There are several locations in the code base where this is done:
buf = ast_realloc(buf, new_size);

This is going to leak the original buf contents if the realloc fails.

Review: https://reviewboard.asterisk.org/r/2832/
........

Merged revisions 398757 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398758 65c4cc65-6c06-0410-ace0-fbb531ad65f3

........

Merged revisions 398752 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398753 65c4cc65-6c06-0410-ace0-fbb531ad65f3

........

Merged revisions 398748 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398749 65c4cc65-6c06-0410-ace0-fbb531ad65f3

Race conditions between freeing a nul terminated string and
ast_strdup()'ing it are more likely to be detected if the fence and freed
magic numbers are completely different.
........

Merged revisions 398703 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398721 65c4cc65-6c06-0410-ace0-fbb531ad65f3

This patch fixes some long-standing bugs in debug threads that were
exacerbated with recent Optional API work in Asterisk 12.

With debug threads enabled, on some systems, there's a lock ordering
problem between our mutex and glibc's mutex protecting its module list
(Ubuntu Lucid, glibc 2.11.1 in this instance). In one thread, the module
list will be locked before acquiring our mutex. In another thread, our
mutex will be locked before locking the module list (which happens in
the depths of calling backtrace()).

This patch fixes this issue by moving backtrace() calls outside of
critical sections that have the mutex acquired. The bigger change was to
reentrancy tracking for ast_cond_{timed,}wait, which wrongly assumed
that waiting on the mutex was equivalent to a single unlock (it actually
suspends all recursive locks on the mutex).

(closes issue ASTERISK-22455)
Review: https://reviewboard.asterisk.org/r/2824/
........

Merged revisions 398648 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398649 65c4cc65-6c06-0410-ace0-fbb531ad65f3

Sometimes the Google Voice servers have a bad habit of sending out 1
byte replies to the xmpp resource. When a blank 1 byte reply is
received from the socket the buffer attempts to wait (endlessly) for
the rest of the reply from google which effectively blocks the socket
and google voice calls will no longer come into the server.

This patch allows the xmpp module to correctly detect empty packets and
send out ping replies to google. It also sets a socket timeout on the
default socket which prevents the xmpp socket from closing and
preventing future google voice calls from coming into the server.

Furthermore instead of sending an empty reply back to google we send a
proper xmpp ping reply back. This also adds several more
socket messages.

(closes issue ASTERISK-22347)
Reported by: Andrew Nagy
Review: https://reviewboard.asterisk.org/r/2771
Patches:
    xmpp_fix_1.diff uploaded by Andrew Nagy (License #6524)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398618 65c4cc65-6c06-0410-ace0-fbb531ad65f3

This is a missing part of the commit in revision 398523 that corrects
the name of a variable.

(issue ASTERISK-22435)
........

Merged revisions 398576 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398577 65c4cc65-6c06-0410-ace0-fbb531ad65f3

The mailbox and context are swapped on the receiving end for all users
of Jabber and XMPP distributed MWI in Asterisk 1.8 and all more recent
versions. This swaps those values to be correct when publishing to the
internal event system from Jabber/XMPP distributed MWI state.

(closes issue ASTERISK-22435)
Reported by: abelbeck
Tested by: Michael Keuter
Patches:
    asterisk-1.8-res_jabber-aji_handle_pubsub_event.patch uploaded by abelbeck
    asterisk-11-res_xmpp-xmpp_pubsub_handle_event.patch uploaded by abelbeck
........

Merged revisions 398523 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398558 65c4cc65-6c06-0410-ace0-fbb531ad65f3

This fixes the things in chan_h323 that were missed or ignored in the
great channel opaquification and gets chan_h323 back into a compiling
state.

(closes issue ASTERISK-22365)
Reported by: Dmitry Melekhov
Patches:
    chan_h323.patch uploaded by Dmitry Melekhov


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398510 65c4cc65-6c06-0410-ace0-fbb531ad65f3

* Reduce indentation in __attempt_transmit().

* Don't update the static last error time variable every time in
__schedule_action() and socket_read().
........

Merged revisions 398456 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398457 65c4cc65-6c06-0410-ace0-fbb531ad65f3

* Fix stray reference to idle_list in cleanup_thread_list().  This may be
the reason for the note in iax2_process_thread() about threads not being
removed from the task lists.

