jsonrpc, rtpengine, aaa_diameter, janus: fix cJSON NULL derefs and memory leaks

modules/aaa_diameter/dm_impl.c

@@ -576,7 +576,12 @@ static int dm_receive_req(struct msg **_req, struct avp * avp, struct session *
 		}
 	}
 
-	init_str(&avp_arr, cJSON_PrintUnformatted(avps));
+	avp_arr.s = cJSON_PrintUnformatted(avps);
+	if (!avp_arr.s) {
+		LM_ERR("cJSON_PrintUnformatted failed\n");
+		goto error;
+	}
+	avp_arr.len = strlen(avp_arr.s);
 
 	/* keep the request for a while in order to be able to generate the answer */
 	if (!dm_server_autoreply_error)

modules/janus/janus_common.c

@@ -229,24 +229,40 @@ int populate_janus_handler_id(janus_connection *conn, cJSON *request)
 	aux = cJSON_GetObjectItem(request, "janus");
 	if (aux == NULL || aux->type != cJSON_String ||
 	(reply_status.s = aux->valuestring) == NULL) {
-		LM_ERR("Unexpected JANUS reply received - %s\n",cJSON_Print(request));
+		char *dbg = cJSON_Print(request);
+		LM_ERR("Unexpected JANUS reply received - %s\n",
+				dbg ? dbg : "(null)");
+		if (dbg)
+			pkg_free(dbg);
 		return -1;
 	}
 
 	if (memcmp(reply_status.s,"success",7) != 0) {
-		LM_ERR("non-succesful JANUS reply received - %s\n",cJSON_Print(request));
+		char *dbg = cJSON_Print(request);
+		LM_ERR("non-succesful JANUS reply received - %s\n",
+				dbg ? dbg : "(null)");
+		if (dbg)
+			pkg_free(dbg);
 		return -1;
 	}
 
 	aux = cJSON_GetObjectItem(request, "data");
 	if (aux == NULL || aux->type != cJSON_Object) {
-		LM_ERR("Unexpected JANUS reply received, no data in %s\n",cJSON_Print(request));
+		char *dbg = cJSON_Print(request);
+		LM_ERR("Unexpected JANUS reply received, no data in %s\n",
+				dbg ? dbg : "(null)");
+		if (dbg)
+			pkg_free(dbg);
 		return -1;
 	}
 
 	aux2 = cJSON_GetObjectItem(aux, "id");
 	if (aux2 == NULL || aux2->type != cJSON_Number) {
-		LM_ERR("Unexpected JANUS reply received, id is not number %s\n",cJSON_Print(request));
+		char *dbg = cJSON_Print(request);
+		LM_ERR("Unexpected JANUS reply received, id is not number %s\n",
+				dbg ? dbg : "(null)");
+		if (dbg)
+			pkg_free(dbg);
 		return -1;
 	}
 

modules/jsonrpc/jsonrpc.c

@@ -342,6 +342,11 @@ static int jsonrpc_handle_cmd(union sockaddr_union *dst, char *cmd, int *id,
 	if (aux && aux->type!=cJSON_NULL) {
 		/* return the entire error */
 		vret->rs.s = cJSON_Print(aux);
+		if (!vret->rs.s) {
+			LM_ERR("cJSON_Print failed\n");
+			ret = -2;
+			goto end;
+		}
 		vret->rs.len = strlen(vret->rs.s);
 		vret->flags = PV_VAL_STR;
 		LM_DBG("Error got from JSON-RPC: %s!\n", buffer);
@@ -361,12 +366,19 @@ static int jsonrpc_handle_cmd(union sockaddr_union *dst, char *cmd, int *id,
 		pv_get_sintval(NULL, NULL, vret, aux->valueint);
 	else {
 		vret->rs.s = cJSON_Print(aux);
+		if (!vret->rs.s) {
+			LM_ERR("cJSON_Print failed\n");
+			ret = -2;
+			goto end;
+		}
 		vret->rs.len = strlen(vret->rs.s);
 		vret->flags = PV_VAL_STR;
 	}
 
 	ret = 1;
 end:
+	if (obj)
+		cJSON_Delete(obj);
 	shutdown(fd, SHUT_RDWR);
 	close(fd);
 	return ret;

modules/rtpengine/rtpengine.c

@@ -4771,6 +4771,10 @@ static void rtpengine_raise_event(int sender, void *p)
 				break;
 			default:
 				jstring.s = cJSON_PrintUnformatted(param);
+				if (!jstring.s) {
+					LM_ERR("cJSON_PrintUnformatted failed\n");
+					break;
+				}
 				jstring.len = strlen(jstring.s);
 				err = evi_param_add_str(eparams, &name, &jstring);
 				cJSON_PurgeString(jstring.s);