Fix memory leaks reported by Coverity Scan

plugins/experimental/jax_fingerprint/plugin.cc

@@ -373,23 +373,34 @@ TSPluginInit(int argc, char const **argv)
     return;
   }
 
-  PluginConfig *config = new PluginConfig();
-  config->plugin_type  = PluginType::GLOBAL;
+  auto owned_config         = std::make_unique<PluginConfig>();
+  owned_config->plugin_type = PluginType::GLOBAL;
 
-  if (!read_config_option(argc, argv, *config)) {
+  if (!read_config_option(argc, argv, *owned_config)) {
     TSError("[%s] Failed to parse options.", PLUGIN_NAME);
     return;
   }
 
-  if (!config->log_filename.empty()) {
-    if (!create_log_file(config->log_filename, config->log_handle)) {
+  if (!owned_config->log_filename.empty()) {
+    if (!create_log_file(owned_config->log_filename, owned_config->log_handle)) {
       TSError("[%s] Failed to create log.", PLUGIN_NAME);
       return;
     } else {
       Dbg(dbg_ctl, "Created log file.");
     }
   }
 
+  // Reserve the index before registering the log field, so that every failure exit happens while the
+  // configuration is still owned here and nothing has taken a reference to it yet.
+  if (reserve_user_arg(*owned_config) == TS_ERROR) {
+    TSError("[%s] Failed to reserve user arg index.", PLUGIN_NAME);
+    return;
+  }
+
+  // A global plugin's configuration lives for the life of the process: the log field callback and the
+  // continuation below both keep a reference to it, so release it from the unique_ptr here.
+  PluginConfig *config = owned_config.release();
+
   if (!config->log_symbol.empty()) {
     std::string name  = "jax_fingerprint-";
     name             += config->method.name;
@@ -412,11 +423,6 @@ TSPluginInit(int argc, char const **argv)
       TSLogIntUnmarshal);
   }
 
-  if (reserve_user_arg(*config) == TS_ERROR) {
-    TSError("[%s] Failed to reserve user arg index.", PLUGIN_NAME);
-    return;
-  }
-
   TSCont cont = TSContCreate(main_handler, nullptr);
   TSContDataSet(cont, config);
   if (config->method.on_client_hello) {
@@ -445,19 +451,17 @@ TSReturnCode
 TSRemapNewInstance(int argc, char *argv[], void **ih, char * /* errbuf ATS_UNUSED */, int /* errbuf_size ATS_UNUSED */)
 {
   Dbg(dbg_ctl, "New instance for client matching %s to %s", argv[0], argv[1]);
-  auto config         = new PluginConfig();
+  auto config         = std::make_unique<PluginConfig>();
   config->plugin_type = PluginType::REMAP;
 
   // Parse parameters
   if (!read_config_option(argc - 1, const_cast<const char **>(argv + 1), *config)) {
-    delete config;
     Dbg(dbg_ctl, "Bad arguments");
     return TS_ERROR;
   }
 
   if (!config->log_symbol.empty()) {
     TSError("[%s] --log-field is not supported in remap.config. Use it in plugin.config instead.", PLUGIN_NAME);
-    delete config;
     return TS_ERROR;
   }
 
@@ -476,22 +480,25 @@ TSRemapNewInstance(int argc, char *argv[], void **ih, char * /* errbuf ATS_UNUSE
     return TS_ERROR;
   }
 
