Use address_to_str(NULL, ...) for strings allocated outside dissectors.

ep_address_to_str() doesn't crash if called outside packet scope, but
it's still not correct to use outside packet scope.  Use
address_to_str(NULL, ...) to allocate those strings, and then explicitly
free them when we're done; exceptions don't get thrown between the
allocate and free, so there's no risk of a leak.

Change-Id: Iea2af93b0757e648d399e2ba64249224eb7e9e3c
Reviewed-on: https://code.wireshark.org/review/2438
Reviewed-by: Guy Harris <guy@alum.mit.edu>

6 files changed, 81 insertions, 24 deletions

diff --git a/epan/dissectors/packet-bacapp.c b/epan/dissectors/packet-bacapp.c
index 451c4dc130..91c913df1a 100644
--- a/epan/dissectors/packet-bacapp.c
+++ b/epan/dissectors/packet-bacapp.c
@@ -4821,6 +4821,17 @@ bacapp_packet_stats_tree_init(stats_tree* st)
     st_node_packets_by_ip_dst = stats_tree_create_node(st, st_str_packets_by_ip_dst, st_node_packets_by_ip, TRUE);
 }
 
+static gchar *
+bacapp_get_address_label(const char *tag, address *addr)
+{
+    gchar *addr_str, *label_str;
+
+    addr_str = address_to_str(NULL, addr);
+    label_str = wmem_strconcat(NULL, tag, addr_str, NULL);
+    wmem_free(NULL, addr_str);
+    return label_str;
+}
+
 static int
 bacapp_stats_tree_packet(stats_tree* st, packet_info* pinfo, epan_dissect_t* edt _U_, const void* p)
 {
@@ -4838,8 +4849,8 @@ bacapp_stats_tree_packet(stats_tree* st, packet_info* pinfo, epan_dissect_t* edt
     gchar *srcstr;
     const bacapp_info_value_t *binfo = (const bacapp_info_value_t *)p;
 
-    srcstr = wmem_strconcat(wmem_packet_scope(), "Src: ", ep_address_to_str(&pinfo->src), NULL);
-    dststr = wmem_strconcat(wmem_packet_scope(), "Dst: ", ep_address_to_str(&pinfo->dst), NULL);
+    srcstr = bacapp_get_address_label("Src: ", &pinfo->src);
+    dststr = bacapp_get_address_label("Dst: ", &pinfo->dst);
 
     tick_stat_node(st, st_str_packets_by_ip, 0, TRUE);
     packets_for_this_dst = tick_stat_node(st, st_str_packets_by_ip_dst, st_node_packets_by_ip, TRUE);
@@ -4859,6 +4870,9 @@ bacapp_stats_tree_packet(stats_tree* st, packet_info* pinfo, epan_dissect_t* edt
         }
     }
 
+    wmem_free(NULL, srcstr);
+    wmem_free(NULL, dststr);
+
     return 1;
 }
 
@@ -4884,8 +4898,8 @@ bacapp_stats_tree_service(stats_tree* st, packet_info* pinfo, epan_dissect_t* ed
 
     const bacapp_info_value_t *binfo = (const bacapp_info_value_t *)p;
 
-    srcstr = wmem_strconcat(wmem_packet_scope(), "Src: ", ep_address_to_str(&pinfo->src), NULL);
-    dststr = wmem_strconcat(wmem_packet_scope(), "Dst: ", ep_address_to_str(&pinfo->dst), NULL);
+    srcstr = bacapp_get_address_label("Src: ", &pinfo->src);
+    dststr = bacapp_get_address_label("Dst: ", &pinfo->dst);
 
     tick_stat_node(st, st_str_packets_by_service, 0, TRUE);
     if (binfo->service_type) {
@@ -4898,6 +4912,9 @@ bacapp_stats_tree_service(stats_tree* st, packet_info* pinfo, epan_dissect_t* ed
         }
     }
 
