topos: free temporary sip msg structure when handling 100 replies

- it can lead to memory leak, reported by Sergey Basov

src/modules/topos/topos_mod.c

@@ -280,12 +280,14 @@ int tps_msg_received(void *data)
 	str *obuf;
 	char *nbuf = NULL;
 	int dialog;
+	int ret;
 
 	obuf = (str*)data;
 	memset(&msg, 0, sizeof(sip_msg_t));
 	msg.buf = obuf->s;
 	msg.len = obuf->len;
 
+	ret = 0;
 	if(tps_prepare_msg(&msg)!=0) {
 		goto done;
 	}
@@ -310,17 +312,22 @@ int tps_msg_received(void *data)
 		/* reply */
 		if(msg.first_line.u.reply.statuscode==100) {
 			/* nothing to do - it should be absorbed */
-			return 0;
+			goto done;
 		}
 		tps_response_received(&msg);
 	}
 
 	nbuf = tps_msg_update(&msg, (unsigned int*)&obuf->len);
 
+	if(nbuf==NULL) {
+		LM_ERR("not enough pkg memory for new message\n");
+		ret = -1;
+		goto done;
+	}
 	if(obuf->len>=BUF_SIZE) {
 		LM_ERR("new buffer overflow (%d)\n", obuf->len);
-		pkg_free(nbuf);
-		return -1;
+		ret = -1;
+		goto done;
 	}
 	memcpy(obuf->s, nbuf, obuf->len);
 	obuf->s[obuf->len] = '\0';
@@ -329,7 +336,7 @@ done:
 	if(nbuf!=NULL)
 		pkg_free(nbuf);
 	free_sip_msg(&msg);
-	return 0;
+	return ret;
 }
 
 /**
@@ -368,7 +375,7 @@ int tps_msg_sent(void *data)
 		/* reply */
 		if(msg.first_line.u.reply.statuscode==100) {
 			/* nothing to do - it should be locally generated */
-			return 0;
+			goto done;
 		}
 		tps_response_sent(&msg);
 	}