various files - fix some alerts raised by lgtm code analysis

This patch fixes several issues reported by the lgtm code analysis tool:

https://lgtm.com/projects/g/asterisk/asterisk

Not all reported issues were addressed in this patch. This patch mostly fixes
confirmed reported errors, potential problematic code points, and a few other
"low hanging" warnings or recommendations found in core supported modules.
These include, but are not limited to the following:

* innapropriate stack allocation in loops
* buffer overflows
* variable declaration "hiding" another variable declaration
* comparisons results that are always the same
* ambiguously signed bit-field members
* missing header guards

Change-Id: Id4a881686605d26c94ab5409bc70fcc21efacc25

apps/app_cdr.c

@@ -119,13 +119,13 @@ struct app_cdr_message_payload {
 	/*! The name of the channel to be manipulated */
 	const char *channel_name;
 	/*! Disable the CDR for this channel */
-	int disable:1;
+	unsigned int disable:1;
 	/*! Re-enable the CDR for this channel */
-	int reenable:1;
+	unsigned int reenable:1;
 	/*! Reset the CDR */
-	int reset:1;
+	unsigned int reset:1;
 	/*! If reseting the CDR, keep the variables */
-	int keep_variables:1;
+	unsigned int keep_variables:1;
 };
 
 static void appcdr_callback(void *data, struct stasis_subscription *sub, struct stasis_message *message)

apps/app_dictate.c

@@ -149,7 +149,8 @@ static int dictate_exec(struct ast_channel *chan, const char *data)
 		ast_mkdir(base, 0755);
 		len = strlen(base) + strlen(filein) + 2;
 		if (!path || len > maxlen) {
-			path = ast_alloca(len);
+			ast_free(path);
+			path = ast_malloc(len);
 			memset(path, 0, len);
 			maxlen = len;
 		} else {
@@ -334,6 +335,7 @@ static int dictate_exec(struct ast_channel *chan, const char *data)
 			ast_frfree(f);
 		}
 	}
+	ast_free(path);
 	if (oldr) {
 		ast_set_read_format(chan, oldr);
 		ao2_ref(oldr, -1);

apps/app_followme.c

@@ -408,7 +408,6 @@ static int reload_followme(int reload)
 	char *cat = NULL, *tmp;
 	struct ast_variable *var;
 	struct number *cur, *nm;
-	char *numberstr;
 	int timeout;
 	int numorder;
 	const char* enable_callee_prompt_str;
@@ -536,9 +535,12 @@ static int reload_followme(int reload)
 		while (var) {
 			if (!strcasecmp(var->name, "number")) {
 				int idx = 0;
+				char copy[strlen(var->value) + 1];
+				char *numberstr;
 
 				/* Add a new number */
-				numberstr = ast_strdupa(var->value);
+				strcpy(copy, var->value); /* safe */
+				numberstr = copy;
 				if ((tmp = strchr(numberstr, ','))) {
 					*tmp++ = '\0';
 					timeout = atoi(tmp);
@@ -762,10 +764,6 @@ static struct ast_channel *wait_for_winner(struct findme_user_listptr *findme_us
 		}
 
 		tmpto = to;
-		if (to < 0) {
-			to = 1000;
-			tmpto = 1000;
-		}
 		towas = to;
 		winner = ast_waitfor_n(watchers, pos, &to);
 		tmpto -= to;

apps/app_minivm.c

@@ -2652,9 +2652,10 @@ static int create_vmaccount(char *name, struct ast_variable *var, int realtime)
 			ast_copy_string(vmu->fullname, var->value, sizeof(vmu->fullname));
 		} else if (!strcasecmp(var->name, "setvar")) {
 			char *varval;
-			char *varname = ast_strdupa(var->value);
+			char varname[strlen(var->value) + 1];
 			struct ast_variable *tmpvar;
 
+			strcpy(varname, var->value); /* safe */
 			if ((varval = strchr(varname, '='))) {
 				*varval = '\0';
 				varval++;

apps/app_playback.c

@@ -173,7 +173,10 @@ static int s_streamwait3(const say_args_t *a, const char *fn)
 static int do_say(say_args_t *a, const char *s, const char *options, int depth)
 {
 	struct ast_variable *v;
-	char *lang, *x, *rule = NULL;
+	char *lang;
+	char *x;
+	char *rule = NULL;
+	char *rule_head = NULL;
 	int ret = 0;
 	struct varshead head = { .first = NULL, .last = NULL };
 	struct ast_var_t *n;
@@ -195,7 +198,7 @@ static int do_say(say_args_t *a, const char *s, const char *options, int depth)
 	for (;;) {
 		for (v = ast_variable_browse(say_cfg, lang); v ; v = v->next) {
 			if (ast_extension_match(v->name, s)) {
-				rule = ast_strdupa(v->value);
+				rule_head = rule = ast_strdup(v->value);
 				break;
 			}
 		}
@@ -220,6 +223,7 @@ static int do_say(say_args_t *a, const char *s, const char *options, int depth)
 	n = ast_var_assign("SAY", s);
 	if (!n) {
 		ast_log(LOG_ERROR, "Memory allocation error in do_say\n");
+		ast_free(rule_head);
 		return -1;
 	}
 	AST_LIST_INSERT_HEAD(&head, n, entries);
@@ -281,6 +285,7 @@ static int do_say(say_args_t *a, const char *s, const char *options, int depth)
 		}
 	}
 	ast_var_delete(n);
+	ast_free(rule_head);
 	return ret;
 }
 

apps/app_readexten.c

@@ -170,8 +170,7 @@ static int readexten_exec(struct ast_channel *chan, const char *data)
 	if (timeout <= 0)
 		timeout = ast_channel_pbx(chan) ? ast_channel_pbx(chan)->rtimeoutms : 10000;
 
-	if (digit_timeout <= 0)
+	digit_timeout = ast_channel_pbx(chan) ? ast_channel_pbx(chan)->dtimeoutms : 5000;
-		digit_timeout = ast_channel_pbx(chan) ? ast_channel_pbx(chan)->dtimeoutms : 5000;
 
 	if (ast_test_flag(&flags, OPT_INDICATION) && !ast_strlen_zero(arglist.filename)) {
 		ts = ast_get_indication_tone(ast_channel_zone(chan), arglist.filename);

