Fix more memory leaks

This patch adds to what was fixed in r366880.  Specifically, it addresses the
following:

* chan_sip:  dispose of an allocated frame in off nominal code paths in
             sip_rtp_read
* func_odbc: when disposing of an allocated resultset, ensure that any rows
             that were appended to that resultset are also disposed of
* cli:       free the created return string buffer in another off nominal code
             path

(issue ASTERISK-19665)
Reported by: Matt Jordan

Review: https://reviewboard.asterisk.org/r/1922/
........

Merged revisions 366944 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10@366948 65c4cc65-6c06-0410-ace0-fbb531ad65f3

channels/chan_sip.c

@@ -7498,6 +7498,7 @@ static struct ast_frame *sip_rtp_read(struct ast_channel *ast, struct sip_pvt *p
 	if (f && (f->frametype == AST_FRAME_DTMF_BEGIN || f->frametype == AST_FRAME_DTMF_END) &&
 	    (ast_test_flag(&p->flags[0], SIP_DTMF) != SIP_DTMF_RFC2833)) {
 		ast_debug(1, "Ignoring DTMF (%c) RTP frame because dtmfmode is not RFC2833\n", f->subclass.integer);
+		ast_frfree(f);
 		return &ast_null_frame;
 	}
 
@@ -7510,6 +7511,7 @@ static struct ast_frame *sip_rtp_read(struct ast_channel *ast, struct sip_pvt *p
 		if (!ast_format_cap_iscompatible(p->jointcaps, &f->subclass.format)) {
 			ast_debug(1, "Bogus frame of format '%s' received from '%s'!\n",
 				ast_getformatname(&f->subclass.format), p->owner->name);
+			ast_frfree(f);
 			return &ast_null_frame;
 		}
 		ast_debug(1, "Oooh, format changed to %s\n",

funcs/func_odbc.c

@@ -151,6 +151,11 @@ static void odbc_datastore_free(void *data)
 {
 	struct odbc_datastore *result = data;
 	struct odbc_datastore_row *row;
+
+	if (!result) {
+		return;
+	}
+
 	AST_LIST_LOCK(result);
 	while ((row = AST_LIST_REMOVE_HEAD(result, list))) {
 		ast_free(row);
@@ -539,7 +544,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
 			pbx_builtin_setvar_helper(chan, "ODBCROWS", rowcount);
 			ast_autoservice_stop(chan);
 		}
-		ast_free(resultset);
+		odbc_datastore_free(resultset);
 		return -1;
 	}
 
@@ -554,7 +559,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
 			pbx_builtin_setvar_helper(chan, "ODBCROWS", rowcount);
 			ast_autoservice_stop(chan);
 		}
-		ast_free(resultset);
+		odbc_datastore_free(resultset);
 		return -1;
 	}
 
@@ -580,7 +585,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
 			pbx_builtin_setvar_helper(chan, "ODBCSTATUS", status);
 			ast_autoservice_stop(chan);
 		}
-		ast_free(resultset);
+		odbc_datastore_free(resultset);
 		return res1;
 	}
 
@@ -594,7 +599,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
 			char *ptrcoldata;
 
 			if (!coldata) {
-				ast_free(resultset);
+				odbc_datastore_free(resultset);
 				SQLCloseCursor(stmt);
 				SQLFreeHandle(SQL_HANDLE_STMT, stmt);
 				ast_odbc_release_obj(obj);
@@ -627,7 +632,7 @@ static int acf_odbc_read(struct ast_channel *chan, const char *cmd, char *s, cha
 					void *tmp = ast_realloc(resultset, sizeof(*resultset) + ast_str_strlen(colnames) + 1);
 					if (!tmp) {
 						ast_log(LOG_ERROR, "No space for a new resultset?\n");
-						ast_free(resultset);
+						odbc_datastore_free(resultset);
 						SQLCloseCursor(stmt);
 						SQLFreeHandle(SQL_HANDLE_STMT, stmt);
 						ast_odbc_release_obj(obj);

main/cli.c

@@ -2350,8 +2350,10 @@ char **ast_cli_completion_matches(const char *text, const char *word)
 
 	/* ensure that the array is NULL terminated */
 	if (matches + 1 >= match_list_len) {
-		if (!(match_list = ast_realloc(match_list, (match_list_len + 1) * sizeof(*match_list))))
+		if (!(match_list = ast_realloc(match_list, (match_list_len + 1) * sizeof(*match_list)))) {
+			ast_free(retstr);
 			return NULL;
+		}
 	}
 	match_list[matches + 1] = NULL;