modules_k/pua: Fixes to memory leaks in PUA when using database only mode

- Found and fixed by Paul Pankhurst @ Crocodile RCS

modules_k/pua/send_publish.c

@@ -341,7 +341,7 @@ void publ_cback_func(struct cell *t, int type, struct tmcb_params *ps)
 	}
 	size= sizeof(ua_pres_t)+ sizeof(str)+ 
 		(hentity->pres_uri->len+ hentity->tuple_id.len + 
-		 hentity->id.len)* sizeof(char);
+		 hentity->id.len + etag.len)* sizeof(char);
 	if(hentity->extra_headers)
 		size+= sizeof(str)+ hentity->extra_headers->len* sizeof(char);
 
@@ -352,7 +352,6 @@ void publ_cback_func(struct cell *t, int type, struct tmcb_params *ps)
 		goto error;
 	}	
 	memset(presentity, 0, size);
-	memset(&presentity->etag, 0, sizeof(str));
 
 	size= sizeof(ua_pres_t);
 	presentity->pres_uri= (str*)((char*)presentity+ size);
@@ -392,14 +391,10 @@ void publ_cback_func(struct cell *t, int type, struct tmcb_params *ps)
 	presentity->flag|= hentity->flag;
 	presentity->event|= hentity->event;
 
-	presentity->etag.s= (char*)shm_malloc(etag.len* sizeof(char));
-	if(presentity->etag.s== NULL)
-	{
-		LM_ERR("No more share memory\n");
-		goto error;
-	}
+	presentity->etag.s= (char*)presentity+ size;
 	memcpy(presentity->etag.s, etag.s, etag.len);
 	presentity->etag.len= etag.len;
+	size+= presentity->etag.len;
 
 	if (dbmode==PUA_DB_ONLY)
 	{
@@ -421,6 +416,9 @@ done:
 		shm_free(*ps->param);
 		*ps->param= NULL;
 	}
+	if(dbmode==PUA_DB_ONLY && presentity)
+		shm_free(presentity);
+
 	free_results_puadb(res);
 	return;
 

modules_k/pua/send_subscribe.c

@@ -241,6 +241,7 @@ void subs_cback_func(struct cell *t, int cb_type, struct tmcb_params *ps)
 	int initial_request = 0;
 	db1_res_t *res=NULL;
  	ua_pres_t dbpres;
+	int need_to_free=0;
 	str pres_uri={0,0}, watcher_uri={0,0}, extra_headers={0,0};
 
 	memset(&dbpres, 0, sizeof(dbpres));
@@ -563,7 +564,7 @@ void subs_cback_func(struct cell *t, int cb_type, struct tmcb_params *ps)
 	size= sizeof(ua_pres_t)+ 2*sizeof(str)+( pto->uri.len+
 		pfrom->uri.len+ pto->tag_value.len+ pfrom->tag_value.len
 		+msg->callid->body.len+ record_route.len+ hentity->contact.len+
-		hentity->id.len )*sizeof(char);
+		hentity->id.len + contact.len)*sizeof(char);
 
 	if(hentity->extra_headers)
 		size+= sizeof(str)+ hentity->extra_headers->len*sizeof(char);
@@ -576,6 +577,11 @@ void subs_cback_func(struct cell *t, int cb_type, struct tmcb_params *ps)
 			pkg_free(record_route.s);
 		goto done;
 	}
+	else
+	{
+		need_to_free=1;
+	}
+	
 	memset(presentity, 0, size);
 	size= sizeof(ua_pres_t);
 
@@ -647,13 +653,10 @@ void subs_cback_func(struct cell *t, int cb_type, struct tmcb_params *ps)
 	}
 
 	/* write the remote contact filed */
-	presentity->remote_contact.s= (char*)shm_malloc(contact.len* sizeof(char));
-	if(presentity->remote_contact.s== NULL)
-	{
-		ERR_MEM(SHARE_MEM);
-	}
+	presentity->remote_contact.s= (char*)presentity+ size;
 	memcpy(presentity->remote_contact.s, contact.s, contact.len);
 	presentity->remote_contact.len= contact.len;
+	size+= presentity->remote_contact.len;
 
 	presentity->event|= hentity->event;
 	presentity->flag= hentity->flag;
@@ -688,7 +691,10 @@ error:
 	if (dbmode == PUA_DB_ONLY)
 	{
 		if (presentity!=NULL)
+		{
 			delete_temporary_dialog_puadb(presentity);
+			if (need_to_free) shm_free(presentity);
+		}
 	}
 	else
 	{
@@ -1082,6 +1088,7 @@ insert:
 		if (dbmode==PUA_DB_ONLY)
 		{
 			insert_puadb(presentity);
+			shm_free(presentity);
 		}
 		else
 		{