apps/app_voicemail.c

@@ -1797,7 +1797,7 @@ static void vm_change_password(struct ast_vm_user *vmu, const char *newpassword)
 	struct ast_config   *cfg = NULL;
 	struct ast_variable *var = NULL;
 	struct ast_category *cat = NULL;
-	char *category = NULL, *value = NULL, *new = NULL;
+	char *category = NULL;
 	const char *tmp = NULL;
 	struct ast_flags config_flags = { CONFIG_FLAG_WITHCOMMENTS };
 	char secretfn[PATH_MAX] = "";
@@ -1824,24 +1824,28 @@ static void vm_change_password(struct ast_vm_user *vmu, const char *newpassword)
 		if ((cfg = ast_config_load(VOICEMAIL_CONFIG, config_flags)) && valid_config(cfg)) {
 			while ((category = ast_category_browse(cfg, category))) {
 				if (!strcasecmp(category, vmu->context)) {
+					char *value = NULL;
+					char *new = NULL;
 					if (!(tmp = ast_variable_retrieve(cfg, category, vmu->mailbox))) {
 						ast_log(AST_LOG_WARNING, "We could not find the mailbox.\n");
 						break;
 					}
 					value = strstr(tmp, ",");
 					if (!value) {
-						new = ast_alloca(strlen(newpassword)+1);
+						new = ast_malloc(strlen(newpassword) + 1);
 						sprintf(new, "%s", newpassword);
 					} else {
-						new = ast_alloca((strlen(value) + strlen(newpassword) + 1));
+						new = ast_malloc((strlen(value) + strlen(newpassword) + 1));
 						sprintf(new, "%s%s", newpassword, value);
 					}
 					if (!(cat = ast_category_get(cfg, category, NULL))) {
 						ast_log(AST_LOG_WARNING, "Failed to get category structure.\n");
+						ast_free(new);
 						break;
 					}
 					ast_variable_update(cat, vmu->mailbox, new, NULL, 0);
 					found = 1;
+					ast_free(new);
 				}
 			}
 			/* save the results */
@@ -1865,13 +1869,14 @@ static void vm_change_password(struct ast_vm_user *vmu, const char *newpassword)
 			for (category = ast_category_browse(cfg, NULL); category; category = ast_category_browse(cfg, category)) {
 				ast_debug(4, "users.conf: %s\n", category);
 				if (!strcasecmp(category, vmu->mailbox)) {
+					char new[strlen(newpassword) + 1];
 					if (!ast_variable_retrieve(cfg, category, "vmsecret")) {
 						ast_debug(3, "looks like we need to make vmsecret!\n");
 						var = ast_variable_new("vmsecret", newpassword, "");
 					} else {
 						var = NULL;
 					}
-					new = ast_alloca(strlen(newpassword) + 1);
+
 					sprintf(new, "%s", newpassword);
 					if (!(cat = ast_category_get(cfg, category, NULL))) {
 						ast_debug(4, "failed to get category!\n");
@@ -2194,7 +2199,6 @@ static int imap_retrieve_greeting(const char *dir, const int msgnum, struct ast_
 	struct vm_state *vms_p;
 	char *file, *filename;
 	char dest[PATH_MAX];
-	char *attachment;
 	int i;
 	BODY *body;
 	int ret = 0;
@@ -2247,21 +2251,26 @@ static int imap_retrieve_greeting(const char *dir, const int msgnum, struct ast_
 		mail_fetchstructure(vms_p->mailstream, i + 1, &body);
 		/* We have the body, now we extract the file name of the first attachment. */
 		if (body->nested.part && body->nested.part->next && body->nested.part->next->body.parameter->value) {
-			attachment = ast_strdupa(body->nested.part->next->body.parameter->value);
+			char *attachment = body->nested.part->next->body.parameter->value;
+			char copy[strlen(attachment) + 1];
+
+			strcpy(copy, attachment); /* safe */
+			attachment = copy;
+
+			filename = strsep(&attachment, ".");
+			if (!strcmp(filename, file)) {
+				ast_copy_string(vms_p->fn, dir, sizeof(vms_p->fn));
+				vms_p->msgArray[vms_p->curmsg] = i + 1;
+				create_dirpath(dest, sizeof(dest), vmu->context, vms_p->username, "");
+				save_body(body, vms_p, "2", attachment, 0);
+				ret = 0;
+				break;
+			}
 		} else {
 			ast_log(AST_LOG_ERROR, "There is no file attached to this IMAP message.\n");
 			ret = -1;
 			break;
 		}
-		filename = strsep(&attachment, ".");
-		if (!strcmp(filename, file)) {
-			ast_copy_string(vms_p->fn, dir, sizeof(vms_p->fn));
-			vms_p->msgArray[vms_p->curmsg] = i + 1;
-			create_dirpath(dest, sizeof(dest), vmu->context, vms_p->username, "");
-			save_body(body, vms_p, "2", attachment, 0);
-			ret = 0;
-			break;
-		}
 	}
 
 	if (curr_mbox != -1) {
@@ -8141,10 +8150,12 @@ static void queue_mwi_event(const char *channel_id, const char *box, int urgent,
 
 		aliases = ao2_find(mailbox_alias_mappings, box, OBJ_SEARCH_KEY | OBJ_MULTIPLE);
 		while ((mapping = ao2_iterator_next(aliases))) {
+			char alias[strlen(mapping->alias) + 1];
+			strcpy(alias, mapping->alias); /* safe */
 			mailbox = NULL;
 			context = NULL;
 			ast_debug(3, "Found alias mapping: %s -> %s\n", mapping->alias, box);
-			separate_mailbox(ast_strdupa(mapping->alias), &mailbox, &context);
+			separate_mailbox(alias, &mailbox, &context);
 			ast_publish_mwi_state_channel(mailbox, context, new + urgent, old, channel_id);
 			ao2_ref(mapping, -1);
 		}
@@ -8364,12 +8375,12 @@ static int forward_message(struct ast_channel *chan, char *context, struct vm_st
 			directory_app = pbx_findapp("Directory");
 			if (directory_app) {
 				char vmcontext[256];
-				char *old_context;
+				char old_context[strlen(ast_channel_context(chan)) + 1];
-				char *old_exten;
+				char old_exten[strlen(ast_channel_exten(chan)) + 1];
 				int old_priority;
 				/* make backup copies */
-				old_context = ast_strdupa(ast_channel_context(chan));
+				strcpy(old_context, ast_channel_context(chan)); /* safe */
-				old_exten = ast_strdupa(ast_channel_exten(chan));
+				strcpy(old_exten, ast_channel_exten(chan)); /* safe */
 				old_priority = ast_channel_priority(chan);
 
 				/* call the Directory, changes the channel */
@@ -9050,7 +9061,6 @@ static int imap_remove_file(char *dir, int msgnum)
 static int imap_delete_old_greeting (char *dir, struct vm_state *vms)
 {
 	char *file, *filename;
-	char *attachment;
 	char arg[11];
 	int i;
 	BODY* body;
@@ -9079,17 +9089,22 @@ static int imap_delete_old_greeting (char *dir, struct vm_state *vms)
 		mail_fetchstructure(vms->mailstream, i + 1, &body);
 		/* We have the body, now we extract the file name of the first attachment. */
 		if (body->nested.part->next && body->nested.part->next->body.parameter->value) {
-			attachment = ast_strdupa(body->nested.part->next->body.parameter->value);
+			char *attachment = body->nested.part->next->body.parameter->value;
+			char copy[strlen(attachment) + 1];
+
+			strcpy(copy, attachment); /* safe */
+			attachment = copy;
+
+			filename = strsep(&attachment, ".");
+			if (!strcmp(filename, file)) {
+				snprintf(arg, sizeof(arg), "%d", i + 1);
+				mail_setflag(vms->mailstream, arg, "\\DELETED");
+			}
 		} else {
 			ast_log(AST_LOG_ERROR, "There is no file attached to this IMAP message.\n");
 			ast_mutex_unlock(&vms->lock);
 			return -1;
 		}
-		filename = strsep(&attachment, ".");
-		if (!strcmp(filename, file)) {
-			snprintf(arg, sizeof(arg), "%d", i + 1);
-			mail_setflag(vms->mailstream, arg, "\\DELETED");
-		}
 	}
 	mail_expunge(vms->mailstream);
 
@@ -13705,26 +13720,30 @@ static void load_zonemessages(struct ast_config *cfg)
 
 	var = ast_variable_browse(cfg, "zonemessages");
 	while (var) {
-		struct vm_zone *z;
+		if (var->value) {
-		char *msg_format, *tzone;
+			struct vm_zone *z;
+			char *msg_format, *tzone;
+			char storage[strlen(var->value) + 1];
 
-		z = ast_malloc(sizeof(*z));
+			z = ast_malloc(sizeof(*z));
-		if (!z) {
+			if (!z) {
-			return;
+				return;
-		}
+			}
 
-		msg_format = ast_strdupa(var->value);
+			strcpy(storage, var->value); /* safe */
-		tzone = strsep(&msg_format, "|,");
+			msg_format = storage;
-		if (msg_format) {
+			tzone = strsep(&msg_format, "|,");
-			ast_copy_string(z->name, var->name, sizeof(z->name));
+			if (msg_format) {
-			ast_copy_string(z->timezone, tzone, sizeof(z->timezone));
+				ast_copy_string(z->name, var->name, sizeof(z->name));
-			ast_copy_string(z->msg_format, msg_format, sizeof(z->msg_format));
+				ast_copy_string(z->timezone, tzone, sizeof(z->timezone));
-			AST_LIST_LOCK(&zones);
+				ast_copy_string(z->msg_format, msg_format, sizeof(z->msg_format));
-			AST_LIST_INSERT_HEAD(&zones, z, list);
+				AST_LIST_LOCK(&zones);
-			AST_LIST_UNLOCK(&zones);
+				AST_LIST_INSERT_HEAD(&zones, z, list);
-		} else {
+				AST_LIST_UNLOCK(&zones);
-			ast_log(AST_LOG_WARNING, "Invalid timezone definition at line %d\n", var->lineno);
+			} else {
-			ast_free(z);
+				ast_log(AST_LOG_WARNING, "Invalid timezone definition at line %d\n", var->lineno);
+				ast_free(z);
+			}
 		}
 		var = var->next;
 	}

