;
 	}
 
@@ -6058,6 +6059,7 @@ static void process_applicationmap_line(struct ast_variable *var)
 	} else {
 		ast_log(LOG_NOTICE, "Invalid 'ActivatedBy' specification for feature '%s',"
 			" must be 'caller', or 'callee', or 'both'\n", var->name);
+		ast_free(feature);
 		return;
 	}
 
diff --git a/main/netsock2.c b/main/netsock2.c
index 1922ac388..5ae4ceb70 100644
--- a/main/netsock2.c
+++ b/main/netsock2.c
@@ -270,6 +270,10 @@ int ast_sockaddr_resolve(struct ast_sockaddr **addrs, const char *str,
 		res_cnt++;
 	}
 
+	if (res_cnt == 0) {
+		goto cleanup;
+	}
+
 	if ((*addrs = ast_malloc(res_cnt * sizeof(struct ast_sockaddr))) == NULL) {
 		res_cnt = 0;
 		goto cleanup;
diff --git a/main/pbx.c b/main/pbx.c
index 2860218af..250737b22 100644
--- a/main/pbx.c
+++ b/main/pbx.c
@@ -7511,6 +7511,8 @@ static void context_merge(struct ast_context **extcontexts, struct ast_hashtab *
 
 				if (!new) {
 					ast_log(LOG_ERROR,"Could not allocate a new context for %s in merge_and_delete! Danger!\n", context->name);
+					ast_hashtab_end_traversal(prio_iter);
+					ast_hashtab_end_traversal(exten_iter);
 					return; /* no sense continuing. */
 				}
 				/* we will not replace existing entries in the new context with stuff from the old context.
@@ -8236,6 +8238,7 @@ int ast_context_add_ignorepat2(struct ast_context *con, const char *value, const
 		if (!strcasecmp(ignorepatc->pattern, value)) {
 			/* Already there */
 			ast_unlock_context(con);
+			ast_free(ignorepat);
 			errno = EEXIST;
 			return -1;
 		}
diff --git a/main/xmldoc.c b/main/xmldoc.c
index 2735583ab..fad10e09a 100644
--- a/main/xmldoc.c
+++ b/main/xmldoc.c
@@ -1666,6 +1666,7 @@ static void xmldoc_parse_optionlist(struct ast_xml_node *fixnode, const char *ta
 		ast_str_append(buffer, 0, "\n");
 		ast_xml_free_attr(optname);
 		ast_xml_free_attr(hasparams);
+		ast_free(optionsyntax);
 	}
 }
 
@@ -1740,12 +1741,14 @@ char *ast_xmldoc_build_arguments(const char *type, const char *name, const char
 	char *retstr = NULL;
 
 	if (ast_strlen_zero(type) || ast_strlen_zero(name)) {
+		ast_free(ret);
 		return NULL;
 	}
 
 	node = xmldoc_get_node(type, name, module, documentation_language);
 
 	if (!node || !ast_xml_node_get_children(node)) {
+		ast_free(ret);
 		return NULL;
 	}
 
@@ -1758,6 +1761,7 @@ char *ast_xmldoc_build_arguments(const char *type, const char *name, const char
 
 	if (!node || !ast_xml_node_get_children(node)) {
 		/* We couldn't find the syntax node. */
+		ast_free(ret);
 		return NULL;
 	}