* Move cleanup_thread_list(&idle_list) to after the other lists are
cleaned up.
........

Merged revisions 398416 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398417 65c4cc65-6c06-0410-ace0-fbb531ad65f3

* Fix bridgecallno deadlock avoidance.  When doing deadlock avoidance, you
need to retest the status of values for each loop to see if you still need
the lock for bridgecallno.

* As a safety check, after acquiring the bridgecallno lock you should
check if iaxs[bridgecallno] is NULL just like the current callno checks.

* Move setting thread->iostate to IAX_IOSTATE_IDLE to after processing any
deferred frames to ensure that the iostate is IDLE when it is placed back
into the idle list.  defer_full_frame() tries to ensure
iax2_process_thread() wakes up to process the frame.
........

Merged revisions 398379 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398380 65c4cc65-6c06-0410-ace0-fbb531ad65f3

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398305 65c4cc65-6c06-0410-ace0-fbb531ad65f3

........

Merged revisions 398301 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398302 65c4cc65-6c06-0410-ace0-fbb531ad65f3

(closes issue ASTERISK-22414)
Reported by: Corey Farrell
Patches:
    test_voicemail_api-leaks-11.patch uploaded by coreyfarrell (license 5909)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398285 65c4cc65-6c06-0410-ace0-fbb531ad65f3

(issues ASTERISK-22414)
Reported by: Corey Farrell
Patch:
    test_voicemail_api-leaks-11.patch uploaded by coreyfarrell (license 5909)


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398281 65c4cc65-6c06-0410-ace0-fbb531ad65f3

Fix the misdn debug output to remote consoles.  chan_misdn uses
ast_console_puts() which doesn't know about verbose levels.  Better to use
ast_verbose() instead.  Without this patch the misdn debug messages are
appended to the verbose level which ever was set by the message sent to
the console before, i.e.  any undefined level.

(closes issue AST-1218)
Reported by: Guenther Kelleter
Patches:
      misdnlog.patch (license #6372) patch uploaded by Guenther Kelleter
........

Merged revisions 398235 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398236 65c4cc65-6c06-0410-ace0-fbb531ad65f3

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398214 65c4cc65-6c06-0410-ace0-fbb531ad65f3

Review: https://reviewboard.asterisk.org/r/2805/
........

Merged revisions 398167 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398168 65c4cc65-6c06-0410-ace0-fbb531ad65f3

main/config.c - cleanup cache fie includes
res/res_security_log.c - unregister logger level
channesl/chan_sip.c - cleanup io context and notify_types
main/translator.c - cleanup at shutdown
main/named_acl.c - cleanup cli commands
main/indications.c - ast_get_indication_tone() unref default_tone_zone if used

(closes issues ASTERISK-22378)
Reported by: Corey Farrell
Patches:
     config_shutdown.patch uploaded by coreyfarrell (license 5909)
     res_security_log.patch uploaded by coreyfarrell (license 5909)
     chan_sip-11.patch uploaded by coreyfarrell (license 5909)
     indications_refleak.patch uploaded by coreyfarrell (license 5909)
     named_acl-cli_unreg-11.patch uploaded by coreyfarrell (license 5909)
     translate_shutdown.patch uploaded by coreyfarrell (license 5909)

........

Merged revisions 398102 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398103 65c4cc65-6c06-0410-ace0-fbb531ad65f3

ast_xmldoc_printable returns an allocated block that must be freed by the
caller.  Fixed manager.c and res_agi.c to stop leaking these results.

(closes issue ASTERISK-22395)
Reported by: Corey Farrell
Patches:
     manager-leaks-11.patch uploaded by coreyfarrell (license 5909)
     res_agi-xmldoc-leaks.patch uploaded by coreyfarrell (license 5909)
........

Merged revisions 398060 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398061 65c4cc65-6c06-0410-ace0-fbb531ad65f3

Fixed a features.c test that leaked a reference to a parked call.  This caused
chancount to never reach 0, so graceful shutdown stops.  Also added an
unregister test.

(closes issue ASTERISK-22413)
Reported by: Corey Farrell
Patches:
     features-TEST_FRAMEWORK.patch uploaded by coreyfarrell (license 5909)
........