channels/chan_dahdi.c

@@ -4382,7 +4382,7 @@ static char *alarm2str(int alm)
 static const char *event2str(int event)
 {
 	static char buf[256];
-	if ((event < (ARRAY_LEN(events))) && (event > -1))
+	if ((event > -1) && (event < (ARRAY_LEN(events))) )
 		return events[event];
 	sprintf(buf, "Event %d", event); /* safe */
 	return buf;
@@ -15174,7 +15174,7 @@ static void mfcr2_show_links_of(struct ast_cli_args *a, struct r2links *list_hea
 			inside_range = 0;
 			len = 0;
 			/* Prepare nice string in channel_list[] */
-			for (i = 0; i < mfcr2->numchans; i++) {
+			for (i = 0; i < mfcr2->numchans && len < sizeof(channel_list) - 1; i++) {
 				struct dahdi_pvt *p = mfcr2->pvts[i];
 				if (!p) {
 					continue;
@@ -18132,13 +18132,17 @@ static int process_dahdi(struct dahdi_chan_conf *confp, const char *cat, struct
 		} else if (!strcasecmp(v->name, "namedpickupgroup")) {
 			confp->chan.named_pickupgroups = ast_get_namedgroups(v->value);
 		} else if (!strcasecmp(v->name, "setvar")) {
-			char *varname = ast_strdupa(v->value), *varval = NULL;
+			if (v->value) {
-			struct ast_variable *tmpvar;
+				char *varval = NULL;
-			if (varname && (varval = strchr(varname, '='))) {
+				struct ast_variable *tmpvar;
-				*varval++ = '\0';
+				char varname[strlen(v->value) + 1];
-				if ((tmpvar = ast_variable_new(varname, varval, ""))) {
+				strcpy(varname, v->value); /* safe */
-					tmpvar->next = confp->chan.vars;
+				if ((varval = strchr(varname, '='))) {
-					confp->chan.vars = tmpvar;
+					*varval++ = '\0';
+					if ((tmpvar = ast_variable_new(varname, varval, ""))) {
+						tmpvar->next = confp->chan.vars;
+						confp->chan.vars = tmpvar;
+					}
 				}
 			}
 		} else if (!strcasecmp(v->name, "immediate")) {
@@ -19082,9 +19086,12 @@ static int process_dahdi(struct dahdi_chan_conf *confp, const char *cat, struct
 			} else if (!strcasecmp(v->name, "mfcr2_logging")) {
 				openr2_log_level_t tmplevel;
 				char *clevel;
-				char *logval = ast_strdupa(v->value);
+				char *logval;
+				char copy[strlen(v->value) + 1];
+				strcpy(copy, v->value); /* safe */
+				logval = copy;
 				while (logval) {
- 					clevel = strsep(&logval,",");
+					clevel = strsep(&logval,",");
 					if (-1 == (tmplevel = openr2_log_get_level(clevel))) {
 						ast_log(LOG_WARNING, "Ignoring invalid logging level: '%s' at line %d.\n", clevel, v->lineno);
 						continue;

channels/chan_dahdi.h

@@ -692,15 +692,15 @@ struct dahdi_pvt {
 	openr2_calling_party_category_t mfcr2_category;
 	int mfcr2_dnis_index;
 	int mfcr2_ani_index;
-	int mfcr2call:1;
+	unsigned int mfcr2call:1;
-	int mfcr2_answer_pending:1;
+	unsigned int mfcr2_answer_pending:1;
-	int mfcr2_charge_calls:1;
+	unsigned int mfcr2_charge_calls:1;
-	int mfcr2_allow_collect_calls:1;
+	unsigned int mfcr2_allow_collect_calls:1;
-	int mfcr2_forced_release:1;
+	unsigned int mfcr2_forced_release:1;
-	int mfcr2_dnis_matched:1;
+	unsigned int mfcr2_dnis_matched:1;
-	int mfcr2_call_accepted:1;
+	unsigned int mfcr2_call_accepted:1;
-	int mfcr2_accept_on_offer:1;
+	unsigned int mfcr2_accept_on_offer:1;
-	int mfcr2_progress_sent:1;
+	unsigned int mfcr2_progress_sent:1;
 #endif	/* defined(HAVE_OPENR2) */
 	/*! \brief DTMF digit in progress.  0 when no digit in progress. */
 	char begindigit;

channels/chan_motif.c

@@ -2086,15 +2086,16 @@ static int jingle_interpret_description(struct jingle_session *session, iks *des
 
 	/* Iterate the codecs updating the relevant RTP instance as we go */
 	for (codec = iks_child(description); codec; codec = iks_next(codec)) {
-		char *id = iks_find_attrib(codec, "id"), *name = iks_find_attrib(codec, "name");
+		char *id = iks_find_attrib(codec, "id");
+		char *attr_name = iks_find_attrib(codec, "name");
 		char *clockrate = iks_find_attrib(codec, "clockrate");
 		int rtp_id, rtp_clockrate;
 
-		if (!ast_strlen_zero(id) && !ast_strlen_zero(name) && (sscanf(id, "%30d", &rtp_id) == 1)) {
+		if (!ast_strlen_zero(id) && !ast_strlen_zero(attr_name) && (sscanf(id, "%30d", &rtp_id) == 1)) {
 			if (!ast_strlen_zero(clockrate) && (sscanf(clockrate, "%30d", &rtp_clockrate) == 1)) {
-				ast_rtp_codecs_payloads_set_rtpmap_type_rate(&codecs, NULL, rtp_id, media, name, 0, rtp_clockrate);
+				ast_rtp_codecs_payloads_set_rtpmap_type_rate(&codecs, NULL, rtp_id, media, attr_name, 0, rtp_clockrate);
 			} else {
-				ast_rtp_codecs_payloads_set_rtpmap_type(&codecs, NULL, rtp_id, media, name, 0);
+				ast_rtp_codecs_payloads_set_rtpmap_type(&codecs, NULL, rtp_id, media, attr_name, 0);
 			}
 		}
 	}

codecs/ex_alaw.h

@@ -7,6 +7,9 @@
  *
  */
 
+#ifndef ASTERISK_EX_ALAW_H
+#define ASTERISK_EX_ALAW_H
+
 static uint8_t ex_alaw[] = {
 	0x00, 0x03, 0x06, 0x09, 0x0c, 0x0f, 0x12, 0x15,
 	0x10, 0x18, 0x1b, 0x1e, 0x21, 0x24, 0x27, 0x2a,
@@ -34,3 +37,5 @@ static struct ast_frame *alaw_sample(void)
 	f.subclass.format = ast_format_alaw;
 	return &f;
 }
+
+#endif /* ASTERISK_EX_ALAW_H */

codecs/ex_g722.h

@@ -7,6 +7,9 @@
  *
  */
 
+#ifndef ASTERISK_EX_G722_H
+#define ASTERISK_EX_G722_H
+
 static uint8_t ex_g722[] = {
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -46,3 +49,5 @@ static struct ast_frame *g722_sample(void)
 
 	return &f;
 }
+
+#endif /* ASTERISK_EX_G722_H */

codecs/ex_ulaw.h

@@ -7,6 +7,9 @@
  *
  */
 
+#ifndef ASTERISK_EX_ULAW_H
+#define ASTERISK_EX_ULAW_H
+
 static uint8_t ex_ulaw[] = {
 	0x00, 0x03, 0x06, 0x09, 0x0c, 0x0f, 0x12, 0x15,
 	0x10, 0x18, 0x1b, 0x1e, 0x21, 0x24, 0x27, 0x2a,
@@ -36,3 +39,5 @@ static struct ast_frame *ulaw_sample(void)
 
 	return &f;
 }
+
+#endif /* ASTERISK_EX_ULAW_H */

formats/format_g726.c

@@ -199,7 +199,7 @@ static off_t g726_tell(struct ast_filestream *fs)
 	return ftello(fs->f) << 1;
 }
 
-static struct ast_format_def f[] = {
+static struct ast_format_def f_def[] = {
 	{
 		.name = "g726-40",
 		.exts = "g726-40",
@@ -259,9 +259,9 @@ static int unload_module(void)
 {
 	int i;
 
-	for (i = 0; f[i].desc_size ; i++) {
+	for (i = 0; f_def[i].desc_size ; i++) {
-		if (ast_format_def_unregister(f[i].name))
+		if (ast_format_def_unregister(f_def[i].name))
-			ast_log(LOG_WARNING, "Failed to unregister format %s.\n", f[i].name);
+			ast_log(LOG_WARNING, "Failed to unregister format %s.\n", f_def[i].name);
 	}
 	return(0);
 }
@@ -270,10 +270,10 @@ static int load_module(void)
 {
 	int i;
 
