set_contact() mem leak on re-registration

TB
Thomas Brown
Wed, Mar 28, 2018 7:05 PM

Hello,

The following portion of code in set_contact() leaks the memory allocated
against the regc pool when re-registering with the same contact.

359    /* Process new contacts */

360    for (i=0; i<contact_cnt; ++i)

361    {

362        pjsip_contact_hdr *hdr;

363        pj_str_t tmp;

364

365        pj_strdup_with_null(regc->pool, &tmp, &contact[i]);

366

367        hdr = (pjsip_contact_hdr*)

368              pjsip_parse_hdr(regc->pool, &CONTACT, tmp.ptr, tmp.slen,
NULL);

369        if (hdr == NULL) {

370            PJ_LOG(4,(THIS_FILE, "Invalid Contact: "%.*s"",

371                      (int)tmp.slen, tmp.ptr));

372            return PJSIP_EINVALIDURI;

373        }

374

375        /* Find the new contact in old contact list. If found, remove

376          * the old header from the old header list.

377          */

378        h = regc->removed_contact_hdr_list.next;

379        while (h != &regc->removed_contact_hdr_list) {

380            int rc;

381

382            rc = pjsip_uri_cmp(PJSIP_URI_IN_CONTACT_HDR,

383                                h->uri, hdr->uri);

384            if (rc == 0) {

385                /* Match */

386                pj_list_erase(h);

387                break;

388            }

389

390            h = h->next;

391        }

392

Memory is allocated against the regc pool with the pj_strdup_with_null()
call and when pjsip_parse_hdr() is called.  In the case of the same contact
pj_list_erase() is invoked to remove the duplicate header from the contact
list however this function merely drops the header entry from the list and
does not free the memory allocated against the pool.

Is this a known problem?  Please advise if there is a correction or work
around.

Cheers

Hello, The following portion of code in set_contact() leaks the memory allocated against the regc pool when re-registering with the same contact. 359 /* Process new contacts */ 360 for (i=0; i<contact_cnt; ++i) 361 { 362 pjsip_contact_hdr *hdr; 363 pj_str_t tmp; 364 365 pj_strdup_with_null(regc->pool, &tmp, &contact[i]); 366 367 hdr = (pjsip_contact_hdr*) 368 pjsip_parse_hdr(regc->pool, &CONTACT, tmp.ptr, tmp.slen, NULL); 369 if (hdr == NULL) { 370 PJ_LOG(4,(THIS_FILE, "Invalid Contact: \"%.*s\"", 371 (int)tmp.slen, tmp.ptr)); 372 return PJSIP_EINVALIDURI; 373 } 374 375 /* Find the new contact in old contact list. If found, remove 376 * the old header from the old header list. 377 */ 378 h = regc->removed_contact_hdr_list.next; 379 while (h != &regc->removed_contact_hdr_list) { 380 int rc; 381 382 rc = pjsip_uri_cmp(PJSIP_URI_IN_CONTACT_HDR, 383 h->uri, hdr->uri); 384 if (rc == 0) { 385 /* Match */ 386 pj_list_erase(h); 387 break; 388 } 389 390 h = h->next; 391 } 392 Memory is allocated against the regc pool with the pj_strdup_with_null() call and when pjsip_parse_hdr() is called. In the case of the same contact pj_list_erase() is invoked to remove the duplicate header from the contact list however this function merely drops the header entry from the list and does not free the memory allocated against the pool. Is this a known problem? Please advise if there is a correction or work around. Cheers