From 0f92716dbb62d8c8df013668bcd86835b8f8b85d Mon Sep 17 00:00:00 2001 From: Richard Mudgett Date: Fri, 19 Aug 2011 17:24:56 +0000 Subject: [PATCH] Fix infinite loop releasing the same memory in ldap_loadentry(). * Fixed memory leak of vars in ldap_loadentry(). * Fixed potential NULL ptr dereference of vars in ldap_loadentry(). git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@332615 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- res/res_config_ldap.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/res/res_config_ldap.c b/res/res_config_ldap.c index 55e1526d53d..554f4f5d497 100644 --- a/res/res_config_ldap.c +++ b/res/res_config_ldap.c @@ -609,17 +609,17 @@ static struct ast_variable *ldap_loadentry(struct ldap_table_config *table_confi /* Chopping \a vars down to one variable */ if (vars != NULL) { struct ast_variable **p = vars; - p++; - var = *p; - while (var) { - ast_variables_destroy(var); - p++; + + /* Only take the first one. */ + var = *vars; + + /* Destroy the rest. */ + while (*++p) { + ast_variables_destroy(*p); } - vars = ast_realloc(vars, sizeof(struct ast_variable *)); + ast_free(vars); } - var = *vars; - return var; } } @@ -864,6 +864,11 @@ static struct ast_variable **realtime_ldap_base_ap(unsigned int *entries_count_p ast_variables_destroy(base_var); base_var = next; } else { + /*! + * \todo XXX The interactions with base_var and append_var may + * cause a memory leak of base_var nodes. Also the append_var + * list and base_var list may get cross linked. + */ if (append_var) { base_var->next = append_var; } else { @@ -926,6 +931,8 @@ static struct ast_variable *realtime_ldap(const char *basedn, if (vars) { struct ast_variable *last_var = NULL; struct ast_variable **p = vars; + + /* Chain the vars array of lists into one list to return. */ while (*p) { if (last_var) { while (last_var->next) {