fix: memory leaks, resource leaks, out of bounds and bugs

ASTERISK-26119 #close

Change-Id: Iecbf7d0f360a021147344c4e83ab242fd1e7512c

1 files changed, 51 insertions, 19 deletions

diff --git a/res/ael/pval.c b/res/ael/pval.c
index d5ea5accf..ce9458c06 100644
--- a/res/ael/pval.c
+++ b/res/ael/pval.c
@@ -3356,9 +3356,9 @@ static int gen_prios(struct ael_extension *exten, char *label, pval *statement,
 #ifdef OLD_RAND_ACTION
 	struct ael_priority *rand_test, *rand_end, *rand_skip;
 #endif
-	char *buf1;
-	char *buf2;
-	char *new_label;
+	RAII_VAR(char *, buf1, NULL, free);
+	RAII_VAR(char *, buf2, NULL, free);
+	RAII_VAR(char *, new_label, NULL, free);
 	char *strp, *strp2;
 	int default_exists;
 	int local_control_statement_count;
@@ -4192,9 +4192,6 @@ static int gen_prios(struct ael_extension *exten, char *label, pval *statement,
 			break;
 		}
 	}
-	free(buf1);
-	free(buf2);
-	free(new_label);
 	return 0;
 }
 
@@ -5053,7 +5050,10 @@ int  pvalCheckType( pval *p, char *funcname, pvaltype type )
 pval *pvalCreateNode( pvaltype type )
 {
 	pval *p = calloc(1,sizeof(pval)); /* why, oh why, don't I use ast_calloc? Way, way, way too messy if I do! */
-	p->type = type;                   /* remember, this can be used externally or internally to asterisk */
+					  /* remember, this can be used externally or internally to asterisk */
+	if (p) {
+		p->type = type;
+	}
 	return p;
 }
 
@@ -5414,14 +5414,30 @@ void pvalIncludesAddInclude( pval *p, const char *include )
 
 void pvalIncludesAddIncludeWithTimeConstraints( pval *p, const char *include, char *hour_range, char *dom_range, char *dow_range, char *month_range )
 {
-	pval *hr = pvalCreateNode(PV_WORD);
-	pval *dom = pvalCreateNode(PV_WORD);
-	pval *dow = pvalCreateNode(PV_WORD);
-	pval *mon = pvalCreateNode(PV_WORD);
-	pval *s = pvalCreateNode(PV_WORD);
-	
-	if (!pvalCheckType(p, "pvalIncludeAddIncludeWithTimeConstraints", PV_INCLUDES))
+	pval *hr;
+	pval *dom;
+	pval *dow;
+	pval *mon;
+	pval *s;
+
+	if (!pvalCheckType(p, "pvalIncludeAddIncludeWithTimeConstraints", PV_INCLUDES)) {
+		return;
+	}
+
+	hr = pvalCreateNode(PV_WORD);
+	dom = pvalCreateNode(PV_WORD);
+	dow = pvalCreateNode(PV_WORD);
+	mon = pvalCreateNode(PV_WORD);
+	s = pvalCreateNode(PV_WORD);
+
+	if (!hr || !dom || !dow || !mon || !s) {
+		destroy_pval(hr);
+		destroy_pval(dom);
+		destroy_pval(dow);
+		destroy_pval(mon);
+		destroy_pval(s);
 		return;
+	}
 
 	s->u1.str = (char *)include;
 	p->u1.list = linku1(p->u1.list, s);
@@ -5668,12 +5684,28 @@ char* pvalIfGetCondition( pval *p )
 
 void pvalIfTimeSetCondition( pval *p, char *hour_range, char *dow_range, char *dom_range, char *mon_range )  /* time range format: 24-hour format begin-end|dow range|dom range|month range */
 {
-	pval *hr = pvalCreateNode(PV_WORD);
-	pval *dow = pvalCreateNode(PV_WORD);
-	pval *dom = pvalCreateNode(PV_WORD);
-	pval *mon = pvalCreateNode(PV_WORD);
-	if (!pvalCheckType(p, "pvalIfTimeSetCondition", PV_IFTIME))
+	pval *hr;
+	pval *dow;
+	pval *dom;
+	pval *mon;
+
+	if (!pvalCheckType(p, "pvalIfTimeSetCondition", PV_IFTIME)) {
 		return;
+	}
+
+	hr = pvalCreateNode(PV_WORD);
+	dow = pvalCreateNode(PV_WORD);
+	dom = pvalCreateNode(PV_WORD);
+	mon = pvalCreateNode(PV_WORD);
+
+	if (!hr || !dom || !dow || !mon) {
+		destroy_pval(hr);
+		destroy_pval(dom);
+		destroy_pval(dow);
+		destroy_pval(mon);
+		return;
+	}
+
 	pvalWordSetString(hr, hour_range);
 	pvalWordSetString(dow, dow_range);
 	pvalWordSetString(dom, dom_range);