+    wmem_free(NULL, srcstr);
+    wmem_free(NULL, dststr);
+
     return 1;
 }
 
@@ -4922,8 +4939,8 @@ bacapp_stats_tree_objectid(stats_tree* st, packet_info* pinfo, epan_dissect_t* e
     gchar *srcstr;
     const bacapp_info_value_t *binfo = (const bacapp_info_value_t *)p;
 
-    srcstr = wmem_strconcat(wmem_packet_scope(), "Src: ", ep_address_to_str(&pinfo->src), NULL);
-    dststr = wmem_strconcat(wmem_packet_scope(), "Dst: ", ep_address_to_str(&pinfo->dst), NULL);
+    srcstr = bacapp_get_address_label("Src: ", &pinfo->src);
+    dststr = bacapp_get_address_label("Dst: ", &pinfo->dst);
 
     tick_stat_node(st, st_str_packets_by_objectid, 0, TRUE);
     if (binfo->object_ident) {
@@ -4936,6 +4953,9 @@ bacapp_stats_tree_objectid(stats_tree* st, packet_info* pinfo, epan_dissect_t* e
         }
     }
 
+    wmem_free(NULL, srcstr);
+    wmem_free(NULL, dststr);
+
     return 1;
 }
 
@@ -4960,8 +4980,8 @@ bacapp_stats_tree_instanceid(stats_tree* st, packet_info* pinfo, epan_dissect_t*
     gchar *srcstr;
     const bacapp_info_value_t *binfo = (const bacapp_info_value_t *)p;
 
-    srcstr = wmem_strconcat(wmem_packet_scope(), "Src: ", ep_address_to_str(&pinfo->src), NULL);
-    dststr = wmem_strconcat(wmem_packet_scope(), "Dst: ", ep_address_to_str(&pinfo->dst), NULL);
+    srcstr = bacapp_get_address_label("Src: ", &pinfo->src);
+    dststr = bacapp_get_address_label("Dst: ", &pinfo->dst);
 
     tick_stat_node(st, st_str_packets_by_instanceid, 0, TRUE);
     if (binfo->object_ident) {
@@ -4973,6 +4993,10 @@ bacapp_stats_tree_instanceid(stats_tree* st, packet_info* pinfo, epan_dissect_t*
             tick_stat_node(st, binfo->object_ident, servicetype, FALSE);
         }
     }
+
+    wmem_free(NULL, srcstr);
+    wmem_free(NULL, dststr);
+
     return 1;
 }
 
diff --git a/epan/dissectors/packet-http.c b/epan/dissectors/packet-http.c
index 13abd2c9d1..58978279fc 100644
--- a/epan/dissectors/packet-http.c
+++ b/epan/dissectors/packet-http.c
@@ -415,7 +415,7 @@ http_reqs_stats_tree_packet(stats_tree* st, packet_info* pinfo, epan_dissect_t*
 
 
 	if (v->request_method) {
-		ip_str = ep_address_to_str(&pinfo->dst);
+		ip_str = address_to_str(NULL, &pinfo->dst);
 
 		tick_stat_node(st, st_str_reqs, 0, FALSE);
 		tick_stat_node(st, st_str_reqs_by_srv_addr, st_node_reqs, TRUE);
@@ -429,10 +429,12 @@ http_reqs_stats_tree_packet(stats_tree* st, packet_info* pinfo, epan_dissect_t*
 			tick_stat_node(st, v->http_host, reqs_by_this_addr, FALSE);
 		}
 
+		wmem_free(NULL, ip_str);
+
 		return 1;
 
 	} else if (i != 0) {
-		ip_str = ep_address_to_str(&pinfo->src);
+		ip_str = address_to_str(NULL, &pinfo->src);
 
 		tick_stat_node(st, st_str_resps_by_srv_addr, 0, FALSE);
 		resps_by_this_addr = tick_stat_node(st, ip_str, st_node_resps_by_srv_addr, TRUE);
@@ -443,6 +445,8 @@ http_reqs_stats_tree_packet(stats_tree* st, packet_info* pinfo, epan_dissect_t*
 			tick_stat_node(st, "KO", resps_by_this_addr, FALSE);
 		}
 
