Browse code

corrected possible memory leak when there are more routes within one Record-Route header field

Vaclav Kubart authored on 04/09/2006 07:53:29
Showing 1 changed files
... ...
@@ -317,6 +317,21 @@ static inline int get_callid(struct sip_msg* _m, str* _cid)
317 317
 	return 0;
318 318
 }
319 319
 
320
+static rr_t *revert_route(rr_t *r)
321
+{
322
+	rr_t *a, *b;
323
+
324
+	a = NULL;
325
+
326
+	while (r) {
327
+		b = r->next;
328
+		r->next = a;
329
+		a = r;
330
+		r = b;
331
+	}
332
+
333
+	return a;
334
+}
320 335
 
321 336
 /*
322 337
  * Create a copy of route set either in normal or reverse order
... ...
@@ -337,31 +352,27 @@ static inline int get_route_set(struct sip_msg* _m, rr_t** _rs, unsigned char _o
337 352
 			}
338 353
 
339 354
 			p = (rr_t*)ptr->parsed;
340
-			while(p) {
341
-				if (shm_duplicate_rr(&t, p) < 0) {
342
-					LOG(L_ERR, "get_route_set(): Error while duplicating rr_t\n");
343
-					goto error;
344
-				}
345
-				if (_order == NORMAL_ORDER) {
346
-					if (!*_rs) *_rs = t;
347
-					if (last) last->next = t;
348
-					last = t;
349
-				} else {
350
-					t->next = *_rs;
351
-					*_rs = t;
352
-				}
353
-
354
-				p = p->next;
355
+			if (shm_duplicate_rr(&t, p) < 0) {
356
+				LOG(L_ERR, "get_route_set(): Error while duplicating rr_t\n");
357
+				goto error;
355 358
 			}
356
-			
359
+			if (!*_rs) *_rs = t;
360
+			if (last) last->next = t;
361
+			last = t;
362
+			while (last->next) last = last->next; /* !!! there may be more routes in one hdr field !!! */
363
+
357 364
 		}
358 365
 		ptr = ptr->next;
359 366
 	}
367
+	if ((*_rs) && (_order != NORMAL_ORDER)) {
368
+		/* better to revert the route outside of cycle above */
369
+		*_rs = revert_route(*_rs);
370
+	}
360 371
 	
361 372
 	return 0;
362 373
 
363 374
  error:
364
-        shm_free_rr(_rs);
375
+	shm_free_rr(_rs);
365 376
 	return -1;
366 377
 }
367 378