Merged revisions 398021 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398022 65c4cc65-6c06-0410-ace0-fbb531ad65f3

You cannot put the "Testing <blah> pass/fail" on a single line before
actually performing the test.  Now any additional failure information is
logged before the test pass/fail announcement.

* Added an additional CDR(answer,u) test.
........

Merged revisions 398018 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398019 65c4cc65-6c06-0410-ace0-fbb531ad65f3

(closes issue ASTERISK-22368)
Reported by: Corey Farrell
Patches:
     issueA22368_mixmonitor_free_filename.patch uploaded by wdoekes (license 5674)
........

Merged revisions 398004 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398011 65c4cc65-6c06-0410-ace0-fbb531ad65f3

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@398000 65c4cc65-6c06-0410-ace0-fbb531ad65f3

Refactored cases where a combination of ast_verbose/options_verbose were
present.  Also in general tried to eliminate, in as many places as possible,
where the options_verbose global variable was being used.  Refactored the way
local and remote consoles handle verbose message logging in an attempt to
solve the various discrepancies that sometimes would show between the two.

(closes issue AST-1193)
Reported by: Guenther Kelleter
Review: https://reviewboard.asterisk.org/r/2798/


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397948 65c4cc65-6c06-0410-ace0-fbb531ad65f3

If the SIP channel driver processes an invalid SDP that defines media
descriptions before connection information, it may attempt to reference
the socket address information even though that information has not yet
been set. This will cause a crash.

This patch adds checks when handling the various media descriptions that
ensures the media descriptions are handled only if we have connection
information suitable for that media.

Thanks to Walter Doekes, OSSO B.V., for reporting, testing, and providing
the solution to this problem.

(closes issue ASTERISK-22007)
Reported by: wdoekes
Tested by: wdoekes
patches:
  issueA22007_sdp_without_c_death.patch uploaded by wdoekes (License 5674)
........

Merged revisions 397756 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 397757 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397758 65c4cc65-6c06-0410-ace0-fbb531ad65f3

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397744 65c4cc65-6c06-0410-ace0-fbb531ad65f3

A remote exploitable crash vulnerability exists in the SIP channel driver if an
ACK with SDP is received after the channel has been terminated. The handling
code incorrectly assumed that the channel would always be present.

This patch adds a check such that the SDP will only be parsed and applied if
Asterisk has a channel present that is associated with the dialog.

Note that the patch being applied was modified only slightly from the patch
provided by Walter Doekes of OSSO B.V.

(closes issue ASTERISK-21064)
Reported by: Colin Cuthbertson
Tested by: wdoekes, Colin Cutherbertson
patches:
  issueA21064_fix.patch uploaded by wdoekes (License 5674)
........

Merged revisions 397710 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 397711 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397712 65c4cc65-6c06-0410-ace0-fbb531ad65f3

Review: https://reviewboard.asterisk.org/r/2777/


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397604 65c4cc65-6c06-0410-ace0-fbb531ad65f3

Review https://reviewboard.asterisk.org/r/2580/ tried to fix the mismatch
in memory pools but had a math error determining the buffer size and
didn't address other similar memory pool mismatches.

* Effectively reverted the previous patch to go in the same direction as
trunk for the returned memory pool of ast_bt_get_symbols().

* Fixed memory leak in ast_bt_get_symbols() when BETTER_BACKTRACES is
defined.

* Fixed some formatting in ast_bt_get_symbols().

* Fixed sig_pri.c freeing memory allocated by libpri when MALLOC_DEBUG is
enabled.

* Fixed __dump_backtrace() freeing memory from ast_bt_get_symbols() when
MALLOC_DEBUG is enabled.

* Moved __dump_backtrace() because of compile issues with the utils
directory.

(closes issue ASTERISK-22221)
Reported by: Matt Jordan

Review: https://reviewboard.asterisk.org/r/2778/
........

Merged revisions 397525 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397528 65c4cc65-6c06-0410-ace0-fbb531ad65f3

The --version-script,asterisk.exports linker flag (and the module
exports) didn't provide _IO_stdin_used in the list of exported symbols.
That causes some kind of libc compatibility mode to kick in, where
stdio file structures (stdout/stderr) land somewhere else. In the
case of the Sparc, they landed on misaligned memory.

