Fix some memory leakage and access violation in recent code

libasn1compiler/asn1c_C.c

@@ -820,24 +820,23 @@ asn1c_lang_C_type_SEx_OF(arg_t *arg) {
 			&& memb->expr_type == ASN_BASIC_INTEGER))
 	    	&& expr_elements_count(arg, memb))) {
 		arg_t tmp;
-		asn1p_expr_t tmp_memb;
+		asn1p_expr_t *tmp_memb = memb;
+		enum asn1p_expr_marker_e flags = memb->marker.flags;
 		arg->embed++;
 			tmp = *arg;
-			tmp.expr = &tmp_memb;
-			tmp_memb = *memb;
-			tmp_memb.marker.flags &= ~EM_INDIRECT;
-			tmp_memb._anonymous_type = 1;
-			if(tmp_memb.Identifier == 0) {
-				tmp_memb.Identifier = "Member";
+			tmp.expr = tmp_memb;
+			tmp_memb->marker.flags &= ~EM_INDIRECT;
+			tmp_memb->_anonymous_type = 1;
+			if(tmp_memb->Identifier == 0) {
+				tmp_memb->Identifier = strdup("Member");
 				if(0)
-				tmp_memb.Identifier = strdup(
+				tmp_memb->Identifier = strdup(
 					asn1c_make_identifier(0,
 						expr, "Member", 0));
-				assert(tmp_memb.Identifier);
+				assert(tmp_memb->Identifier);
 			}
 			tmp.default_cb(&tmp, NULL);
-			if(tmp_memb.Identifier != memb->Identifier)
-				if(0) free(tmp_memb.Identifier);
+			tmp_memb->marker.flags = flags;
 		arg->embed--;
 		assert(arg->target->target == OT_TYPE_DECLS ||
 				arg->target->target == OT_FWD_DEFS);

libasn1compiler/asn1c_naming.c

@@ -17,6 +17,24 @@ c_name_clash_finder_init() {
     TQ_INIT(&used_names);
 }
 
+void
+c_name_clash_finder_destroy() {
+    struct intl_name *n;
+
+    while((n = TQ_REMOVE(&used_names, next))) {
+        union {
+            const char *c_buf;
+            char *nc_buf;
+        } const_cast;
+
+        asn1p_expr_free(n->expr);
+        asn1p_expr_free(n->clashes_with);
+        const_cast.c_buf = n->name;
+        free(const_cast.nc_buf);
+        free(n);
+    }
+}
+
 static void
 register_global_name(arg_t *arg, const char *name) {
     struct intl_name *n;
@@ -25,14 +43,19 @@ register_global_name(arg_t *arg, const char *name) {
         if(strcmp(n->name, name) == 0) {
             if(!(arg->expr->_mark & TM_NAMEGIVEN) && arg->expr != n->expr) {
                 n->clashes_with = arg->expr;
+                arg->expr->ref_cnt++;
                 return;
             }
         }
     }
 
+    if(arg->expr->_mark & TM_NAMEGIVEN)
+        return;
+
     n = calloc(1, sizeof(*n));
     assert(n);
     n->expr = arg->expr;
+    arg->expr->ref_cnt++;
     n->name = strdup(name);
     TQ_ADD(&used_names, n, next);
 }

libasn1compiler/asn1c_naming.h

@@ -25,4 +25,6 @@ int c_name_clash(arg_t *arg);
 
 void c_name_clash_finder_init(void);
 
+void c_name_clash_finder_destroy(void);
+
 #endif	/* ASN1_COMPILER_NAMING_H */

libasn1compiler/asn1c_save.c

@@ -43,6 +43,7 @@ static int generate_preamble(arg_t *, FILE *, int optc, char **argv);
 static int include_type_to_pdu_collection(arg_t *arg);
 static void pdu_collection_print_unused_types(arg_t *arg);
 static const char *generate_pdu_C_definition(void);
+static void asn1c__cleanup_pdu_type(void);
 
 int
 asn1c_save_compiled_output(arg_t *arg, const char *datadir,
@@ -198,6 +199,8 @@ asn1c_save_compiled_output(arg_t *arg, const char *datadir,
 	fclose(mkf);
 	safe_fprintf(stderr, "Generated Makefile.am.sample\n");
 
+        asn1c__cleanup_pdu_type();
+
 	return 0;
 }
 
@@ -601,6 +604,14 @@ asn1c__add_pdu_type(const char *ctypename) {
 	pduTypes++;
 }
 
+static void
+asn1c__cleanup_pdu_type() {
+	int i;
+	for (i = 0; i < pduTypes; i++)
+		free(pduType[i].typename);
+	free(pduType);
+}
+
 static int
 asn1c__pdu_type_lookup(const char *typename) {
 	int i;

libasn1compiler/asn1compiler.c

@@ -79,6 +79,8 @@ asn1_compile(asn1p_t *asn, const char *datadir, enum asn1c_flags flags,
 
 	DEBUG("Saving compiled data");
 
+	c_name_clash_finder_destroy();
+
 	/*
 	 * Save or print out the compiled result.
 	 */

libasn1fix/asn1fix_internal.h

@@ -105,6 +105,7 @@ typedef struct arg_s {
         arg->mod = tmp_mod;                                   \
         arg->ns = asn1_namespace_new_from_module(tmp_mod, 1); \
         typeof(code) ret = code;                              \
+        asn1_namespace_free(arg->ns);                         \
         arg->ns = _saved_ns;                                  \
         arg->mod = _saved_mod;                                \
         ret;                                                  \

libasn1parser/asn1p_y.c

@@ -4314,6 +4314,7 @@ yyreduce:
     {
 		(yyval.a_value) = asn1p_value_fromtype((yyvsp[(2) - (2)].a_expr));
 		checkmem((yyval.a_value));
+		asn1p_expr_free((yyvsp[(2) - (2)].a_expr));
     }
     break;
 
@@ -4322,6 +4323,7 @@ yyreduce:
     {
 		(yyval.a_value) = asn1p_value_fromtype((yyvsp[(1) - (1)].a_expr));
 		checkmem((yyval.a_value));
+		asn1p_expr_free((yyvsp[(1) - (1)].a_expr));
     }
     break;
 
@@ -4939,6 +4941,7 @@ yyreduce:
     {
 		(yyval.a_ref) = asn1p_ref_new(yylineno, currentModule);
 		asn1p_ref_add_component((yyval.a_ref), (yyvsp[(1) - (1)].tv_str), RLT_lowercase);
+		free((yyvsp[(1) - (1)].tv_str));
     }
     break;
 

libasn1parser/asn1p_y.y

@@ -1986,11 +1986,13 @@ ContainedSubtype:
     TOK_INCLUDES Type {
 		$$ = asn1p_value_fromtype($2);
 		checkmem($$);
+		asn1p_expr_free($2);
     }
     /* Can't put Type here because of conflicts. Simplified subset */
     | DefinedUntaggedType {
 		$$ = asn1p_value_fromtype($1);
 		checkmem($$);
+		asn1p_expr_free($1);
     }
 	;
 
@@ -2475,6 +2477,7 @@ IdentifierAsReference:
     Identifier {
 		$$ = asn1p_ref_new(yylineno, currentModule);
 		asn1p_ref_add_component($$, $1, RLT_lowercase);
+		free($1);
     };
 
 IdentifierAsValue: