From 4fb4ed416b6787cf3293bb2191d9a933f34dde3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Markus=20M=C3=A4kel=C3=A4?= <markus.makela@mariadb.com>
Date: Mon, 16 Jul 2018 05:53:44 +0300
Subject: [PATCH] MXS-1977: Fix protocol and readwritesplit memory leaks

The protocol could leak memory in rare cases where several commands were
queued at the same time. Readwritesplit also didn't free the memory it
acquired via qc_get_table_names.
---
 server/modules/protocol/MySQL/mysql_common.cc |  3 +-
 .../readwritesplit/rwsplit_tmp_table_multi.cc | 36 +++++++++++--------
 2 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/server/modules/protocol/MySQL/mysql_common.cc b/server/modules/protocol/MySQL/mysql_common.cc
index d1b396504..282e4cb38 100644
--- a/server/modules/protocol/MySQL/mysql_common.cc
+++ b/server/modules/protocol/MySQL/mysql_common.cc
@@ -637,8 +637,9 @@ void protocol_remove_srv_command(MySQLProtocol* p)
     }
     else
     {
-        p->protocol_command = *(s->scom_next);
+        server_command_t tmp = *(s->scom_next);
         MXS_FREE(s->scom_next);
+        p->protocol_command = tmp;
     }
 }
 
diff --git a/server/modules/routing/readwritesplit/rwsplit_tmp_table_multi.cc b/server/modules/routing/readwritesplit/rwsplit_tmp_table_multi.cc
index 43e62701c..a9e134eeb 100644
--- a/server/modules/routing/readwritesplit/rwsplit_tmp_table_multi.cc
+++ b/server/modules/routing/readwritesplit/rwsplit_tmp_table_multi.cc
@@ -51,24 +51,32 @@ static bool foreach_table(RWSplitSession* rses, GWBUF* querybuf, bool (*func)(RW
     int n_tables;
     char** tables = qc_get_table_names(querybuf, &n_tables, true);
 
-    for (int i = 0; i < n_tables; i++)
+    if (tables)
     {
-        const char* db = mxs_mysql_get_current_db(rses->client_dcb->session);
-        std::string table;
-
-        if (strchr(tables[i], '.') == NULL)
+        for (int i = 0; i < n_tables; i++)
         {
-            table += db;
-            table += ".";
+            if (rval)
+            {
+                const char* db = mxs_mysql_get_current_db(rses->client_dcb->session);
+                std::string table;
+
+                if (strchr(tables[i], '.') == NULL)
+                {
+                    table += db;
+                    table += ".";
+                }
+
+                table += tables[i];
+
+                if (!func(rses, table))
+                {
+                    rval = false;
+                }
+            }
+            MXS_FREE(tables[i]);
         }
 
-        table += tables[i];
-
-        if (!func(rses, table))
-        {
-            rval = false;
-            break;
-        }
+        MXS_FREE(tables);
     }
 
     return rval;