Fix memory leaks involving tvb_get_string[z]().

svn path=/trunk/; revision=40312

10 files changed, 32 insertions, 22 deletions

diff --git a/epan/dissectors/packet-bt-dht.c b/epan/dissectors/packet-bt-dht.c
index 2ddd097da8..ed242b3f92 100644
--- a/epan/dissectors/packet-bt-dht.c
+++ b/epan/dissectors/packet-bt-dht.c
@@ -103,7 +103,7 @@ static int dissect_bencoded_string(tvbuff_t *tvb, packet_info _U_*pinfo, proto_t
   while( tvb_get_guint8(tvb,offset) != ':' )
     offset ++;
 
-  string_len = atoi( tvb_get_string(tvb,string_len_start,offset-string_len_start) );
+  string_len = atoi( tvb_get_ephemeral_string(tvb,string_len_start,offset-string_len_start) );
   /* skip the ':' */
   offset++;
 
@@ -111,7 +111,7 @@ static int dissect_bencoded_string(tvbuff_t *tvb, packet_info _U_*pinfo, proto_t
   if( tohex )
     *result = tvb_bytes_to_str(tvb, offset, string_len );
   else
-    *result = tvb_get_string( tvb, offset, string_len );
+    *result = tvb_get_ephemeral_string( tvb, offset, string_len );
 
   proto_tree_add_string_format( tree, hf_bencoded_string, tvb, offset, string_len, *result, "%s: %s", label, *result );
   offset += string_len;
@@ -134,7 +134,7 @@ static int dissect_bencoded_int(tvbuff_t *tvb, packet_info _U_*pinfo, proto_tree
   while( tvb_get_guint8(tvb,offset)!='e' )
     offset ++;
 
-  *result = tvb_get_string( tvb, offset, offset-start_offset-1 );
+  *result = tvb_get_ephemeral_string( tvb, offset, offset-start_offset-1 );
   proto_tree_add_string_format( tree, hf_bencoded_int, tvb, offset, offset-start_offset-1, *result,
     "%s: %s", label, *result );
 
@@ -240,7 +240,7 @@ static int dissect_bt_dht_values(tvbuff_t *tvb, packet_info *pinfo, proto_tree *
     while( tvb_get_guint8(tvb,offset) != ':' )
       offset ++;
 
-    string_len = atoi( tvb_get_string(tvb,string_len_start,offset-string_len_start) );
+    string_len = atoi( tvb_get_ephemeral_string(tvb,string_len_start,offset-string_len_start) );
     /* skip the ':' */
     offset++;
     /* 4 bytes ip, 2 bytes port */
@@ -293,7 +293,7 @@ static int dissect_bt_dht_nodes(tvbuff_t *tvb, packet_info *pinfo, proto_tree *t
   while( tvb_get_guint8(tvb,offset) != ':' )
     offset ++;
 
-  string_len = atoi( tvb_get_string(tvb,string_len_start,offset-string_len_start) );
+  string_len = atoi( tvb_get_ephemeral_string(tvb,string_len_start,offset-string_len_start) );
   /* skip the ':' */
   offset++;
 
