Fix some memory leaks.

These memory leaks were found and fixed by John Hardin. I'm just
committing them for him.

ASTERISK-24736 #close
Reported by Mark Michelson

Review: https://reviewboard.asterisk.org/r/4389
........

Merged revisions 431468 from http://svn.asterisk.org/svn/asterisk/branches/13


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@431469 65c4cc65-6c06-0410-ace0-fbb531ad65f3

channels/chan_pjsip.c

@@ -2107,7 +2107,7 @@ static int chan_pjsip_incoming_request(struct ast_sip_session *session, struct p
 
 static int call_pickup_incoming_request(struct ast_sip_session *session, pjsip_rx_data *rdata)
 {
-	struct ast_features_pickup_config *pickup_cfg = ast_get_chan_features_pickup_config(session->channel);
+	struct ast_features_pickup_config *pickup_cfg;
 	struct ast_channel *chan;
 
 	/* We don't care about reinvites */
@@ -2115,6 +2115,7 @@ static int call_pickup_incoming_request(struct ast_sip_session *session, pjsip_r
 		return 0;
 	}
 
+	pickup_cfg = ast_get_chan_features_pickup_config(session->channel);
 	if (!pickup_cfg) {
 		ast_log(LOG_ERROR, "Unable to retrieve pickup configuration options. Unable to detect call pickup extension.\n");
 		return 0;

main/bridge_after.c

@@ -345,6 +345,7 @@ static void after_bridge_goto_destroy(void *data)
 	ast_free((char *) after_bridge->parseable_goto);
 	ast_free((char *) after_bridge->context);
 	ast_free((char *) after_bridge->exten);
+	ast_free((char *) after_bridge);
 }
 
 /*!

main/manager.c

@@ -4970,8 +4970,6 @@ static void *fast_originate(void *data)
 			S_OR(in->cid_name, NULL),
 			in->vars, in->account, &chan, in->early_media, &assignedids);
 	}
-	/* Any vars memory was passed to the ast_pbx_outgoing_xxx() calls. */
-	in->vars = NULL;
 
 	if (!chan) {
 		snprintf(requested_channel, AST_CHANNEL_NAME, "%s/%s", in->tech, in->data);
@@ -5418,11 +5416,11 @@ static int action_originate(struct mansession *s, const struct message *m)
 		}
 	} else if (!ast_strlen_zero(app)) {
 		res = ast_pbx_outgoing_app(tech, cap, data, to, app, appdata, &reason, 1, l, n, vars, account, NULL, assignedids.uniqueid ? &assignedids : NULL);
-		/* Any vars memory was passed to ast_pbx_outgoing_app(). */
+		ast_variables_destroy(vars);
 	} else {
 		if (exten && context && pi) {
 			res = ast_pbx_outgoing_exten(tech, cap, data, to, context, exten, pi, &reason, 1, l, n, vars, account, NULL, bridge_early, assignedids.uniqueid ? &assignedids : NULL);
-			/* Any vars memory was passed to ast_pbx_outgoing_exten(). */
+			ast_variables_destroy(vars);
 		} else {
 			astman_send_error(s, m, "Originate with 'Exten' requires 'Context' and 'Priority'");
 			ast_variables_destroy(vars);

main/pbx.c

@@ -8831,7 +8831,7 @@ static void context_merge(struct ast_context **extcontexts, struct ast_hashtab *
 				dupdstr = ast_strdup(prio_item->data);
 
 				res1 = ast_add_extension2(new, 0, prio_item->exten, prio_item->priority, prio_item->label,
-										  prio_item->matchcid ? prio_item->cidmatch : NULL, prio_item->app, dupdstr, prio_item->datad, prio_item->registrar);
+										  prio_item->matchcid ? prio_item->cidmatch : NULL, prio_item->app, dupdstr, ast_free_ptr, prio_item->registrar);
 				if (!res1 && new_exten_item && new_prio_item){
 					ast_verb(3,"Dropping old dialplan item %s/%s/%d [%s(%s)] (registrar=%s) due to conflict with new dialplan\n",
 							context->name, prio_item->exten, prio_item->priority, prio_item->app, (char*)prio_item->data, prio_item->registrar);

main/stasis_channels.c

@@ -1004,13 +1004,14 @@ static struct ast_json *dtmf_end_to_json(
 	const char *direction =
 		ast_json_string_get(ast_json_object_get(blob, "direction"));
 	const struct timeval *tv = stasis_message_timestamp(message);
-	struct ast_json *json_channel = ast_channel_snapshot_to_json(snapshot, sanitize);
+	struct ast_json *json_channel;
 
