kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-09-23 22:45:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merged revisions 346349 via svnmerge from

Browse Source 
https://origsvn.digium.com/svn/asterisk/branches/10

........
  r346349 | dvossel | 2011-11-28 18:00:11 -0600 (Mon, 28 Nov 2011) | 10 lines
  
  Fixes memory leak in message API.
  
  The ast_msg_get_var function did not properly decrement
  the ref count of the var it retrieves.  The way this is
  implemented is a bit tricky, as we must decrement the var and then
  return the var's value.  As long as the documentation for the
  function is followed, this will not result in a dangling pointer as
  the ast_msg structure owns its own reference to the var while it
  exists in the var container.
........


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@346350 65c4cc65-6c06-0410-ace0-fbb531ad65f3
This commit is contained in:
David Vossel
2011-11-29 00:03:36 +00:00
parent edaf970c38
commit d7dec4f14f
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
include/asterisk/message.h
View File

@@ -173,7 +173,8 @@ int ast_msg_set_var(struct ast_msg *msg, const char *name, const char *value);
/*! /*!
* \brief Get the specified variable on the message * \brief Get the specified variable on the message
* \note The return value is valid only as long as the ast_message is valid. Hold a reference * \note The return value is valid only as long as the ast_message is valid. Hold a reference
* to the message if you plan on storing the return value. * to the message if you plan on storing the return value. Do re-set the same
* message var name while holding a pointer to the result of this function.
* *
* \return The value associated with variable "name". NULL if variable not found. * \return The value associated with variable "name". NULL if variable not found.
*/ */

10
main/message.c
View File

@@ -522,12 +522,20 @@ int ast_msg_set_var(struct ast_msg *msg, const char *name, const char *value)
const char *ast_msg_get_var(struct ast_msg *msg, const char *name) const char *ast_msg_get_var(struct ast_msg *msg, const char *name)
{ {
struct msg_data *data; struct msg_data *data;
const char *val = NULL;
if (!(data = msg_data_find(msg->vars, name))) { if (!(data = msg_data_find(msg->vars, name))) {
return NULL; return NULL;
} }
return data->value; /* Yep, this definitely looks like val would be a dangling pointer
* after the ref count is decremented. As long as the message structure
* is used in a thread safe manner, this will not be the case though.
* The ast_msg holds a reference to this object in the msg->vars container. */
val = data->value;
ao2_ref(data, -1);
return val;
} }
struct ast_msg_var_iterator { struct ast_msg_var_iterator {