(closes issue #11903)

Reported by: atis

Many thanks to atis for spotting this problem and reporting it.
The fix was to straighten out how items are placed on and removed
from the file stack. Regressions as well as the provided test case
helped to straighten out all code paths. valgrind was used to make
sure all memory allocated was freed.

Sorry for not solving this earlier. I got distracted.

Added the ntest23 regression test, which is mainly a copy of ntest22, 
but with a few juicy errors thrown in, to replicate the kind of 
error that atis spotted.




git-svn-id: http://svn.digium.com/svn/asterisk/branches/1.4@109309 f38db490-d61c-443f-a65b-d21fe96a405b

1 files changed, 14 insertions, 12 deletions

diff --git a/pbx/ael/ael_lex.c b/pbx/ael/ael_lex.c
index 09199ab4f..708387829 100644
--- a/pbx/ael/ael_lex.c
+++ b/pbx/ael/ael_lex.c
@@ -1735,8 +1735,6 @@ case YY_STATE_EOF(comment):
 {
 		char fnamebuf[2048];
 		if (include_stack_index > 0 && include_stack[include_stack_index-1].globbuf_pos < include_stack[include_stack_index-1].globbuf.gl_pathc-1) {
-			free(my_file);
-			my_file = 0;
 			ael_yy_delete_buffer(YY_CURRENT_BUFFER,yyscanner );
 			include_stack[include_stack_index-1].globbuf_pos++;
 			setup_filestack(fnamebuf, sizeof(fnamebuf), &include_stack[include_stack_index-1].globbuf, include_stack[include_stack_index-1].globbuf_pos, yyscanner, 0);
@@ -1747,13 +1745,13 @@ case YY_STATE_EOF(comment):
 				free(include_stack[include_stack_index].fname);
 				include_stack[include_stack_index].fname = 0;
 			}
+			if (my_file) {
+				free(my_file);
+				my_file = 0;
+			}
 			if ( --include_stack_index < 0 ) {
 				yyterminate();
 			} else {
-				if (my_file) {
-					free(my_file);
-					my_file = 0;
-				}
 				globfree(&include_stack[include_stack_index].globbuf);
 				include_stack[include_stack_index].globbuf_pos = -1;
 				
@@ -1768,10 +1766,10 @@ case YY_STATE_EOF(comment):
 	YY_BREAK
 case 62:
 YY_RULE_SETUP
-#line 472 "ael.flex"
+#line 470 "ael.flex"
 ECHO;
 	YY_BREAK
-#line 1774 "ael_lex.c"
+#line 1772 "ael_lex.c"
 
 	case YY_END_OF_BUFFER:
 		{
@@ -2896,7 +2894,7 @@ void *ael_yyrealloc  (void * ptr, yy_size_t  size , yyscan_t yyscanner)
 
 #define YYTABLES_NAME "yytables"
 
-#line 472 "ael.flex"
+#line 470 "ael.flex"
 
 
 
@@ -3092,12 +3090,16 @@ static void setup_filestack(char *fnamebuf2, int fnamebuf_siz, glob_t *globbuf,
 			buffer[stats.st_size] = 0;
 			ast_log(LOG_NOTICE,"  --Read in included file %s, %d chars\n",fnamebuf2, (int)stats.st_size);
 			fclose(in1);
-			if (my_file)
-				free(my_file);
-			my_file = strdup(fnamebuf2);
+			if (include_stack[include_stack_index].fname) {
+			   	free(include_stack[include_stack_index].fname);
+				include_stack[include_stack_index].fname = 0;
+			}
 			include_stack[include_stack_index].fname = strdup(my_file);
 			include_stack[include_stack_index].lineno = my_lineno;
 			include_stack[include_stack_index].colno = my_col+yyleng;
+			if (my_file)
+				free(my_file);
+			my_file = strdup(fnamebuf2);
 			if (create)
 				include_stack[include_stack_index].globbuf = *globbuf;