- Revert back to Z_Malloc from Hunk_FreeTempMemory introduced in r2077 as Hunk_FreeTempMemory must be freed in LIFO order (#5079)

- Introduce SV_ClientFree() to prevent memory leaks r2077 was supposed to fix

code/server/server.h

@@ -348,6 +348,7 @@ void SV_ExecuteClientMessage( client_t *cl, msg_t *msg );
 void SV_UserinfoChanged( client_t *cl );
 
 void SV_ClientEnterWorld( client_t *client, usercmd_t *cmd );
+void SV_FreeClient(client_t *client);
 void SV_DropClient( client_t *drop, const char *reason );
 
 void SV_ExecuteClientCommand( client_t *cl, const char *s, qboolean clientOK );
@@ -466,4 +467,4 @@ void SV_ClipToEntity( trace_t *trace, const vec3_t start, const vec3_t mins, con
 void SV_Netchan_Transmit( client_t *client, msg_t *msg);
 int SV_Netchan_TransmitNextFragment(client_t *client);
 qboolean SV_Netchan_Process( client_t *client, msg_t *msg );
-
+void SV_Netchan_FreeQueue(client_t *client);

code/server/sv_client.c

@@ -579,6 +579,29 @@ gotnewcl:
 	}
 }
 
+/*
+=====================
+SV_FreeClient
+
+Destructor for data allocated in a client structure
+=====================
+*/
+void SV_FreeClient(client_t *client)
+{
+	int index;
+	
+	SV_Netchan_FreeQueue(client);
+	SV_CloseDownload(client);
+	
+	for(index = client->queuedVoipIndex; index < client->queuedVoipPackets; index++)
+	{
+		index %= ARRAY_LEN(client->voipPacket);
+		
+		Z_Free(client->voipPacket[index]);
+	}
+	
+	client->queuedVoipPackets = 0;
+}
 
 /*
 =====================
@@ -612,17 +635,12 @@ void SV_DropClient( client_t *drop, const char *reason ) {
 		}
 	}
 
-	// Kill any download
-	SV_CloseDownload( drop );
+	// Free all allocated data on the client structure
+	SV_FreeClient(drop);
 
 	// tell everyone why they got dropped
 	SV_SendServerCommand( NULL, "print \"%s" S_COLOR_WHITE " %s\n\"", drop->name, reason );
 
-	if (drop->download)	{
-		FS_FCloseFile( drop->download );
-		drop->download = 0;
-	}
-
 	// call the prog function for removing a client
 	// this will remove the body, among other things
 	VM_Call( gvm, GAME_CLIENT_DISCONNECT, drop - svs.clients );
@@ -797,7 +815,7 @@ static void SV_CloseDownload( client_t *cl ) {
 	// Free the temporary buffer space
 	for (i = 0; i < MAX_DOWNLOAD_WINDOW; i++) {
 		if (cl->downloadBlocks[i]) {
-			Hunk_FreeTempMemory(cl->downloadBlocks[i]);
+			Z_Free(cl->downloadBlocks[i]);
 			cl->downloadBlocks[i] = NULL;
 		}
 	}
@@ -1017,7 +1035,7 @@ int SV_WriteDownloadToClient(client_t *cl, msg_t *msg)
 		curindex = (cl->downloadCurrentBlock % MAX_DOWNLOAD_WINDOW);
 
 		if (!cl->downloadBlocks[curindex])
-			cl->downloadBlocks[curindex] = Hunk_AllocateTempMemory(MAX_DOWNLOAD_BLKSIZE);
+			cl->downloadBlocks[curindex] = Z_Malloc(MAX_DOWNLOAD_BLKSIZE);
 
 		cl->downloadBlockSize[curindex] = FS_Read( cl->downloadBlocks[curindex], MAX_DOWNLOAD_BLKSIZE, cl->download );
 
@@ -1195,7 +1213,7 @@ void SV_WriteVoipToClient( client_t *cl, msg_t *msg )
 			MSG_WriteShort(msg, packet->len);
 			MSG_WriteData(msg, packet->data, packet->len);
 			
-			Hunk_FreeTempMemory(packet);
+			Z_Free(packet);
 		}
 
 		cl->queuedVoipPackets -= i;
@@ -1871,13 +1889,12 @@ void SV_UserVoip( client_t *cl, msg_t *msg ) {
 			continue;  // not addressed to this player.
 
 		// Transmit this packet to the client.
-		// !!! FIXME: I don't like this queueing system.
 		if (client->queuedVoipPackets >= ARRAY_LEN(client->voipPacket)) {
 			Com_Printf("Too many VoIP packets queued for client #%d\n", i);
 			continue;  // no room for another packet right now.
 		}
 
-		packet = Hunk_AllocateTempMemory(sizeof(*packet));
+		packet = Z_Malloc(sizeof(*packet));
 		packet->sender = sender;
 		packet->frames = frames;
 		packet->len = packetsize;

code/server/sv_init.c

@@ -760,8 +760,14 @@ void SV_Shutdown( char *finalmsg ) {
 	SV_ClearServer();
 
 	// free server static data
-	if ( svs.clients ) {
-		Z_Free( svs.clients );
+	if(svs.clients)
+	{
+		int index;
+		
+		for(index = 0; index < sv_maxclients->integer; index++)
+			SV_FreeClient(&svs.clients[index]);
+		
+		Z_Free(svs.clients);
 	}
 	Com_Memset( &svs, 0, sizeof( svs ) );
 

code/server/sv_net_chan.c

@@ -130,6 +130,27 @@ static void SV_Netchan_Decode( client_t *client, msg_t *msg ) {
 }
 #endif
 
+
+
+/*
+=================
+SV_Netchan_FreeQueue
+=================
+*/
+void SV_Netchan_FreeQueue(client_t *client)
+{
+	netchan_buffer_t *netbuf, *next;
+	
+	for(netbuf = client->netchan_start_queue; netbuf; netbuf = next)
+	{
+		next = netbuf->next;
+		Z_Free(netbuf);
+	}
+	
+	client->netchan_start_queue = NULL;
+	client->netchan_end_queue = &client->netchan_start_queue;
+}
+
 /*
 =================
 SV_Netchan_TransmitNextInQueue
@@ -159,7 +180,7 @@ void SV_Netchan_TransmitNextInQueue(client_t *client)
 	else
 		Com_DPrintf("#462 Netchan_TransmitNextFragment: remaining queued message\n");
 
-	Hunk_FreeTempMemory(netbuf);
+	Z_Free(netbuf);
 }
 
 /*
@@ -207,7 +228,7 @@ void SV_Netchan_Transmit( client_t *client, msg_t *msg)
 	{
 		netchan_buffer_t *netbuf;
 		Com_DPrintf("#462 SV_Netchan_Transmit: unsent fragments, stacked\n");
-		netbuf = (netchan_buffer_t *) Hunk_AllocateTempMemory(sizeof(netchan_buffer_t));
+		netbuf = (netchan_buffer_t *) Z_Malloc(sizeof(netchan_buffer_t));
 		// store the msg, we can't store it encoded, as the encoding depends on stuff we still have to finish sending
 		MSG_Copy(&netbuf->msg, netbuf->msgBuffer, sizeof( netbuf->msgBuffer ), msg);
 		netbuf->next = NULL;