+		wmem_free(NULL, ip_str);
+
 		return 1;
 	}
 
diff --git a/epan/dissectors/packet-iax2.c b/epan/dissectors/packet-iax2.c
index dd60ab58b3..1a14bfb50b 100644
--- a/epan/dissectors/packet-iax2.c
+++ b/epan/dissectors/packet-iax2.c
@@ -597,7 +597,9 @@ static guint circuitcount = 0;
 static gchar *key_to_str( const iax_circuit_key *key )
 {
   static int    i = 0;
-  static gchar *strp, str[3][80];
+  static gchar  str[3][80];
+  gchar        *strp;
+  gchar        *addrstr;
 
   i++;
   if (i >= 3) {
@@ -608,11 +610,12 @@ static gchar *key_to_str( const iax_circuit_key *key )
   /* why doesn't ep_address_to_str take a const pointer?
      cast the warnings into oblivion. */
 
-  /* XXX - is this a case for wmem_packet_scope()? */
+  addrstr = address_to_str(NULL, (address *)&key->addr)
   g_snprintf(strp, 80, "{%s:%i,%i}",
-             ep_address_to_str((address *)&key->addr),
+             addrstr,
              key->port,
              key->callno);
+  wmem_free(NULL, addrstr);
   return strp;
 }
 #endif
@@ -928,12 +931,19 @@ static iax_call_data *iax_lookup_call( packet_info *pinfo,
   gboolean       reversed = FALSE;
   iax_call_data *iax_call = NULL;
   guint          src_circuit_id;
+#ifdef DEBUG_HASHING
+  gchar         *srcstr, *dststr;
+#endif
 
 #ifdef DEBUG_HASHING
+  srcstr = address_to_str(NULL, &pinfo->src);
+  dststr = address_to_str(NULL, &pinfo->dst);
   g_debug("++ iax_lookup_circuit_details: Looking up circuit for frame %u, "
           "from {%s:%u:%u} to {%s:%u:%u}", pinfo->fd->num,
-          ep_address_to_str(&pinfo->src), pinfo->srcport, scallno,
-          ep_address_to_str(&pinfo->dst), pinfo->destport, dcallno);
+          srcstr, pinfo->srcport, scallno,
+          dststr, pinfo->destport, dcallno);
+  wmem_free(NULL, srcstr);
+  wmem_free(NULL, dststr);
 #endif
 
 
diff --git a/epan/dissectors/packet-isup.c b/epan/dissectors/packet-isup.c
index ac62d15fc3..6cfc6a4b9f 100644
--- a/epan/dissectors/packet-isup.c
+++ b/epan/dissectors/packet-isup.c
@@ -10889,11 +10889,15 @@ static int
 msg_stats_tree_packet(stats_tree *st, packet_info *pinfo, epan_dissect_t *edt _U_, const void *p)
 {
   const gchar *msg = try_val_to_str_ext(((const isup_tap_rec_t*)p)->message_type, &isup_message_type_value_acro_ext);
-  gchar       *dir;
+  gchar       *src, *dst, *dir;
   int          msg_node;
   int          dir_node;
 
-  dir = wmem_strdup_printf(wmem_packet_scope(), "%s->%s", ep_address_to_str(&pinfo->src), ep_address_to_str(&pinfo->dst));
+  src = address_to_str(NULL, &pinfo->src);
+  dst = address_to_str(NULL, &pinfo->dst);
+  dir = wmem_strdup_printf(NULL, "%s->%s", src, dst);
+  wmem_free(NULL, src);
+  wmem_free(NULL, dst);
 
   msg_node = tick_stat_node(st, msg, st_node_msg, TRUE);
   tick_stat_node(st, dir, msg_node, FALSE);
@@ -10901,6 +10905,8 @@ msg_stats_tree_packet(stats_tree *st, packet_info *pinfo, epan_dissect_t *edt _U
   dir_node = tick_stat_node(st, dir, st_node_dir, TRUE);
   tick_stat_node(st, msg, dir_node, FALSE);
 
