Fix pktvar and http uri memory leaks.

src/decode.h

@@ -307,8 +307,10 @@ typedef struct _PacketQueue {
     (p)->flow = NULL; \
     (p)->flowflags = 0; \
     (p)->alerts.cnt = 0; \
-    (p)->http_uri.cnt = 0; \
-    PktVarFree((p)->pktvar); \
+    PktHttpUriFree((p)); \
+    if ((p)->pktvar != NULL) { \
+        PktVarFree((p)->pktvar); \
+    } \
     (p)->pktvar = NULL; \
     (p)->recursion_level = 0; \
 }

src/detect-uricontent.c

@@ -67,6 +67,16 @@ u_int32_t DetectUricontentMaxId(DetectEngineCtx *de_ctx) {
     return de_ctx->uricontent_max_id;
 }
 
+void PktHttpUriFree(Packet *p) {
+    int i;
+
+    for (i = 0; i < p->http_uri.cnt; i++) {
+        free(p->http_uri.raw[i]);
+        p->http_uri.raw[i] = NULL;
+    }
+    p->http_uri.cnt = 0;
+}
+
 /* Normalize http buffer
  *
  * Returns 0: on ok

src/detect.c

@@ -2531,6 +2531,7 @@ int SigGroupBuild (DetectEngineCtx *de_ctx) {
     SigAddressPrepareStage1(de_ctx);
     SigAddressPrepareStage2(de_ctx);
     SigAddressPrepareStage3(de_ctx);
+//abort();
 //    SigAddressPrepareStage5();
     DbgPrintScanSearchStats();
 //    DetectAddressGroupPrintMemory();

src/pkt-var.c

@@ -70,9 +70,14 @@ void PktVarFree(PktVar *pv) {
         return;
 
     pv->name = NULL;
-    if (pv->value) free(pv->value);
+    if (pv->value != NULL)
+        free(pv->value);
+    PktVar *pv_next = pv->next;
+
+    free(pv);
 
-    if (pv->next) PktVarFree(pv->next);
+    if (pv_next != NULL)
+        PktVarFree(pv_next);
 }
 
 void PktVarPrint(PktVar *pv) {

src/tmqh-packetpool.c

@@ -7,6 +7,8 @@
 
 #include "tm-queuehandlers.h"
 
+#include "pkt-var.h"
+
 Packet *TmqhInputPacketpool(ThreadVars *t);
 void TmqhOutputPacketpool(ThreadVars *t, Packet *p);
 
@@ -90,8 +92,15 @@ void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
         //printf("TmqhOutputPacketpool: tunnel stuff done, move on\n");
     }
 
+    if (proot) {
+        CLEAR_PACKET(p->root);
+    }
+    CLEAR_PACKET(p);
+
     mutex_lock(&q->mutex_q);
-    if (proot) PacketEnqueue(q, p->root);
+    if (proot) {
+        PacketEnqueue(q, p->root);
+    }
     PacketEnqueue(q, p);
     mutex_unlock(&q->mutex_q);
 

src/vips.c

@@ -91,32 +91,23 @@ setup_signal_handler(int sig, void (*handler)())
 Packet *SetupPkt (void)
 {
     Packet *p = NULL;
-//    do {
-        mutex_lock(&packet_q.mutex_q);
-        p = PacketDequeue(&packet_q);
-        mutex_unlock(&packet_q.mutex_q);
-
-        if (p == NULL) {
-            p = malloc(sizeof(Packet));
-            if (p == NULL) {
-                printf("ERROR: malloc failed: %s\n", strerror(errno));
-                exit(1);
-            }
 
-            p->pktvar = NULL;
-            CLEAR_TCP_PACKET(p);
+    mutex_lock(&packet_q.mutex_q);
+    p = PacketDequeue(&packet_q);
+    mutex_unlock(&packet_q.mutex_q);
 
-            //TmqDebugList();
-            //usleep(1000); /* sleep 1ms */
+    if (p == NULL) {
+        p = malloc(sizeof(Packet));
+        if (p == NULL) {
+            printf("ERROR: malloc failed: %s\n", strerror(errno));
+            exit(1);
+        }
 
-            /* XXX check for recv'd signals, so
-             * we can exit on signals received */
+        memset(p, 0, sizeof(Packet));
 
-            printf("SetupPkt: allocated a new packet...\n");
-        }
-//    } while (p == NULL);
+        printf("SetupPkt: allocated a new packet...\n");
+    }
 
-    CLEAR_PACKET(p);
     return p;
 }
 
@@ -148,8 +139,6 @@ Packet *TunnelPktSetup(ThreadVars *t, Packet *parent, u_int8_t *pkt, u_int16_t l
 #endif /* DBG_PERF */
     mutex_unlock(&mutex_pending);
 
-    CLEAR_PACKET(p);
-
     /* set the root ptr to the lowest layer */
     if (parent->root != NULL)
         p->root = parent->root;
@@ -247,10 +236,7 @@ int main(int argc, char **argv)
             printf("ERROR: malloc failed: %s\n", strerror(errno));
             exit(1);
         }
-
-        p->pktvar = NULL;
-        CLEAR_TCP_PACKET(p);
-        CLEAR_PACKET(p);
+        memset(p, 0, sizeof(Packet));
 
         PacketEnqueue(&packet_q,p);
     }