+  // Past here the instance handle owns the configuration and TSRemapDeleteInstance releases it.
+  PluginConfig *instance = config.release();
+
   // Create continuation
-  if (config->standalone) {
+  if (instance->standalone) {
     Dbg(dbg_ctl, "Standalone mode. Adding hooks.");
-    config->handler = TSContCreate(main_handler, nullptr);
-    if (config->method.on_client_hello) {
-      TSHttpHookAdd(TS_SSL_CLIENT_HELLO_HOOK, config->handler);
+    instance->handler = TSContCreate(main_handler, nullptr);
+    if (instance->method.on_client_hello) {
+      TSHttpHookAdd(TS_SSL_CLIENT_HELLO_HOOK, instance->handler);
     }
-    if (config->method.type == Method::Type::CONNECTION_BASED) {
-      TSHttpHookAdd(TS_VCONN_CLOSE_HOOK, config->handler);
+    if (instance->method.type == Method::Type::CONNECTION_BASED) {
+      TSHttpHookAdd(TS_VCONN_CLOSE_HOOK, instance->handler);
     } else {
-      TSHttpHookAdd(TS_HTTP_TXN_CLOSE_HOOK, config->handler);
+      TSHttpHookAdd(TS_HTTP_TXN_CLOSE_HOOK, instance->handler);
     }
-    TSContDataSet(config->handler, config);
+    TSContDataSet(instance->handler, instance);
   }
 
-  *ih = static_cast<void *>(config);
+  *ih = static_cast<void *>(instance);
 
   return TS_SUCCESS;
 }

plugins/experimental/maxmind_acl/mmdb.cc

@@ -79,17 +79,20 @@ Acl::init(char const *filename)
   }
 
   // Associate our config file with remap.config or .yaml if possible to be able to initiate reloads
-  TSMgmtString result;
+  TSMgmtString result   = nullptr;
   const char  *var_name = "proxy.config.url_remap_yaml.filename";
   if (TS_SUCCESS != TSMgmtStringGet(var_name, &result) || TS_SUCCESS != TSMgmtConfigFileAdd(result, configloc.c_str())) {
     // Fall back to remap.config
+    TSfree(result);
+    result   = nullptr;
     var_name = "proxy.config.url_remap.filename";
     if (TS_SUCCESS != TSMgmtStringGet(var_name, &result)) {
       TSWarning("[%s] Could not retrieve remap filename", PLUGIN_NAME);
     } else if (TS_SUCCESS != TSMgmtConfigFileAdd(result, configloc.c_str())) {
       TSWarning("[%s] Error adding mgmt config file", PLUGIN_NAME);
     }
   }
+  TSfree(result);
 
   // Find our database name and convert to full path as needed
   status = loaddb(maxmind["database"]);

plugins/experimental/stale_response/stale_response.cc

@@ -1070,6 +1070,10 @@ parse_args(int argc, char const *argv[])
       plugin_config->log_info.stale_if_error = true;
       break;
     case 'd':
+      // The option may be repeated; release the previously duplicated name first.
+      if (plugin_config->log_info.filename != PLUGIN_TAG) {
+        free(const_cast<char *>(plugin_config->log_info.filename));
+      }
       plugin_config->log_info.filename = strdup(optarg);
       break;
 

plugins/experimental/uri_signing/config.cc

@@ -282,6 +282,8 @@ read_config_from_json(json_t *const issuer_json)
       if (id_json) {
         id = json_string_value(id_json);
         if (id) {
+          /* An earlier issuer may have set an id; free it so it is not leaked. Last issuer wins. */
+          free(cfg->id);
           cfg->id = static_cast<char *>(malloc(strlen(id) + 1));
           strcpy(cfg->id, id);
           PluginDebug("Found Id in the config: %s", cfg->id);

plugins/regex_revalidate/regex_revalidate.cc

@@ -778,6 +778,7 @@ TSPluginInit(int argc, const char *argv[])
   while ((c = getopt_long(argc, (char *const *)argv, "c:l:f:m:", longopts, nullptr)) != -1) {
     switch (c) {
     case 'c':
+      TSfree(pstate->config_path); // An option can be repeated, so the earlier value is not leaked
       pstate->config_path = TSstrdup(optarg);
       break;
     case 'l':
@@ -790,9 +791,11 @@ TSPluginInit(int argc, const char *argv[])
       disable_timed_reload = true;
       break;
     case 'f':
+      TSfree(pstate->state_path);
       pstate->state_path = make_state_path(optarg);
       break;
     case 'm':
+      TSfree(pstate->match_header);
       pstate->match_header = TSstrdup(optarg);
       break;
     default:

plugins/remap_purge/remap_purge.cc

@@ -287,17 +287,21 @@ TSRemapNewInstance(int argc, char *argv[], void **ih, char * /* errbuf ATS_UNUSE
       purge->allow_get = true;
       break;
     case 'h':
+      TSfree(purge->header); // An option can be repeated, so the earlier value is not leaked
       purge->header     = TSstrdup(optarg);
       purge->header_len = strlen(purge->header);
       break;
     case 'i':
+      TSfree(purge->id);
       purge->id = TSstrdup(optarg);
       break;
     case 's':
+      TSfree(purge->secret);
       purge->secret     = TSstrdup(optarg);
       purge->secret_len = strlen(purge->secret);
       break;
     case 'f':
+      TSfree(purge->state_file);
       purge->state_file = make_state_path(optarg);
       break;
     }

plugins/xdebug/xdebug.cc

@@ -947,6 +947,7 @@ TSPluginInit(int argc, const char *argv[])
     switch (opt) {
     case 'h':
       Dbg(dbg_ctl, "Setting header: %s", optarg);
+      TSfree(const_cast<char *>(xDebugHeader.str)); // The option can be repeated, so the earlier value is not leaked
       xDebugHeader.str = TSstrdup(optarg);
       break;
     case 'e':

src/api/InkAPITest.cc

@@ -6656,6 +6656,9 @@ REGRESSION_TEST(SDK_API_TSMgmtGet)(RegressionTest *test, int /* atype ATS_UNUSED
     SDK_RPRINT(test, "TSMgmtStringGet", "TestCase1.4", TC_PASS, "ok");
   }
 
+  // TSMgmtStringGet() hands back a copy the caller owns.
+  TSfree(svalue);
+
   {
     TSRecordDataType result;
     auto             ret = TSMgmtDataTypeGet(CONFIG_PARAM_STRING_NAME, &result);

src/proxy/http/remap/RemapYamlConfig.cc

@@ -35,6 +35,7 @@
 #include <vector>
 
 #include "tscore/Diags.h"
+#include "tscore/ink_memory.h"
 #include "tscore/ink_string.h"
 #include "tsutil/ts_errata.h"
 #include "tsutil/PostScript.h"
@@ -388,7 +389,12 @@ parse_map_referer(const YAML::Node &node, url_mapping *url_mapping)
       !strcasecmp(url.c_str(), "<default_redirect_url>") || !strcasecmp(url.c_str(), "default_redirect_url")) {
     url_mapping->default_redirect_url = true;
   }
-  url_mapping->redir_chunk_list = redirect_tag_str::parse_format_redirect_url(ats_strdup(url.c_str()));
+  // parse_format_redirect_url() nul terminates each chunk in place before copying it out, and for a
+  // url with no format specifier that write lands on the terminating nul, which std::string does not
+  // allow a caller to assign. Give it a buffer we own instead, and release it once it returns; the
+  // chunk list holds copies.
+  ats_scoped_str redirect_url(ats_strdup(url.c_str()));
+  url_mapping->redir_chunk_list = redirect_tag_str::parse_format_redirect_url(redirect_url.get());
 
   if (!node["regex"] || !node["regex"].IsSequence()) {
     return swoc::Errata("'regex' field must be sequence");

src/traffic_cache_tool/CacheTool.cc

@@ -208,7 +208,7 @@ struct Cache {
   std::map<int, Volume>              _volumes;
   std::vector<StripeSM *>            globalVec_stripe;
   std::unordered_set<ts::CacheURL *> URLset;
-  unsigned short                    *stripes_hash_table;
+  unsigned short                    *stripes_hash_table = nullptr;
 };
 
 Errata
@@ -685,7 +685,14 @@ Cache::calcTotalSpanPhysicalSize()
 }
 #endif
 
-Cache::~Cache() {}
+Cache::~Cache()
+{
+  // The URL set and the stripe hash table are owned solely by this instance.
+  for (auto *url : URLset) {
+    delete url;
+  }
+  ats_free(stripes_hash_table);
+}
 
 Errata
 Span::load()