[asterisk-dev] [Code Review] tcptls_session memory leak

[Russell Bryant]

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviewboard.asterisk.org/r/375/#review1104
-----------------------------------------------------------


There are still cases where handle_tls_connection() will decrement the reference count and return NULL (when a worker function gets called).  In that case, when you goto error, tcptls_session is still non-NULL, and it will be decremented again and go *boom*.

- Russell


On 2009-09-22 18:32:50, David Vossel wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviewboard.asterisk.org/r/375/
> -----------------------------------------------------------
> 
> (Updated 2009-09-22 18:32:50)
> 
> 
> Review request for Asterisk Developers.
> 
> 
> Summary
> -------
> 
> In tcptls.c, a client tcptls_session is allocated in ast_tcptls_client_start().  The session is created using ao2_alloc() which returns an ao2 object containing the data as well as a single reference.  In that same function an additional reference is given to the tcptls_session right before the handle_tls_connection() function is called.  The handle_tls_connection() function does not handle this reference at all, except for dereferencing the tcptls_session in one error case, so it doesn't appear the extra ref is necessary.  This results in a memory leak in chan_sip for every new client tcptls_session.
> 
> 
> This addresses bug 15939.
>     https://issues.asterisk.org/view.php?id=15939
> 
> 
> Diffs
> -----
> 
>   /trunk/main/tcptls.c 219888 
> 
> Diff: https://reviewboard.asterisk.org/r/375/diff
> 
> 
> Testing
> -------
> 
> I placed a debug message in the tcptls destructor function verifying it is destroyed correctly.  Before this change, the destructor was never called.
> 
> 
> Thanks,
> 
> David
> 
>