Fix memory/ref counting leaks in a variety of locations

This patch fixes the following memory leaks:
 * http.c: The structure containing the addresses to bind to was not being
   deallocated when no longer used
 * named_acl.c: The global configuration information was not disposed of
 * config_options.c: An invalid read was occurring for certain option types.
 * res_calendar.c: The loaded calendars on module unload were not being
   properly disposed of.
 * chan_motif.c: The format capabilities needed to be disposed of on module
   unload. In addition, this now specifies the default options for the
   maxpayloads and maxicecandidates in such a way that it doesn't cause the
   invalid read in config_options.c to occur.

(issue ASTERISK-21906)
Reported by: John Hardin
patches:
  http.patch uploaded by jhardin (license 6512)
  named_acl.patch uploaded by jhardin (license 6512)
  config_options.patch uploaded by jhardin (license 6512)
  res_calendar.patch uploaded by jhardin (license 6512)
  chan_motif.patch uploaded by jhardin (license 6512)
........

Merged revisions 392810 from http://svn.asterisk.org/svn/asterisk/branches/11


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@392812 65c4cc65-6c06-0410-ace0-fbb531ad65f3

channels/chan_motif.c

@@ -2711,9 +2711,9 @@ static int load_module(void)
 	aco_option_register_custom(&cfg_info, "connection", ACO_EXACT, endpoint_options, NULL, custom_connection_handler, 0);
 	aco_option_register_custom(&cfg_info, "transport", ACO_EXACT, endpoint_options, NULL, custom_transport_handler, 0);
 	aco_option_register(&cfg_info, "maxicecandidates", ACO_EXACT, endpoint_options, DEFAULT_MAX_ICE_CANDIDATES, OPT_UINT_T, PARSE_DEFAULT,
-			    FLDSET(struct jingle_endpoint, maxicecandidates));
+			    FLDSET(struct jingle_endpoint, maxicecandidates), DEFAULT_MAX_ICE_CANDIDATES);
 	aco_option_register(&cfg_info, "maxpayloads", ACO_EXACT, endpoint_options, DEFAULT_MAX_PAYLOADS, OPT_UINT_T, PARSE_DEFAULT,
-			    FLDSET(struct jingle_endpoint, maxpayloads));
+			    FLDSET(struct jingle_endpoint, maxpayloads), DEFAULT_MAX_PAYLOADS);
 
 	ast_format_cap_add_all_by_type(jingle_tech.capabilities, AST_FORMAT_TYPE_AUDIO);
 
@@ -2764,6 +2764,8 @@ static int reload(void)
 static int unload_module(void)
 {
 	ast_channel_unregister(&jingle_tech);
+	ast_format_cap_destroy(jingle_tech.capabilities);
+	jingle_tech.capabilities = NULL;
 	ast_rtp_glue_unregister(&jingle_rtp_glue);
 	ast_sched_context_destroy(sched);
 	aco_info_destroy(&cfg_info);

main/config_options.c

@@ -186,14 +186,15 @@ static int link_option_to_types(struct aco_info *info, struct aco_type **types,
 				|| xmldoc_update_config_option(types, info->module, opt->name, type->name, opt->default_val, opt->match_type == ACO_REGEX, opt->type)
 #endif /* AST_XML_DOCS */
 		) {
-			while (--idx) {
+			do {
 				ao2_unlink(types[idx]->internal->opts, opt);
-			}
+			} while (--idx);
 			return -1;
 		}
-		/* The container should hold the only ref to opt */
-		ao2_ref(opt, -1);
 	}
+	/* The container(s) should hold the only ref to opt */
+	ao2_ref(opt, -1);
+
 	return 0;
 }
 

main/http.c

@@ -1040,7 +1040,7 @@ static int __ast_http_load(int reload)
 	struct http_uri_redirect *redirect;
 	struct ast_flags config_flags = { reload ? CONFIG_FLAG_FILEUNCHANGED : 0 };
 	uint32_t bindport = DEFAULT_PORT;
-	struct ast_sockaddr *addrs = NULL;
+	RAII_VAR(struct ast_sockaddr *, addrs, NULL, ast_free);
 	int num_addrs = 0;
 	int http_tls_was_enabled = 0;
 

main/named_acl.c

@@ -360,21 +360,6 @@ struct ast_ha *ast_named_acl_find(const char *name, int *is_realtime, int *is_un
 /*! \brief Message type for named ACL changes */
 STASIS_MESSAGE_TYPE_DEFN(ast_named_acl_change_type);
 
-static void acl_stasis_cleanup(void)
-{
-	STASIS_MESSAGE_TYPE_CLEANUP(ast_named_acl_change_type);
-}
-
-/*!
- * \internal
- * \brief Initialize Named ACL related stasis topics/messages
- */
-static void ast_acl_stasis_init(void)
-{
-	ast_register_cleanup(acl_stasis_cleanup);
-	STASIS_MESSAGE_TYPE_INIT(ast_named_acl_change_type);
-}
-
 /*!
  * \internal
  * \brief Sends a stasis message corresponding to a given named ACL that has changed or
@@ -580,16 +565,25 @@ static struct ast_cli_entry cli_named_acl[] = {
 	AST_CLI_DEFINE(handle_show_named_acl_cmd, "Show a named ACL or list all named ACLs"),
 };
 
+static void named_acl_cleanup(void)
+{
+	STASIS_MESSAGE_TYPE_CLEANUP(ast_named_acl_change_type);
+	aco_info_destroy(&cfg_info);
+	ao2_global_obj_release(globals);
+}
+
 int ast_named_acl_init()
 {
 	ast_cli_register_multiple(cli_named_acl, ARRAY_LEN(cli_named_acl));
 
+	STASIS_MESSAGE_TYPE_INIT(ast_named_acl_change_type);
+
+	ast_register_cleanup(named_acl_cleanup);
+
 	if (aco_info_init(&cfg_info)) {
 		return 0;
 	}
 
-	ast_acl_stasis_init();
-
 	/* Register the per level options. */
 	aco_option_register(&cfg_info, "permit", ACO_EXACT, named_acl_types, NULL, OPT_ACL_T, 1, FLDSET(struct named_acl, ha));
 	aco_option_register(&cfg_info, "deny", ACO_EXACT, named_acl_types, NULL, OPT_ACL_T, 0, FLDSET(struct named_acl, ha));

res/res_calendar.c

@@ -1819,6 +1819,8 @@ static int unload_module(void)
 
 	/* Remove all calendars */
 	ao2_callback(calendars, OBJ_UNLINK | OBJ_NODATA | OBJ_MULTIPLE, NULL, NULL);
+	ao2_cleanup(calendars);
+	calendars = NULL;
 
 	ast_mutex_lock(&refreshlock);
 	module_unloading = 1;