diff --git a/epan/dissectors/packet-gopher.c b/epan/dissectors/packet-gopher.c
index c9719e6fdd..24e2a0fc9a 100644
--- a/epan/dissectors/packet-gopher.c
+++ b/epan/dissectors/packet-gopher.c
@@ -179,6 +179,7 @@ dissect_gopher(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {
                 name = tvb_get_string(tvb, offset + 1, sel_start - offset - 2);
                 ti = proto_tree_add_string(gopher_tree, hf_gopher_dir_item, tvb,
                                 offset, line_len + 1, name);
+                g_free(name);
                 dir_tree = proto_item_add_subtree(ti, ett_dir_item);
                 proto_tree_add_item(dir_tree, hf_gopher_di_type, tvb, offset, 1, ENC_BIG_ENDIAN);
                 proto_tree_add_item(dir_tree, hf_gopher_di_name, tvb, offset + 1,
diff --git a/epan/dissectors/packet-gsm_ipa.c b/epan/dissectors/packet-gsm_ipa.c
index 6601bc3d87..ba012a96f4 100644
--- a/epan/dissectors/packet-gsm_ipa.c
+++ b/epan/dissectors/packet-gsm_ipa.c
@@ -326,7 +326,7 @@ dissect_ipa(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 			}
 			if (global_ipa_in_info == TRUE)
 				col_append_fstr(pinfo->cinfo, COL_INFO, "%s ",
-						tvb_get_stringz(next_tvb, 0, NULL));
+						tvb_get_ephemeral_stringz(next_tvb, 0, NULL));
 			break;
 		default:
 			if (msg_type < ABISIP_RSL_MAX) {
diff --git a/epan/dissectors/packet-meta.c b/epan/dissectors/packet-meta.c
index 27517ec58f..fff99ba498 100644
--- a/epan/dissectors/packet-meta.c
+++ b/epan/dissectors/packet-meta.c
@@ -292,6 +292,7 @@ static guint16 evaluate_meta_item_dxt(proto_tree *meta_tree, tvbuff_t *tvb, pack
             apn = tvb_get_string(tvb, offs, len);
             proto_tree_add_string(meta_tree, hf_meta_item_apn, tvb,
                 offs, len, apn);
+            g_free(apn);
             break;
         case META_ID_RAT:
             rat = tvb_get_guint8(tvb, offs);
@@ -369,11 +370,13 @@ static guint16 evaluate_meta_item_dxt(proto_tree *meta_tree, tvbuff_t *tvb, pack
             calling = tvb_get_string(tvb, offs, len);
             proto_tree_add_string(meta_tree, hf_meta_item_calling, tvb,
                 offs, len, calling);
+            g_free(calling);
             break;
         case META_ID_CALLED:
             called = tvb_get_string(tvb, offs, len);
             proto_tree_add_string(meta_tree, hf_meta_item_called, tvb,
                 offs, len, called);
+            g_free(called);
             break;
         default:
             subti = proto_tree_add_item(meta_tree, hf_meta_item, tvb, offs - 4,
diff --git a/epan/dissectors/packet-mux27010.c b/epan/dissectors/packet-mux27010.c
index d364ea4690..131aa0b752 100644
--- a/epan/dissectors/packet-mux27010.c
+++ b/epan/dissectors/packet-mux27010.c
@@ -248,8 +248,6 @@ static char colDestText[256];
 static char colSourceText[256];
 static char frameTypeText[64];
 
-static char information_field_content[256];
-static char *information_field;
 static char dlci_char[3];
 
 static guint8 i = 0;
@@ -741,7 +739,7 @@ getControlChannelValues(tvbuff_t *tvb, proto_tree *field_tree_ctr){
         if (controlchannel_iei == MUX27010_VALUE_CONTROLCHANNEL_TEST_IEI_MS){
             proto_tree_add_uint_format(field_tree_ctr, hf_mux27010_controlchannelvalue, tvb, offset, 1, controlchannel_value, "IEI coding: MSMUX_VERSION");
         }
-        proto_tree_add_uint_format(field_tree_ctr, hf_mux27010_controlchannelvalue, tvb, offset+1, controlchannel_length_value-1, controlchannel_value, "Value (ASCII): %s", tvb_get_string(tvb, offset+1,controlchannel_length_value-1));
+        proto_tree_add_uint_format(field_tree_ctr, hf_mux27010_controlchannelvalue, tvb, offset+1, controlchannel_length_value-1, controlchannel_value, "Value (ASCII): %s", tvb_get_ephemeral_string(tvb, offset+1,controlchannel_length_value-1));
     }
 
     /*Command pattern for Power saving control (C/R is set to 1)*/
@@ -798,14 +796,17 @@ getControlChannelValues(tvbuff_t *tvb, proto_tree *field_tree_ctr){
 /*Get values information field*/
 static void
 getFrameInformation(tvbuff_t *tvb, proto_tree *field_tree){
+    char information_field_content[52];
+    char *information_field, *save_information_field_ptr;
 
     /*Get the data from information field as string*/
     information_field = tvb_get_string(tvb,offset,length_info);
+    save_information_field_ptr = information_field;
     tmp = 0;
 
