[registrar] fix mem bug and mem leak in UA-regexp filter

The compiled RE (for UA) is to be freed by the fixup-free function and not by the script function.
Reported by @feiyingcheung
Closes #3356

lib/reg/lookup.c

@@ -73,7 +73,7 @@ lookup_rc lookup(struct sip_msg *req, udomain_t *d,
 
 	if (lookup_flags) {
 		flags = lookup_flags->flags;
-		if (lookup_flags->ua_re_is_set)
+		if (flags & REG_LOOKUP_UAFILTER_FLAG)
 			ua_re = &lookup_flags->ua_re;
 		max_latency = lookup_flags->max_latency;
 	}
@@ -208,8 +208,6 @@ lookup_rc lookup(struct sip_msg *req, udomain_t *d,
 		ul.unlock_udomain(d, &aor);
 	}
 out_cleanup:
-	if (flags & REG_LOOKUP_UAFILTER_FLAG)
-		regfree(ua_re);
 	return ret;
 }
 
@@ -430,8 +428,6 @@ int reg_fixup_lookup_flags(void** param)
 			return -1;
 		}
 		*(p + re_len) = '/';
-
-		lookup_flags->ua_re_is_set = 1;
 	}
 
 	/* max-ping-latency */
@@ -451,8 +447,13 @@ int reg_fixup_lookup_flags(void** param)
 
 int reg_fixup_free_lookup_flags(void** param)
 {
-	if (*param)
-		pkg_free(*param);
+	struct lookup_flags *lookup_flags = (struct lookup_flags *)*param;
+
+	if (lookup_flags) {
+		if (lookup_flags->flags & REG_LOOKUP_UAFILTER_FLAG)
+			regfree(&lookup_flags->ua_re);
+		pkg_free(lookup_flags);
+	}
 	return 0;
 }
 

lib/reg/lookup.h

@@ -48,7 +48,6 @@ typedef enum _lookup_rc {
 struct lookup_flags {
 	unsigned int flags;
 	regex_t ua_re;
-	char ua_re_is_set;
 	int max_latency;
 };