WPS: Cleanup subscription URL list handling

Do not give the allocated memory to the subscription code since it was
not using it as-is anyway. This makes it easier to understand who owns
the allocation an is responsible of freeing it. This may potentially
fix some memory leaks on error paths.

src/wps/wps_upnp.c

@@ -734,13 +734,13 @@ static int subscription_first_event(struct subscription *s)
 
 
 /**
- * subscription_start - Rremember a UPnP control point to send events to.
+ * subscription_start - Remember a UPnP control point to send events to.
  * @sm: WPS UPnP state machine from upnp_wps_device_init()
- * @callback_urls: malloc' mem given to the subscription
+ * @callback_urls: Callback URLs
  * Returns: %NULL on error, or pointer to new subscription structure.
  */
 struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
-					 char *callback_urls)
+					 const char *callback_urls)
 {
 	struct subscription *s;
 	time_t now = time(NULL);
@@ -780,7 +780,6 @@ struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
 	}
 	wpa_printf(MSG_DEBUG, "WPS UPnP: Subscription %p started with %s",
 		   s, callback_urls);
-	os_free(callback_urls);
 	/* Schedule sending this */
 	event_send_all_later(sm);
 	return s;

src/wps/wps_upnp_i.h

@@ -145,7 +145,7 @@ struct upnp_wps_device_sm {
 /* wps_upnp.c */
 void format_date(struct wpabuf *buf);
 struct subscription * subscription_start(struct upnp_wps_device_sm *sm,
-					 char *callback_urls);
+					 const char *callback_urls);
 struct subscription * subscription_renew(struct upnp_wps_device_sm *sm,
 					 const u8 uuid[UUID_LEN]);
 void subscription_unlink(struct subscription *s);

src/wps/wps_upnp_web.c

@@ -925,7 +925,6 @@ static void web_connection_parse_subscribe(struct upnp_wps_device_sm *sm,
 			ret = HTTP_INTERNAL_SERVER_ERROR;
 			goto error;
 		}
-		callback_urls = NULL;   /* is now owned by subscription */
 	} else {
 		ret = HTTP_PRECONDITION_FAILED;
 		goto error;
@@ -975,6 +974,7 @@ error:
 	*/
 	http_put_empty(buf, ret);
 	http_request_send_and_deinit(req, buf);
+	os_free(callback_urls);
 }