-	for (i = 0; f[i].desc_size ; i++) {
+	for (i = 0; f_def[i].desc_size ; i++) {
-		f[i].format = ast_format_g726;
+		f_def[i].format = ast_format_g726;
-		if (ast_format_def_register(&f[i])) {	/* errors are fatal */
+		if (ast_format_def_register(&f_def[i])) {	/* errors are fatal */
-			ast_log(LOG_WARNING, "Failed to register format %s.\n", f[i].name);
+			ast_log(LOG_WARNING, "Failed to register format %s.\n", f_def[i].name);
 			unload_module();
 			return AST_MODULE_LOAD_DECLINE;
 		}

formats/msgsm.h

@@ -1,4 +1,6 @@
 /* Conversion routines derived from code by guido@sienanet.it */
+#ifndef ASTERISK_MSGSM_H
+#define ASTERISK_MSGSM_H
 
 #define GSM_MAGIC 0xD
 
@@ -687,3 +689,5 @@ static inline void conv65( wav_byte * c, gsm_byte * d){
                         writeGSM_33(d+33);
 
 }
+
+#endif /* ASTERISK_MSGSM_H */

include/asterisk/ari.h

@@ -101,7 +101,7 @@ struct ast_ari_response {
 	/*! Corresponding text for the response code */
 	const char *response_text; /* Shouldn't http.c handle this? */
 	/*! Flag to indicate that no further response is needed */
-	int no_response:1;
+	unsigned int no_response:1;
 };
 
 /*!

include/asterisk/calendar.h

@@ -133,8 +133,8 @@ struct ast_calendar {
 	int timeframe;       /*!< Span (in mins) of calendar data to pull with each request */
 	pthread_t thread;    /*!< The thread that the calendar is loaded/updated in */
 	ast_cond_t unload;
-	int unloading:1;
+	unsigned int unloading:1;
-	int pending_deletion:1;
+	unsigned int pending_deletion:1;
 	struct ao2_container *events;  /*!< The events that are known at this time */
 };
 

include/asterisk/channel_internal.h

@@ -18,6 +18,9 @@
  * \brief Internal channel functions for channel.c to use
  */
 
+#ifndef ASTERISK_CHANNEL_INTERNAL_H
+#define ASTERISK_CHANNEL_INTERNAL_H
+
 #define ast_channel_internal_alloc(destructor, assignedid, requestor) __ast_channel_internal_alloc(destructor, assignedid, requestor, __FILE__, __LINE__, __PRETTY_FUNCTION__)
 struct ast_channel *__ast_channel_internal_alloc(void (*destructor)(void *obj), const struct ast_assigned_ids *assignedids, const struct ast_channel *requestor, const char *file, int line, const char *function);
 void ast_channel_internal_finalize(struct ast_channel *chan);
@@ -33,3 +36,5 @@ void ast_channel_internal_set_stream_topology_change_source(
 	struct ast_channel *chan, void *change_source);
 void ast_channel_internal_swap_stream_topology(struct ast_channel *chan1,
 	struct ast_channel *chan2);
+
+#endif /* ASTERISK_CHANNEL_INTERNAL_H */

include/asterisk/config_options.h

@@ -168,7 +168,7 @@ struct aco_file {
 
 struct aco_info {
 	const char *module; /*!< The name of the module whose config is being processed */
-	int hidden:1;                /*!< If enabled, this config item is hidden from users */
+	unsigned int hidden:1;                /*!< If enabled, this config item is hidden from users */
 	aco_pre_apply_config pre_apply_config; /*!< A callback called after processing, but before changes are applied */
 	aco_post_apply_config post_apply_config;/*!< A callback called after changes are applied */
 	aco_snapshot_alloc snapshot_alloc;     /*!< Allocate an object to hold all global configs and item containers */

include/asterisk/dns_internal.h

@@ -23,6 +23,9 @@
  * \author Joshua Colp <jcolp@digium.com>
  */
 
+#ifndef _ASTERISK_DNS_INTERNAL_H
+#define _ASTERISK_DNS_INTERNAL_H
+
 /*! \brief For AST_VECTOR */
 #include "asterisk/vector.h"
 
@@ -293,3 +296,5 @@ int dns_parse_string(char *cur, uint8_t *size, char **val);
  * \note The query must be released upon completion or cancellation using ao2_ref
  */
 struct ast_dns_query *dns_query_alloc(const char *name, int rr_type, int rr_class, ast_dns_resolve_callback callback, void *data);
+
+#endif /* _ASTERISK_DNS_INTERNAL_H */

include/asterisk/max_forwards.h

@@ -17,6 +17,7 @@
  */
 
 #ifndef MAX_FORWARDS_H
+#define MAX_FORWARDS_H
 
 struct ast_channel;
 

include/asterisk/mixmonitor.h

@@ -23,6 +23,9 @@
  * \author Jonathan Rose <jrose@digium.com>
  */
 
+#ifndef ASTERISK_MIX_MONITOR_H
+#define ASTERISK_MIX_MONITOR_H
+
 /*!
  * \brief Start a mixmonitor on a channel.
  * \since 12.0.0
@@ -103,3 +106,5 @@ int ast_start_mixmonitor(struct ast_channel *chan, const char *filename, const c
  * \retval non-zero on failure
  */
 int ast_stop_mixmonitor(struct ast_channel *chan, const char *mixmon_id);
+
+#endif /* ASTERISK_MIX_MONITOR_H */

include/asterisk/parking.h

@@ -23,6 +23,9 @@
  * \author Jonathan Rose <jrose@digium.com>
  */
 
+#ifndef ASTERISK_PARKING_H
+#define ASTERISK_PARKING_H
+
 #include "asterisk/stringfields.h"
 #include "asterisk/bridge.h"
 
@@ -294,3 +297,5 @@ int ast_parking_unregister_bridge_features(const char *module_name);
  * \retval 1 if there is a parking provider regsistered
  */
 int ast_parking_provider_registered(void);
+
+#endif /* ASTERISK_PARKING_H */

include/asterisk/res_pjsip_presence_xml.h

@@ -30,6 +30,9 @@
  * This constant is useful to check against when trying to determine
  * if printing XML succeeded or failed.
  */
+#ifndef ASTERISK_PJSIP_PRESENCE_XML_H
+#define ASTERISK_PJSIP_PRESENCE_XML_H
+
 #define AST_PJSIP_XML_PROLOG_LEN 39
 
 /*!
@@ -115,3 +118,5 @@ pj_xml_node *ast_sip_presence_xml_create_node(pj_pool_t *pool,
 void ast_sip_presence_xml_find_node_attr(pj_pool_t* pool,
 		pj_xml_node *parent, const char *node_name, const char *attr_name,
 		pj_xml_node **node, pj_xml_attr **attr);
+
+#endif /* ASTERISK_PJSIP_PRESENCE_XML_H */

include/asterisk/slin.h

@@ -22,6 +22,9 @@
  * Samples were truncated at 160 and 320 bytes.
  */
 
+#ifndef ASTERISK_SLIN_H
+#define ASTERISK_SLIN_H
+
 static uint16_t ex_slin8[] = {
 	0x0002, 0xfffc, 0x0000, 0xfffe, 0x0000, 0xfffa, 0x002a, 0x007a,
 	0x003a, 0xffbe, 0xff76, 0xff84, 0x0016, 0x007e, 0x0096, 0x00d2,
@@ -91,3 +94,5 @@ static inline struct ast_frame *slin16_sample(void)
 
 	return &f;
 }
+
+#endif /* ASTERISK_SLIN_H */

main/app.c

@@ -1504,7 +1504,7 @@ static int __ast_play_and_record(struct ast_channel *chan, const char *playfile,
 	char comment[256];
 	int x, fmtcnt = 1, res = -1, outmsg = 0;
 	struct ast_filestream *others[AST_MAX_FORMATS];
-	char *sfmt[AST_MAX_FORMATS];
+	const char *sfmt[AST_MAX_FORMATS];
 	char *stringp = NULL;
 	time_t start, end;
 	struct ast_dsp *sildet = NULL;   /* silence detector dsp */
@@ -1579,7 +1579,12 @@ static int __ast_play_and_record(struct ast_channel *chan, const char *playfile,
 			ast_log(LOG_WARNING, "Please increase AST_MAX_FORMATS in file.h\n");
 			break;
 		}
-		sfmt[fmtcnt++] = ast_strdupa(fmt);
+		/*
+		 * Storage for 'fmt' is on the stack and held by 'fmts', which is maintained for
+		 * the rest of this function. So okay to not duplicate 'fmt' here, but only keep
+		 * a pointer to it.
+		 */
+		sfmt[fmtcnt++] = fmt;
 	}
 
 	end = start = time(NULL);  /* pre-initialize end to be same as start in case we never get into loop */

main/asterisk.c

@@ -3491,10 +3491,11 @@ static void main_atexit(void)
 int main(int argc, char *argv[])
 {
 	int c;
-	char * xarg = NULL;
 	int x;
 	int isroot = 1, rundir_exists = 0;
-	const char *runuser = NULL, *rungroup = NULL;
+	RAII_VAR(char *, runuser, NULL, ast_free);
+	RAII_VAR(char *, rungroup, NULL, ast_free);
+	RAII_VAR(char *, xarg, NULL, ast_free);
 	struct rlimit l;
 	static const char *getopt_settings = "BC:cde:FfG:ghIiL:M:mnpqRrs:TtU:VvWXx:";
 