     /*Copy data from buffer to local array information_field_content*/
     /*and delete unneeded signs out of info field -> for info column: CR (0x0d) and LF (0x0a)*/
-    for (i = 0; i<length_info && i<=50; i++) {
+    for (i = 0; i<length_info && i<(sizeof(information_field_content)-1); i++) {
         /*Check every sign in information field for CR and LF*/
         if (*information_field != 0x0a && *information_field != 0x0d){
             /*Copy char to array*/
@@ -826,10 +827,11 @@ getFrameInformation(tvbuff_t *tvb, proto_tree *field_tree){
     g_snprintf(colInfoText,sizeof(colInfoText),"%s %s", colInfoText, information_field_content);
 
     /*Get pointer to begin of buffer again*/
-    information_field = tvb_get_string(tvb,offset,length_info);
+    information_field = save_information_field_ptr;
 
     /*Add info to subtree*/
     proto_tree_add_uint_format(field_tree, hf_mux27010_information, tvb, offset, length_info, controlchannel_type_command, "Information: %s",information_field);
+    g_free(information_field);
 
     /*Increment offset by the length of chars in info field*/
     offset +=length_info;
diff --git a/epan/dissectors/packet-nfs.c b/epan/dissectors/packet-nfs.c
index fabdeef936..48044d7a19 100644
--- a/epan/dissectors/packet-nfs.c
+++ b/epan/dissectors/packet-nfs.c
@@ -2353,6 +2353,7 @@ dissect_fhandle_data(tvbuff_t *tvb, int offset, packet_info *pinfo,
 
 		fh_array = tvb_get_string(tvb, offset, fhlen);
 		fhhash = crc32_ccitt(fh_array, fhlen);
+		g_free(fh_array);
 
 		if(hidden){
 			fh_item=proto_tree_add_uint(tree, hf_nfs_fh_hash, NULL, 0,
@@ -8288,6 +8289,7 @@ dissect_nfs_stateid4(tvbuff_t *tvb, int offset,
 
 	sidh_array = tvb_get_string(tvb, offset, 16);
 	sid_hash = crc16_ccitt(sidh_array, 16);
+	g_free(sidh_array);
 
 	sh_item=proto_tree_add_uint(newftree, hf_nfs_stateid4_hash, tvb, offset,
 									+		16, sid_hash);
@@ -9357,6 +9359,7 @@ dissect_nfs_argop4(tvbuff_t *tvb, int offset, packet_info *pinfo,
 		case NFS4_OP_RENEW:
 			clientid_array = tvb_get_string(tvb, offset, 8);
 			clientid_hash = crc16_ccitt(clientid_array, 8);
+			g_free(clientid_array);
 			offset = dissect_rpc_uint64(tvb, newftree, hf_nfs_clientid4, offset);
 			g_string_append_printf (op_summary[ops_counter].optext, " CID: 0x%04x", clientid_hash);
 
diff --git a/epan/dissectors/packet-rdp.c b/epan/dissectors/packet-rdp.c
index c628a6cdf5..d0e71e7e02 100644
--- a/epan/dissectors/packet-rdp.c
+++ b/epan/dissectors/packet-rdp.c
@@ -940,21 +940,21 @@ dissect_rdp_clientNetworkData(tvbuff_t *tvb, int offset, packet_info *pinfo, pro
     next_tree = proto_item_add_subtree(pi, ett_rdp_channelDefArray);
 
     if(rdp_info)
-      rdp_info->maxChannels = channelCount;
+      rdp_info->maxChannels = min(channelCount, MAX_CHANNELS);
 