This became apparent first after r376428 (Reorder startup sequence)
when a lot of ast_log's were replaced with fprintf's. Writing to
stderr triggered a SIGBUS. (Compared to x86 and amd64 architectures,
the Sparc is very picky about memory alignment.)

(issue ASTERISK-21763)
(issue ASTERISK-21665)

Reported by: Jeremy Kister
Review: https://reviewboard.asterisk.org/r/2760/
........

Merged revisions 397377 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397378 65c4cc65-6c06-0410-ace0-fbb531ad65f3

If the file udptl.conf is unavailable at startup, UDPTL will fail to
initialize and while it makes some noise, it isn't immediately
obvious why consumers start to fail when using it. This patch makes
UDPTL load as though an empty config was provided  when udptl is
unavailable at startup.

(closes issue ASTERISK-22349)
Reported by: Jonathan Rose
Review: https://reviewboard.asterisk.org/r/2773/


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397365 65c4cc65-6c06-0410-ace0-fbb531ad65f3

This patch frees up some resources allocated in http.c.
 * tcp listeners stopped
 * tls settings freed
 * uri redirects freed
 * unregister internal http.c uri's

(closes issue ASTERISK-22237)
Reported by: Corey Farrell

Patches:
    http.patch uploaded by Corey Farrell (license 5909)
........

Merged revisions 397308 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397309 65c4cc65-6c06-0410-ace0-fbb531ad65f3

If an endpoint fails to include the T38MaxBitRate attribute during negotiation,
Asterisk will negotiate a bit rate of 2400 instead of the ITU recommended
bit rate of 14400. This patch fixes this by making AST_T38_RATE_14400 the
'default' value of the enum by assigning it a value of 0, such that if an
endpoint fails to include the attribute, the default will be 14400.

Note that Walter Doekes included the nice comment in frame.h about why we are
purposefully assigning AST_T38_RATE_14400 a value of 0.

(closes issue ASTERISK-22275)
Reported by: Andreas Steinmetz
patches:
  fax-fix.patch uploaded by anstein (License 6523)
........

Merged revisions 397256 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397257 65c4cc65-6c06-0410-ace0-fbb531ad65f3

If a From header on an outbound out-of-call SIP MESSAGE were
malformed, the result could crash Asterisk.

In addition, if a From header on an incoming out-of-call SIP
MESSAGE request were malformed, the message was happily accepted
rather than being rejected up front. The incoming message path
would not result in a crash, but the behavior was bad nonetheless.

(closes issue ASTERISK-22185)
reported by Zhang Lei


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397254 65c4cc65-6c06-0410-ace0-fbb531ad65f3

In 1.8, r384779 introduced a regression by retrieving an old dialog and keeping
the old recv address since recv was already set.  This has caused a problem when
a proxy is involved since responses to incoming requests from the proxy server,
after an outbound call is established, are never sent to the correct recv
address.

In 11, r382322 introduced this regression.

The fix is to revert that change and always store the recv address on incoming
requests.

Thank you Walter Doekes for helping to point out this error and Mark Michelson
for your input/review of the fix.

(closes issue ASTERISK-22071)
Reported by: Alex Zarubin
Tested by: Alex Zarubin, Karsten Wemheuer
Patches:
    asterisk-22071-store-recvd-address.diff by Michael L. Young (license 5026)
........

Merged revisions 397204 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397205 65c4cc65-6c06-0410-ace0-fbb531ad65f3

........

Merged revisions 397156 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397157 65c4cc65-6c06-0410-ace0-fbb531ad65f3

(closes issue ASTERISK-22248)
reported by Corey Farrell
patches:
	test_sip_rtpqos.patch uploaded by Corey Farrell (license #5909)
........

Merged revisions 397112 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397133 65c4cc65-6c06-0410-ace0-fbb531ad65f3

This patch ensures that CLI commands enabled by DEBUG_FD_LEAKS and
DEBUG_THREADLOCALS are cleaned up properly on exit.

(closes issue ASTERISK-22238)
Reported by: Corey Farrell
Tested by: Corey Farrell
Patches:
    debug_cli_unregister.patch uploaded by Corey Farrell
........

Merged revisions 397106 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@397107 65c4cc65-6c06-0410-ace0-fbb531ad65f3