@@ -3599,7 +3600,7 @@ int main(int argc, char *argv[])
 			break;
 #endif
 		case 'G':
-			rungroup = ast_strdupa(optarg);
+			rungroup = ast_strdup(optarg);
 			break;
 		case 'g':
 			ast_set_flag(&ast_options, AST_OPT_FLAG_DUMP_CORE);
@@ -3655,7 +3656,7 @@ int main(int argc, char *argv[])
 			ast_set_flag(&ast_options, AST_OPT_FLAG_CACHE_RECORD_FILES);
 			break;
 		case 'U':
-			runuser = ast_strdupa(optarg);
+			runuser = ast_strdup(optarg);
 			break;
 		case 'V':
 		case 'v':
@@ -3670,7 +3671,7 @@ int main(int argc, char *argv[])
 			ast_set_flag(&ast_options, AST_OPT_FLAG_NO_FORK | AST_OPT_FLAG_REMOTE);
 
 			ast_set_flag(&ast_options, AST_OPT_FLAG_EXEC | AST_OPT_FLAG_NO_COLOR);
-			xarg = ast_strdupa(optarg);
+			xarg = ast_strdup(optarg);
 			break;
 		case '?':
 			/* already processed. */
@@ -3749,9 +3750,9 @@ int main(int argc, char *argv[])
 #endif /* !defined(CONFIGURE_RAN_AS_ROOT) */
 
 	if ((!rungroup) && !ast_strlen_zero(ast_config_AST_RUN_GROUP))
-		rungroup = ast_config_AST_RUN_GROUP;
+		rungroup = ast_strdup(ast_config_AST_RUN_GROUP);
 	if ((!runuser) && !ast_strlen_zero(ast_config_AST_RUN_USER))
-		runuser = ast_config_AST_RUN_USER;
+		runuser = ast_strdup(ast_config_AST_RUN_USER);
 
 	/* Must install this signal handler up here to ensure that if the canary
 	 * fails to execute that it doesn't kill the Asterisk process.

main/event.c

@@ -419,7 +419,7 @@ struct ast_event *ast_event_new(enum ast_event_type type, ...)
 		ie_type != AST_EVENT_IE_END;
 		ie_type = va_arg(ap, enum ast_event_ie_type))
 	{
-		struct ast_event_ie_val *ie_value = ast_alloca(sizeof(*ie_value));
+		struct ast_event_ie_val *ie_value = ast_malloc(sizeof(*ie_value));
 		int insert = 0;
 
 		memset(ie_value, 0, sizeof(*ie_value));
@@ -443,7 +443,7 @@ struct ast_event *ast_event_new(enum ast_event_type type, ...)
 		{
 			void *data = va_arg(ap, void *);
 			size_t datalen = va_arg(ap, size_t);
-			ie_value->payload.raw = ast_alloca(datalen);
+			ie_value->payload.raw = ast_malloc(datalen);
 			memcpy(ie_value->payload.raw, data, datalen);
 			ie_value->raw_datalen = datalen;
 			insert = 1;
@@ -491,7 +491,7 @@ struct ast_event *ast_event_new(enum ast_event_type type, ...)
 
 		/* realloc inside one of the append functions failed */
 		if (!event) {
-			return NULL;
+			goto cleanup;
 		}
 	}
 
@@ -501,6 +501,17 @@ struct ast_event *ast_event_new(enum ast_event_type type, ...)
 		ast_event_append_eid(&event);
 	}
 
+cleanup:
+	AST_LIST_TRAVERSE_SAFE_BEGIN(&ie_vals, ie_val, entry) {
+		AST_LIST_REMOVE_CURRENT(entry);
+
+		if (ie_val->ie_pltype == AST_EVENT_IE_PLTYPE_RAW) {
+			ast_free(ie_val->payload.raw);
+		}
+		ast_free(ie_val);
+	}
+	AST_LIST_TRAVERSE_SAFE_END;
+
 	return event;
 }
 

main/file.c

@@ -517,7 +517,9 @@ static int filehelper(const char *filename, const void *arg2, const char *fmt, c
 	AST_RWLIST_RDLOCK(&formats);
 	/* Check for a specific format */
 	AST_RWLIST_TRAVERSE(&formats, f, list) {
-		char *stringp, *ext = NULL;
+		char *ext = NULL;
+		char storage[strlen(f->exts) + 1];
+		char *stringp;
 
 		if (fmt && !exts_compare(f->exts, fmt))
 			continue;
@@ -526,7 +528,8 @@ static int filehelper(const char *filename, const void *arg2, const char *fmt, c
 		 * The file must exist, and for OPEN, must match
 		 * one of the formats supported by the channel.
 		 */
-		stringp = ast_strdupa(f->exts);	/* this is in the stack so does not need to be freed */
+		strcpy(storage, f->exts); /* safe - this is in the stack so does not need to be freed */
+		stringp = storage;
 		while ( (ext = strsep(&stringp, "|")) ) {
 			struct stat st;
 			char *fn = build_filename(filename, ext);
@@ -1407,13 +1410,13 @@ struct ast_filestream *ast_writefile(const char *filename, const char *type, con
 			  We touch orig_fn just as a place-holder so other things (like vmail) see the file is there.
 			  What we are really doing is writing to record_cache_dir until we are done then we will mv the file into place.
 			*/
-			orig_fn = ast_strdupa(fn);
+			orig_fn = ast_strdup(fn);
 			for (c = fn; *c; c++)
 				if (*c == '/')
 					*c = '_';
 
 			size = strlen(fn) + strlen(record_cache_dir) + 2;
-			buf = ast_alloca(size);
+			buf = ast_malloc(size);
 			strcpy(buf, record_cache_dir);
 			strcat(buf, "/");
 			strcat(buf, fn);
@@ -1444,14 +1447,18 @@ struct ast_filestream *ast_writefile(const char *filename, const char *type, con
 				if (orig_fn) {
 					unlink(fn);
 					unlink(orig_fn);
+					ast_free(orig_fn);
 				}
 				if (fs) {
 					ast_closestream(fs);
 					fs = NULL;
 				}
-				if (!buf) {
+				/*
-					ast_free(fn);
+				 * 'fn' was has either been allocated from build_filename, or that was freed
-				}
+				 * and now 'fn' points to memory allocated for 'buf'. Either way the memory
+				 * now needs to be released.
+				 */
+				ast_free(fn);
 				continue;
 			}
 			fs->trans = NULL;
@@ -1459,8 +1466,14 @@ struct ast_filestream *ast_writefile(const char *filename, const char *type, con
 			fs->flags = flags;
 			fs->mode = mode;
 			if (orig_fn) {
-				fs->realfilename = ast_strdup(orig_fn);
+				fs->realfilename = orig_fn;
-				fs->filename = ast_strdup(fn);
+				fs->filename = fn;
+				/*
+				 * The above now manages the memory allocated for 'orig_fn' and 'fn', so
+				 * set them to NULL, so they don't get released at the end of the loop.
+				 */
+				orig_fn = NULL;
+				fn = NULL;
 			} else {
 				fs->realfilename = NULL;
 				fs->filename = ast_strdup(filename);
@@ -1473,9 +1486,9 @@ struct ast_filestream *ast_writefile(const char *filename, const char *type, con
 			if (orig_fn)
 				unlink(orig_fn);
 		}
-		/* if buf != NULL then fn is already free and pointing to it */
+		/* Free 'fn', or if 'fn' points to 'buf' then free 'buf' */
-		if (!buf)
+		ast_free(fn);
-			ast_free(fn);
+		ast_free(orig_fn);
 	}
 
