Skip to content

Commit

Permalink
b2b_entities: free key returned by client_new
Browse files Browse the repository at this point in the history
prevent pkg leak of b2b_key returned by client_new

(cherry picked from commit 60043ae)
  • Loading branch information
razvancrainea committed Aug 22, 2022
1 parent 9ee9046 commit 99d9a24
Show file tree
Hide file tree
Showing 4 changed files with 9 additions and 0 deletions.
1 change: 1 addition & 0 deletions modules/b2b_entities/dlg.c
Expand Up @@ -260,6 +260,7 @@ str* b2b_htable_insert(b2b_table table, b2b_dlg_t* dlg, int hash_index,
LM_ERR("No more shared memory\n");
if(!safe)
lock_release(&table[hash_index].lock);
pkg_free(b2b_key);
return 0;
}
memcpy(dlg->tag[CALLEE_LEG].s, b2b_key->s, b2b_key->len);
Expand Down
2 changes: 2 additions & 0 deletions modules/b2b_sdp_demux/b2b_sdp_demux.c
Expand Up @@ -1634,9 +1634,11 @@ static int b2b_sdp_demux_start(struct sip_msg *msg, str *uri,
if (shm_str_dup(&client->b2b_key, b2b_key) < 0) {
LM_ERR("could not copy b2b client key\n");
/* key is not yet stored, but INVITE sent - terminate it */
pkg_free(b2b_key);
b2b_sdp_client_terminate(client, b2b_key);
return -1;
}
pkg_free(b2b_key);
}

return 0;
Expand Down
4 changes: 4 additions & 0 deletions modules/media_exchange/media_exchange.c
Expand Up @@ -331,8 +331,10 @@ static int handle_media_fork_to_uri(struct media_session_leg *msl, struct socket
LM_ERR("could not copy b2b client key\n");
/* key is not yet stored, so cannot be deleted */
media_b2b.entity_delete(B2B_CLIENT, b2b_key, msl->dlginfo, 1, 1);
pkg_free(b2b_key);
goto destroy;
}
pkg_free(b2b_key);
msl->b2b_entity = B2B_CLIENT;
return 1;
destroy:
Expand Down Expand Up @@ -618,8 +620,10 @@ static int handle_media_exchange_from_uri(struct socket_info *si, struct dlg_cel
LM_ERR("could not copy b2b client key\n");
/* key is not yet stored, so cannot be deleted */
media_b2b.entity_delete(B2B_CLIENT, b2b_key, msl->dlginfo, 1, 1);
pkg_free(b2b_key);
goto unref;
}
pkg_free(b2b_key);
msl->b2b_entity = B2B_CLIENT;
return 1;
unref:
Expand Down
2 changes: 2 additions & 0 deletions modules/siprec/siprec_logic.c
Expand Up @@ -464,10 +464,12 @@ static int srs_send_invite(struct src_sess *sess)
sess->b2b_key.s = shm_malloc(client->len);
if (!sess->b2b_key.s) {
LM_ERR("out of shm memory!\n");
pkg_free(client);
return -1;
}
memcpy(sess->b2b_key.s, client->s, client->len);
sess->b2b_key.len = client->len;
pkg_free(client);

return 0;
}
Expand Down

0 comments on commit 99d9a24

Please sign in to comment.