+  wmem_free(NULL, dir);
+
   return 1;
 }
 
diff --git a/epan/dissectors/packet-ssl-utils.c b/epan/dissectors/packet-ssl-utils.c
index a5a65c1039..fa1eec49fa 100644
--- a/epan/dissectors/packet-ssl-utils.c
+++ b/epan/dissectors/packet-ssl-utils.c
@@ -3669,6 +3669,7 @@ ssl_find_private_key(SslDecryptSession *ssl_session, GHashTable *key_hash, GTree
     SslService dummy;
     char       ip_addr_any[] = {0,0,0,0};
     guint32    port    = 0;
+    gchar     *addr_string;
     Ssl_private_key_t * private_key;
 
     if (!ssl_session) {
@@ -3683,8 +3684,10 @@ ssl_find_private_key(SslDecryptSession *ssl_session, GHashTable *key_hash, GTree
         dummy.addr = pinfo->dst;
         dummy.port = port = pinfo->destport;
     }
+    addr_string = address_to_str(NULL, &dummy.addr);
     ssl_debug_printf("ssl_find_private_key server %s:%u\n",
-                     ep_address_to_str(&dummy.addr),dummy.port);
+                     addr_string, dummy.port);
+    wmem_free(NULL, addr_string);
 
     if (g_hash_table_size(key_hash) == 0) {
         ssl_debug_printf("ssl_find_private_key: no keys found\n");
@@ -4169,6 +4172,7 @@ ssl_parse_key_list(const ssldecrypt_assoc_t * uats, GHashTable *key_hash, GTree*
     guint32            addr_data[4];
     int                addr_len, at;
     address_type addr_type[2] = { AT_IPv4, AT_IPv6 };
+    gchar*             address_string;
 
     /* try to load keys file first */
     fp = ws_fopen(uats->keyfile, "rb");
@@ -4233,10 +4237,15 @@ ssl_parse_key_list(const ssldecrypt_assoc_t * uats, GHashTable *key_hash, GTree*
             service->port = atoi(uats->port);
         }
 
-
+        /*
+         * This gets called outside any dissection scope, so we have to
+         * use a NULL scope and free it ourselves.
+         */
+        address_string = address_to_str(NULL, &service->addr);
         ssl_debug_printf("ssl_init %s addr '%s' (%s) port '%d' filename '%s' password(only for p12 file) '%s'\n",
-            (addr_type[at] == AT_IPv4) ? "IPv4" : "IPv6", uats->ipaddr, ep_address_to_str(&service->addr),
+            (addr_type[at] == AT_IPv4) ? "IPv4" : "IPv6", uats->ipaddr, address_string,
             service->port, uats->keyfile, uats->password);
+        wmem_free(NULL, address_string);
 
         ssl_debug_printf("ssl_init private key file %s successfully loaded.\n", uats->keyfile);
 
diff --git a/epan/dissectors/packet-tacacs.c b/epan/dissectors/packet-tacacs.c
index e663c72997..7d133a8a60 100644
--- a/epan/dissectors/packet-tacacs.c
+++ b/epan/dissectors/packet-tacacs.c
@@ -748,13 +748,17 @@ static void
 tacplus_print_key_entry( gpointer data, gpointer user_data )
 {
 	tacplus_key_entry *tacplus_data=(tacplus_key_entry *)data;
+	gchar *s_str, *c_str;
+
+	s_str = address_to_str( NULL, tacplus_data->s );
+	c_str = address_to_str( NULL, tacplus_data->c );
 	if( user_data ) {
-		printf("%s:%s=%s\n", ep_address_to_str( tacplus_data->s ),
-				ep_address_to_str( tacplus_data->c ), tacplus_data->k );
+		printf("%s:%s=%s\n", s_str, c_str, tacplus_data->k );
 	} else {
-		printf("%s:%s\n", ep_address_to_str( tacplus_data->s ),
-				ep_address_to_str( tacplus_data->c ) );
+		printf("%s:%s\n", s_str, c_str );
 	}
+	wmem_free(NULL, s_str);
+	wmem_free(NULL, c_str);
 }
 #endif
 static int