 	AST_RWLIST_UNLOCK(&formats);

main/indications.c

@@ -904,11 +904,11 @@ static void store_tone_zone_ring_cadence(struct ast_tone_zone *zone, const char
 	ast_copy_string(buf, val, sizeof(buf));
 
 	while ((ring = strsep(&c, ","))) {
-		int *tmp, val;
+		int *tmp, value;
 
 		ring = ast_strip(ring);
 
-		if (!isdigit(ring[0]) || (val = atoi(ring)) == -1) {
+		if (!isdigit(ring[0]) || (value = atoi(ring)) == -1) {
 			ast_log(LOG_WARNING, "Invalid ringcadence given '%s'.\n", ring);
 			continue;
 		}
@@ -918,7 +918,7 @@ static void store_tone_zone_ring_cadence(struct ast_tone_zone *zone, const char
 		}
 
 		zone->ringcadence = tmp;
-		tmp[zone->nrringcadence] = val;
+		tmp[zone->nrringcadence] = value;
 		zone->nrringcadence++;
 	}
 }

main/manager.c

@@ -1619,7 +1619,7 @@ struct mansession {
 	struct ast_iostream *stream;
 	struct ast_tcptls_session_instance *tcptls_session;
 	enum mansession_message_parsing parsing;
-	int write_error:1;
+	unsigned int write_error:1;
 	struct manager_custom_hook *hook;
 	ast_mutex_t lock;
 };
@@ -3820,8 +3820,8 @@ static enum error_type handle_updates(struct mansession *s, const struct message
 		int allowdups = 0;
 		int istemplate = 0;
 		int ignoreerror = 0;
-		char *inherit = NULL;
+		RAII_VAR(char *, inherit, NULL, ast_free);
-		char *catfilter = NULL;
+		RAII_VAR(char *, catfilter, NULL, ast_free);
 		char *token;
 		int foundvar = 0;
 		int foundcat = 0;
@@ -3859,7 +3859,9 @@ static enum error_type handle_updates(struct mansession *s, const struct message
 		snprintf(hdr, sizeof(hdr), "Options-%06d", x);
 		options = astman_get_header(m, hdr);
 		if (!ast_strlen_zero(options)) {
-			dupoptions = ast_strdupa(options);
+			char copy[strlen(options) + 1];
+			strcpy(copy, options); /* safe */
+			dupoptions = copy;
 			while ((token = ast_strsep(&dupoptions, ',', AST_STRSEP_STRIP))) {
 				if (!strcasecmp("allowdups", token)) {
 					allowdups = 1;
@@ -3877,7 +3879,7 @@ static enum error_type handle_updates(struct mansession *s, const struct message
 					char *c = ast_strsep(&token, '=', AST_STRSEP_STRIP);
 					c = ast_strsep(&token, '=', AST_STRSEP_STRIP);
 					if (c) {
-						inherit = ast_strdupa(c);
+						inherit = ast_strdup(c);
 					}
 					continue;
 				}
@@ -3885,7 +3887,7 @@ static enum error_type handle_updates(struct mansession *s, const struct message
 					char *c = ast_strsep(&token, '=', AST_STRSEP_STRIP);
 					c = ast_strsep(&token, '=', AST_STRSEP_STRIP);
 					if (c) {
-						catfilter = ast_strdupa(c);
+						catfilter = ast_strdup(c);
 					}
 					continue;
 				}

main/pbx_variables.c

@@ -630,9 +630,8 @@ void pbx_substitute_variables_helper_full(struct ast_channel *c, struct varshead
 	/* Substitutes variables into cp2, based on string cp1, cp2 NO LONGER NEEDS TO BE ZEROED OUT!!!!  */
 	const char *whereweare;
 	const char *orig_cp2 = cp2;
-	char *workspace = NULL;
+	char ltmp[VAR_BUF_SIZE];
-	char *ltmp = NULL;
+	char var[VAR_BUF_SIZE];
-	char *var = NULL;
 
 	*cp2 = 0; /* just in case nothing ends up there */
 	whereweare = cp1;
@@ -690,6 +689,7 @@ void pbx_substitute_variables_helper_full(struct ast_channel *c, struct varshead
 			int offset2;
 			int isfunction;
 			char *cp4;
+			char workspace[VAR_BUF_SIZE] = "";
 
 			/* We have a variable.  Find the start and end, and determine
 			   if we are going to have to recursively call ourselves on the
@@ -725,28 +725,17 @@ void pbx_substitute_variables_helper_full(struct ast_channel *c, struct varshead
 			/* Skip totally over variable string */
 			whereweare = vare;
 
-			if (!var)
-				var = ast_alloca(VAR_BUF_SIZE);
-
 			/* Store variable name expression to lookup (and truncate). */
 			ast_copy_string(var, vars, len + 1);
 
 			/* Substitute if necessary */
 			if (needsub) {
-				if (!ltmp) {
-					ltmp = ast_alloca(VAR_BUF_SIZE);
-				}
 				pbx_substitute_variables_helper_full(c, headp, var, ltmp, VAR_BUF_SIZE - 1, NULL);
 				vars = ltmp;
 			} else {
 				vars = var;
 			}
 
-			if (!workspace)
-				workspace = ast_alloca(VAR_BUF_SIZE);
-
-			workspace[0] = '\0';
-
 			parse_variable_name(vars, &offset, &offset2, &isfunction);
 			if (isfunction) {
 				/* Evaluate function */
@@ -820,17 +809,11 @@ void pbx_substitute_variables_helper_full(struct ast_channel *c, struct varshead
 			/* Skip totally over expression */
 			whereweare = vare;
 
-			if (!var)
-				var = ast_alloca(VAR_BUF_SIZE);
-
 			/* Store expression to evaluate (and truncate). */
 			ast_copy_string(var, vars, len + 1);
 
 			/* Substitute if necessary */
 			if (needsub) {
-				if (!ltmp) {
-					ltmp = ast_alloca(VAR_BUF_SIZE);
-				}
 				pbx_substitute_variables_helper_full(c, headp, var, ltmp, VAR_BUF_SIZE - 1, NULL);
 				vars = ltmp;
 			} else {

main/stasis.c

@@ -301,7 +301,7 @@
 #define TOPIC_POOL_BUCKETS 57
 
 /*! Thread pool for topics that don't want a dedicated taskprocessor */
-static struct ast_threadpool *pool;
+static struct ast_threadpool *threadpool;
 
 STASIS_MESSAGE_TYPE_DEFN(stasis_subscription_change_type);
 
@@ -900,7 +900,7 @@ struct stasis_subscription *internal_stasis_subscribe(
 		 * pool should be used.
 		 */
 		if (use_thread_pool) {
-			sub->mailbox = ast_threadpool_serializer(tps_name, pool);
+			sub->mailbox = ast_threadpool_serializer(tps_name, threadpool);
 		} else {
 			sub->mailbox = ast_taskprocessor_get(tps_name, TPS_REF_DEFAULT);
 		}
@@ -3027,8 +3027,8 @@ static void stasis_cleanup(void)
 	ast_cli_unregister_multiple(cli_stasis, ARRAY_LEN(cli_stasis));
 	ao2_cleanup(topic_all);
 	topic_all = NULL;
-	ast_threadpool_shutdown(pool);
+	ast_threadpool_shutdown(threadpool);
-	pool = NULL;
+	threadpool = NULL;
 	STASIS_MESSAGE_TYPE_CLEANUP(stasis_subscription_change_type);
 	STASIS_MESSAGE_TYPE_CLEANUP(ast_multi_user_event_type);
 	aco_info_destroy(&cfg_info);
@@ -3105,9 +3105,9 @@ int stasis_init(void)
 	threadpool_opts.auto_increment = 1;
 	threadpool_opts.max_size = cfg->threadpool_options->max_size;
 	threadpool_opts.idle_timeout = cfg->threadpool_options->idle_timeout_sec;
-	pool = ast_threadpool_create("stasis", NULL, &threadpool_opts);
+	threadpool = ast_threadpool_create("stasis", NULL, &threadpool_opts);
 	ao2_ref(cfg, -1);
-	if (!pool) {
+	if (!threadpool) {
 		ast_log(LOG_ERROR, "Failed to create 'stasis-core' threadpool\n");
 