 	/* Only present received DTMF end events as JSON */
 	if (strcasecmp("Received", direction) != 0) {
 		return NULL;
 	}
 
+	json_channel = ast_channel_snapshot_to_json(snapshot, sanitize);
 	if (!json_channel) {
 		return NULL;
 	}

main/xmldoc.c

@@ -2533,7 +2533,8 @@ static struct ast_xml_doc_item *xmldoc_build_list_responses(struct ast_xml_node
 	/* Iterate over managerEvent nodes */
 	for (event = ast_xml_node_get_children(list_elements); event; event = ast_xml_node_get_next(event)) {
 		struct ast_xml_node *event_instance;
-		const char *name = ast_xml_get_attribute(event, "name");
+		RAII_VAR(const char *, name, ast_xml_get_attribute(event, "name"),
+			ast_xml_free_attr);
 		struct ast_xml_doc_item *new_item;
 
 		if (!name || strcmp(ast_xml_node_get_name(event), "managerEvent")) {
@@ -2607,10 +2608,16 @@ static struct ast_xml_doc_item *xmldoc_build_final_response(struct ast_xml_node
 		"managerEventInstance", NULL, NULL);
 	if (!event_instance) {
 		return NULL;
+	} else {
+		const char *name;
+		struct ast_xml_doc_item *res;
+
+		name = ast_xml_get_attribute(final_response_event, "name");
+		res = xmldoc_build_documentation_item(event_instance, name, "managerEvent");
+		ast_xml_free_attr(name);
+		return res;
 	}
 
-	return xmldoc_build_documentation_item(event_instance,
-		ast_xml_get_attribute(final_response_event, "name"), "managerEvent");
 }
 
 struct ast_xml_doc_item *ast_xmldoc_build_final_response(const char *type, const char *name, const char *module)

pbx/pbx_spool.c

@@ -377,14 +377,12 @@ static void *attempt_thread(void *data)
 		res = ast_pbx_outgoing_app(o->tech, o->capabilities, o->dest, o->waittime * 1000,
 			o->app, o->data, &reason, 2 /* wait to finish */, o->cid_num, o->cid_name,
 			o->vars, o->account, NULL, NULL);
-		o->vars = NULL;
 	} else {
 		ast_verb(3, "Attempting call on %s/%s for %s@%s:%d (Retry %d)\n", o->tech, o->dest, o->exten, o->context,o->priority, o->retries);
 		res = ast_pbx_outgoing_exten(o->tech, o->capabilities, o->dest,
 			o->waittime * 1000, o->context, o->exten, o->priority, &reason,
 			2 /* wait to finish */, o->cid_num, o->cid_name, o->vars, o->account, NULL,
 			ast_test_flag(&o->options, SPOOL_FLAG_EARLY_MEDIA), NULL);
-		o->vars = NULL;
 	}
 	if (res) {
 		ast_log(LOG_NOTICE, "Call failed to go through, reason (%d) %s\n", reason, ast_channel_reason2str(reason));

res/res_pjsip_refer.c

@@ -242,16 +242,16 @@ static struct ast_frame *refer_progress_framehook(struct ast_channel *chan, stru
 
 	/* If a notification is due to be sent push it to the thread pool */
 	if (notification) {
-		if (ast_sip_push_task(progress->serializer, refer_progress_notify, notification)) {
-			ao2_cleanup(notification);
-		}
-
 		/* If the subscription is being terminated we don't need the frame hook any longer */
 		if (notification->state == PJSIP_EVSUB_STATE_TERMINATED) {
 			ast_debug(3, "Detaching REFER progress monitoring hook from '%s' as subscription is being terminated\n",
 				ast_channel_name(chan));
 			ast_framehook_detach(chan, progress->framehook);
 		}
+
+		if (ast_sip_push_task(progress->serializer, refer_progress_notify, notification)) {
+			ao2_cleanup(notification);
+		}
 	}
 
 	return f;
@@ -420,6 +420,7 @@ static void refer_attended_destroy(void *obj)
 	ao2_cleanup(attended->transferer);
 	ast_channel_unref(attended->transferer_chan);
 	ao2_cleanup(attended->transferer_second);
+	ao2_cleanup(attended->progress);
 }
 
 /*! \brief Allocator for attended transfer task */