Memory Leak in belle_sip_object_data_remove/belle_sip_object_data_grab

[zzfnohell]

Description:

The function belle_sip_list_remove_link in belle_sip_object.c incorrectly removes list items without freeing their associated memory. This can lead to memory leaks over time, as unused list items accumulate but are not properly deallocated.

Expected Behavior:

The function should remove the specified list item and free its memory to prevent memory leaks. To achieve this, the correct function to use is belle_sip_list_delete_link. This function both removes the item from the list and frees its memory.

belle_sip_object.c

int belle_sip_object_data_remove(belle_sip_object_t *obj, const char *name) {
	belle_sip_list_t *list_entry = belle_sip_list_find_custom(obj->data_store, belle_sip_object_data_find, name);
	struct belle_sip_object_data *entry = (list_entry) ? list_entry->data : NULL;
	if (entry) {
		belle_sip_free(entry->name);
		if (entry->destroy_func) entry->destroy_func(entry->data);
		belle_sip_free(entry);
	}
	if (list_entry) obj->data_store = belle_sip_list_remove_link(obj->data_store, list_entry);
	return !(list_entry != NULL);
}

void *belle_sip_object_data_grab(belle_sip_object_t *obj, const char *name) {
	belle_sip_list_t *list_entry = belle_sip_list_find_custom(obj->data_store, belle_sip_object_data_find, name);
	struct belle_sip_object_data *entry = (list_entry) ? list_entry->data : NULL;
	void *data = NULL;

	if (entry) {
		belle_sip_free(entry->name);
		data = entry->data;
	}
	obj->data_store = belle_sip_list_remove_link(obj->data_store, list_entry);
	belle_sip_free(entry);

	return data;
}

in belle-sip/include/belle-sip/list.h

#define belle_sip_list_remove_link bctbx_list_unlink
#define belle_sip_list_delete_link bctbx_list_erase_link

in bctoolbox/src/containers/list.c

bctbx_list_t *bctbx_list_unlink(bctbx_list_t *list, bctbx_list_t *elem) {
	bctbx_list_t *ret;
	if (!elem) {
		return list;
	} else if (elem == list) {
		ret = elem->next;
		elem->prev = NULL;
		elem->next = NULL;
		if (ret != NULL) ret->prev = NULL;
		return ret;
	}
	elem->prev->next = elem->next;
	if (elem->next != NULL) elem->next->prev = elem->prev;
	elem->next = NULL;
	elem->prev = NULL;
	return list;
}

bctbx_list_t *bctbx_list_erase_link(bctbx_list_t *list, bctbx_list_t *elem) {
	bctbx_list_t *ret = NULL;
	if (elem) {
		ret = bctbx_list_unlink(list, elem);
		bctbx_free(elem);
	} else {
		ret = list;
	}
	return ret;
}