 		return -1;

main/stasis_cache.c

@@ -863,13 +863,13 @@ static void caching_topic_exec(void *data, struct stasis_subscription *sub,
 		 * continue to grow unabated.
 		 */
 		if (strcmp(change->description, "Unsubscribe") == 0) {
-			struct stasis_cache_entry *sub;
+			struct stasis_cache_entry *cached_sub;
 
 			ao2_wrlock(caching_topic->cache->entries);
-			sub = cache_find(caching_topic->cache->entries, stasis_subscription_change_type(), change->uniqueid);
+			cached_sub = cache_find(caching_topic->cache->entries, stasis_subscription_change_type(), change->uniqueid);
-			if (sub) {
+			if (cached_sub) {
-				ao2_cleanup(cache_remove(caching_topic->cache->entries, sub, stasis_message_eid(message)));
+				ao2_cleanup(cache_remove(caching_topic->cache->entries, cached_sub, stasis_message_eid(message)));
-				ao2_cleanup(sub);
+				ao2_cleanup(cached_sub);
 			}
 			ao2_unlock(caching_topic->cache->entries);
 			ao2_cleanup(caching_topic_needs_unref);

res/ari/config.c

@@ -165,7 +165,7 @@ static struct aco_type user_option = {
 	.item_offset = offsetof(struct ast_ari_conf, users),
 };
 
-static struct aco_type *user[] = ACO_TYPES(&user_option);
+static struct aco_type *global_user[] = ACO_TYPES(&user_option);
 
 static void conf_general_dtor(void *obj)
 {
@@ -361,16 +361,16 @@ int ast_ari_config_init(void)
 		"", channelvars_handler, 0);
 
 	/* ARI type=user category options */
-	aco_option_register(&cfg_info, "type", ACO_EXACT, user, NULL,
+	aco_option_register(&cfg_info, "type", ACO_EXACT, global_user, NULL,
 		OPT_NOOP_T, 0, 0);
-	aco_option_register(&cfg_info, "read_only", ACO_EXACT, user,
+	aco_option_register(&cfg_info, "read_only", ACO_EXACT, global_user,
 		"no", OPT_BOOL_T, 1,
 		FLDSET(struct ast_ari_conf_user, read_only));
-	aco_option_register(&cfg_info, "password", ACO_EXACT, user,
+	aco_option_register(&cfg_info, "password", ACO_EXACT, global_user,
 		"", OPT_CHAR_ARRAY_T, 0,
 		FLDSET(struct ast_ari_conf_user, password), ARI_PASSWORD_LEN);
 	aco_option_register_custom(&cfg_info, "password_format", ACO_EXACT,
-		user, "plain",  password_format_handler, 0);
+		global_user, "plain",  password_format_handler, 0);
 
 	return process_config(0);
 }

res/parking/parking_bridge_features.c

@@ -69,7 +69,7 @@ struct parked_subscription_datastore {
 struct parked_subscription_data {
 	struct transfer_channel_data *transfer_data;
 	char *parkee_uuid;
-	int hangup_after:1;
+	unsigned int hangup_after:1;
 	char parker_uuid[0];
 };
 

res/parking/res_parking.h

@@ -23,6 +23,9 @@
  * \author Jonathan Rose <jrose@digium.com>
  */
 
+#ifndef ASTERISK_RES_PARKING_H
+#define ASTERISK_RES_PARKING_H
+
 #include "asterisk/pbx.h"
 #include "asterisk/bridge.h"
 #include "asterisk/parking.h"
@@ -574,3 +577,5 @@ int load_parking_tests(void);
  * \return Nothing
  */
 void unload_parking_tests(void);
+
+#endif /* ASTERISK_RES_PARKING_H */

res/res_config_curl.c

@@ -156,7 +156,7 @@ static struct ast_config *realtime_multi_curl(const char *url, const char *unuse
 	for (field = fields; field; field = field->next) {
 		if (start) {
 			char *op;
-			initfield = ast_strdupa(field->name);
+			initfield = ast_strdup(field->name);
 			if ((op = strchr(initfield, ' ')))
 				*op = '\0';
 		}
@@ -172,6 +172,7 @@ static struct ast_config *realtime_multi_curl(const char *url, const char *unuse
 	ast_str_substitute_variables(&buffer, 0, NULL, ast_str_buffer(query));
 
 	if (!(cfg = ast_config_new())) {
+		ast_free(initfield);
 		return NULL;
 	}
 
@@ -206,6 +207,8 @@ static struct ast_config *realtime_multi_curl(const char *url, const char *unuse
 		ast_category_append(cfg, cat);
 	}
 
+	ast_free(initfield);
+
 	return cfg;
 }
 

res/res_phoneprov.c

@@ -607,13 +607,14 @@ static void build_profile(const char *name, struct ast_variable *v)
 		if (!strcasecmp(v->name, "mime_type")) {
 			ast_string_field_set(profile, default_mime_type, v->value);
 		} else if (!strcasecmp(v->name, "setvar")) {
-			char *value_copy = ast_strdupa(v->value);
+			char value_copy[strlen(v->value) + 1];
 
 			AST_DECLARE_APP_ARGS(args,
 				AST_APP_ARG(varname);
 				AST_APP_ARG(varval);
 			);
 
+			strcpy(value_copy, v->value); /* safe */
 			AST_NONSTANDARD_APP_ARGS(args, value_copy, '=');
 			do {
 				if (ast_strlen_zero(args.varname) || ast_strlen_zero(args.varval))
@@ -629,7 +630,7 @@ static void build_profile(const char *name, struct ast_variable *v)
 		} else {
 			struct phoneprov_file *pp_file;
 			char *file_extension;
-			char *value_copy = ast_strdupa(v->value);
+			char value_copy[strlen(v->value) + 1];
 
 			AST_DECLARE_APP_ARGS(args,
 				AST_APP_ARG(filename);
@@ -644,6 +645,7 @@ static void build_profile(const char *name, struct ast_variable *v)
 			if ((file_extension = strrchr(pp_file->format, '.')))
 				file_extension++;
 
+			strcpy(value_copy, v->value); /* safe */
 			AST_STANDARD_APP_ARGS(args, value_copy);
 
 			/* Mime type order of preference

res/res_pjsip/config_system.c

@@ -83,7 +83,7 @@ static void *system_alloc(const char *name)
 	return system;
 }
 
-static int system_apply(const struct ast_sorcery *system_sorcery, void *obj)
+static int system_apply(const struct ast_sorcery *sorcery, void *obj)
 {
 	struct system_config *system = obj;
 	int min_timerb;

res/res_pjsip/config_transport.c

@@ -1347,10 +1347,19 @@ static int transport_localnet_handler(const struct aco_option *opt, struct ast_v
 	return error;
 }
 
+static void localnet_to_vl_append(struct ast_variable **head, struct ast_ha *ha)
+{
+	char str[MAX_OBJECT_FIELD];
+	const char *addr = ast_strdupa(ast_sockaddr_stringify_addr(&ha->addr));
+	snprintf(str, MAX_OBJECT_FIELD, "%s%s/%s", ha->sense == AST_SENSE_ALLOW ? "!" : "",
+			 addr, ast_sockaddr_stringify_addr(&ha->netmask));
+
+	ast_variable_list_append(head, ast_variable_new("local_net", str, ""));
+}
+
 static int localnet_to_vl(const void *obj, struct ast_variable **fields)
 {
 	const struct ast_sip_transport *transport = obj;
-	char str[MAX_OBJECT_FIELD];
 	struct ast_variable *head = NULL;
 	struct ast_ha *ha;
 	RAII_VAR(struct ast_sip_transport_state *, state, find_state_by_transport(transport), ao2_cleanup);
@@ -1360,11 +1369,7 @@ static int localnet_to_vl(const void *obj, struct ast_variable **fields)
 	}
 
 	for (ha = state->localnet; ha; ha = ha->next) {
-		const char *addr = ast_strdupa(ast_sockaddr_stringify_addr(&ha->addr));
+		localnet_to_vl_append(&head, ha);
-		snprintf(str, MAX_OBJECT_FIELD, "%s%s/%s", ha->sense == AST_SENSE_ALLOW ? "!" : "",
-			addr, ast_sockaddr_stringify_addr(&ha->netmask));
-
-		ast_variable_list_append(&head, ast_variable_new("local_net", str, ""));
 	}
 
 	if (head) {

res/res_pjsip/pjsip_resolver.c

@@ -665,7 +665,7 @@ static void sip_check_transport(pj_pool_t *pool, pjsip_transport_type_e transpor
 }
 
 /*! \brief External resolver implementation for PJSIP */
-static pjsip_ext_resolver resolver = {
+static pjsip_ext_resolver ext_resolver = {
 	.resolve = sip_resolve,
 };
 
@@ -697,7 +697,7 @@ static int sip_replace_resolver(void *data)
 	pjsip_endpt_release_pool(ast_sip_get_pjsip_endpoint(), pool);
 
 	/* Replace the PJSIP resolver with our own implementation */
-	pjsip_endpt_set_ext_resolver(ast_sip_get_pjsip_endpoint(), &resolver);
+	pjsip_endpt_set_ext_resolver(ast_sip_get_pjsip_endpoint(), &ext_resolver);
 	return 0;
 }
 

res/res_pjsip_endpoint_identifier_ip.c

@@ -551,20 +551,24 @@ static int match_to_str(const void *obj, const intptr_t *args, char **buf)
 	return 0;
 }
 
-static int match_to_var_list(const void *obj, struct ast_variable **fields)
+static void match_to_var_list_append(struct ast_variable **head, struct ast_ha *ha)
 {
 	char str[MAX_OBJECT_FIELD];
+	const char *addr = ast_strdupa(ast_sockaddr_stringify_addr(&ha->addr));
+	snprintf(str, MAX_OBJECT_FIELD, "%s%s/%s", ha->sense == AST_SENSE_ALLOW ? "!" : "",
+			 addr, ast_sockaddr_stringify_addr(&ha->netmask));
+
+	ast_variable_list_append(head, ast_variable_new("match", str, ""));
+}
+
+static int match_to_var_list(const void *obj, struct ast_variable **fields)
+{
 	const struct ip_identify_match *identify = obj;
 	struct ast_variable *head = NULL;
 	struct ast_ha *ha = identify->matches;
 
 	for (; ha; ha = ha->next) {
-		const char *addr = ast_strdupa(ast_sockaddr_stringify_addr(&ha->addr));
+		match_to_var_list_append(&head, ha);
-		snprintf(str, MAX_OBJECT_FIELD, "%s%s/%s", ha->sense == AST_SENSE_ALLOW ? "!" : "",
-			addr, ast_sockaddr_stringify_addr(&ha->netmask));
-
-		ast_variable_list_append(&head, ast_variable_new("match", str, ""));
-
 	}
 
 	if (head) {

res/res_pjsip_registrar.c

@@ -1018,9 +1018,9 @@ static struct ast_sip_aor *find_registrar_aor(struct pjsip_rx_data *rdata, struc
 		case AST_SIP_ENDPOINT_IDENTIFY_BY_USERNAME:
 			uri = pjsip_uri_get_uri(rdata->msg_info.to->uri);
 
-			domain_name = ast_alloca(uri->host.slen + 1);
+			domain_name = ast_malloc(uri->host.slen + 1);
 			ast_copy_pj_str(domain_name, &uri->host, uri->host.slen + 1);
-			username = ast_alloca(uri->user.slen + 1);
+			username = ast_malloc(uri->user.slen + 1);
 			ast_copy_pj_str(username, &uri->user, uri->user.slen + 1);
 
 			/*
@@ -1038,9 +1038,9 @@ static struct ast_sip_aor *find_registrar_aor(struct pjsip_rx_data *rdata, struc
 			while ((header = pjsip_msg_find_hdr(rdata->msg_info.msg, PJSIP_H_AUTHORIZATION,
 				header ? header->next : NULL))) {
 				if (header && !pj_stricmp2(&header->scheme, "digest")) {
-					username = ast_alloca(header->credential.digest.username.slen + 1);
+					username = ast_malloc(header->credential.digest.username.slen + 1);
 					ast_copy_pj_str(username, &header->credential.digest.username, header->credential.digest.username.slen + 1);
-					domain_name = ast_alloca(header->credential.digest.realm.slen + 1);
+					domain_name = ast_malloc(header->credential.digest.realm.slen + 1);
 					ast_copy_pj_str(domain_name, &header->credential.digest.realm, header->credential.digest.realm.slen + 1);
 
 					aor_name = find_aor_name(username, domain_name, endpoint->aors);
@@ -1058,6 +1058,9 @@ static struct ast_sip_aor *find_registrar_aor(struct pjsip_rx_data *rdata, struc
 		if (aor_name) {
 			break;
 		}
+
+		ast_free(domain_name);
+		ast_free(username);
 	}
 
 	if (ast_strlen_zero(aor_name) || !(aor = ast_sip_location_retrieve_aor(aor_name))) {
@@ -1068,6 +1071,8 @@ static struct ast_sip_aor *find_registrar_aor(struct pjsip_rx_data *rdata, struc
 			username ?: "", ast_sorcery_object_get_id(endpoint));
 	}
 	ast_free(aor_name);
+	ast_free(domain_name);
+	ast_free(username);
 	return aor;
 }
 

res/res_pjsip_t38.c

@@ -537,13 +537,13 @@ static struct ast_frame *t38_framehook(struct ast_channel *chan, struct ast_fram
 	if (f->frametype == AST_FRAME_CONTROL
 		&& f->subclass.integer == AST_CONTROL_T38_PARAMETERS) {
 		if (channel->session->endpoint->media.t38.enabled) {
-			struct t38_parameters_task_data *data;
+			struct t38_parameters_task_data *task_data;
 
-			data = t38_parameters_task_data_alloc(channel->session, f);
+			task_data = t38_parameters_task_data_alloc(channel->session, f);
-			if (data
+			if (task_data
 				&& ast_sip_push_task(channel->session->serializer,
-					t38_interpret_parameters, data)) {
+					t38_interpret_parameters, task_data)) {
-				ao2_ref(data, -1);
+				ao2_ref(task_data, -1);
 			}
 		} else {
 			static const struct ast_control_t38_parameters rsp_refused = {

res/res_resolver_unbound.c

@@ -260,11 +260,11 @@ static void unbound_resolver_callback(void *data, int err, struct ub_result *ub_
 	if (!ast_dns_resolver_set_result(query, ub_result->secure, ub_result->bogus, ub_result->rcode,
 		S_OR(ub_result->canonname, ast_dns_query_get_name(query)), ub_result->answer_packet, ub_result->answer_len)) {
 		int i;
-		char *data;
+		char *result_data;
 
-		for (i = 0; (data = ub_result->data[i]); i++) {
+		for (i = 0; (result_data = ub_result->data[i]); i++) {
 			if (ast_dns_resolver_add_record(query, ub_result->qtype, ub_result->qclass, ub_result->ttl,
-				data, ub_result->len[i])) {
+				result_data, ub_result->len[i])) {
 				break;
 			}
 		}

res/res_rtp_asterisk.c

@@ -3087,11 +3087,11 @@ static int __rtp_recvfrom(struct ast_rtp_instance *instance, void *buf, size_t s
 		ao2_ref(ice, -1);
 		ao2_lock(instance);
 		if (status != PJ_SUCCESS) {
-			char buf[100];
+			char err_buf[100];
 
-			pj_strerror(status, buf, sizeof(buf));
+			pj_strerror(status, err_buf, sizeof(err_buf));
 			ast_log(LOG_WARNING, "PJ ICE Rx error status code: %d '%s'.\n",
-				(int)status, buf);
+				(int)status, err_buf);
 			return -1;
 		}
 		if (!rtp->passthrough) {

res/stasis/command.c

@@ -37,7 +37,7 @@ struct stasis_app_command {
 	void *data;
 	command_data_destructor_fn data_destructor;
 	int retval;
-	int is_done:1;
+	unsigned int is_done:1;
 };
 
 static void command_dtor(void *obj)

res/stasis/control.c

@@ -99,7 +99,7 @@ struct stasis_app_control {
 	/*!
 	 * When set, /c app_stasis should exit and continue in the dialplan.
 	 */
-	int is_done:1;
+	unsigned int is_done:1;
 };
 
 static void control_dtor(void *obj)