-    for(i = 0; i < channelCount; i++) {
+    for(i = 0; i < min(channelCount, MAX_CHANNELS); i++) {
       if(rdp_info) {
-	rdp_info->channels[i].strptr = tvb_get_string(tvb, offset, 8);
-	rdp_info->channels[i].value = -1; /* unset */
+        rdp_info->channels[i].value = -1; /* unset */
+        rdp_info->channels[i].strptr = tvb_get_ephemeral_string(tvb, offset, 8);
       }
       offset = dissect_rdp_fields(tvb, offset, pinfo, next_tree, def_fields);
     }
 
     if(rdp_info) {
+      /* value_strings are normally terminated with a {0, NULL} entry */
+      rdp_info->channels[i].value = 0;
       rdp_info->channels[i].strptr = NULL;
-      rdp_info->channels[i].value = -1;
     }
-
   }
 
   return offset;
diff --git a/epan/dissectors/packet-sametime.c b/epan/dissectors/packet-sametime.c
index 7cef0821ec..7e91435e99 100644
--- a/epan/dissectors/packet-sametime.c
+++ b/epan/dissectors/packet-sametime.c
@@ -236,7 +236,7 @@ add_text_item(tvbuff_t *tvb, proto_tree *tree, int offset, int hf)
 			proto_tree_add_item(tree, hf_sametime_field_length, tvb, offset, 2, ENC_BIG_ENDIAN);
 
 		/* add string */
-		proto_tree_add_string(tree, hf, tvb, offset + 2, length, tvb_get_string(tvb, offset + 2, length));
+		proto_tree_add_string(tree, hf, tvb, offset + 2, length, tvb_get_ephemeral_string(tvb, offset + 2, length));
 	}
 
 	return 2 + length;
diff --git a/epan/dissectors/packet-ua.c b/epan/dissectors/packet-ua.c
index 132abb80e5..5a4d650845 100644
--- a/epan/dissectors/packet-ua.c
+++ b/epan/dissectors/packet-ua.c
@@ -647,18 +647,18 @@ static void DissectTLV_data(tvbuff_t *pTvb, proto_tree *pTlv, guint8 u8Property)
     case 55: /*Label*/
     case 138: /*Label_138*/
         {
-            proto_item_append_text(pTlv, "'%s'", tvb_get_string(pTvb, 0, tvb_length(pTvb)));
+            proto_item_append_text(pTlv, "'%s'", tvb_get_ephemeral_string(pTvb, 0, tvb_length(pTvb)));
             proto_tree_add_item(pTlv, hf_tlv_label, pTvb, 0, -1, ENC_ASCII|ENC_NA);
 
             /* append text on NOE level */
             pNoeItem = proto_item_get_parent(pTlv);
-            proto_item_append_text(pNoeItem, ", Label='%s'", tvb_get_string(pTvb, 0, tvb_length(pTvb)));
+            proto_item_append_text(pNoeItem, ", Label='%s'", tvb_get_ephemeral_string(pTvb, 0, tvb_length(pTvb)));
             break;
         }
 
     case 143: /*Phone number*/
         {
-            proto_item_append_text(pTlv, "%s", tvb_get_string(pTvb, 0, tvb_length(pTvb)));
+            proto_item_append_text(pTlv, "%s", tvb_get_ephemeral_string(pTvb, 0, tvb_length(pTvb)));
             proto_tree_add_item(pTlv, hf_tlv_number, pTvb, 0, -1, ENC_NA);
             break;
         }
@@ -666,7 +666,7 @@ static void DissectTLV_data(tvbuff_t *pTvb, proto_tree *pTlv, guint8 u8Property)
     case 147: /*Today*/
     case 148: /*Tomorrow*/
         {
-            proto_item_append_text(pTlv, "'%s'", tvb_get_string(pTvb, 0, tvb_length(pTvb)));
+            proto_item_append_text(pTlv, "'%s'", tvb_get_ephemeral_string(pTvb, 0, tvb_length(pTvb)));
             proto_tree_add_item(pTlv, hf_tlv_data, pTvb, 0, -1, ENC_NA);
             break;
         }
diff --git a/epan/dissectors/packet-xtp.c b/epan/dissectors/packet-xtp.c
index 9fc0553e9b..2b38846c91 100644
--- a/epan/dissectors/packet-xtp.c
+++ b/epan/dissectors/packet-xtp.c
@@ -905,6 +905,7 @@ dissect_xtp_diag(tvbuff_t *tvb, proto_tree *tree, guint32 offset) {
 	/* message(4) */
 	proto_tree_add_string(xtp_subtree, hf_xtp_diag_msg,
 			tvb, offset, msg_len, diag->msg);
+	g_free(diag->msg);
 
 	return;
 }