Free the previous nonce before storing a nextnonce.

auc_digest_info() stores the server-supplied Authentication-Info
nextnonce over cda->cda_ac->ac_nonce without releasing what was there:

	n = auth_get_params(home, info->ai_params, "nextnonce=",
			    &nextnonce, NULL);
	if (n <= 0)
	  return n;
	cda->cda_ac->ac_nonce = nextnonce;

auth_get_params() allocates the new string from `home`, and the pointer
being overwritten is owned by that same home: it came either from the
challenge via auth_digest_challenge_get(), or from an earlier
Authentication-Info through this same assignment.

The consequence is not "one leak per nonce" but "all but the last": the
next challenge calls auth_digest_challenge_free_params(), which does
release ac_nonce - so of N responses carrying nextnonce between two
challenges, N-1 strings are lost. A server that sends
Authentication-Info on every 2xx therefore leaks one nonce string per
response for as long as the credentials stay valid.

Like every other object in this family the block is allocated from a
su_home and stays reachable through the home's block table, so no leak
checker reports it; it shows up only as heap growth proportional to the
response rate.

The free follows the discipline the rest of the file already uses -
auth_digest_challenge_free_params() at auth_digest.c:126, and the
cnonce path in auc_digest_challenge(), both su_free() from ca_home
before replacing. su_free() ignores NULL, so the first nextnonce on a
fresh client is unaffected.

Author: Oleksii Molchanov

libsofia-sip-ua/iptsec/auth_client.c

@@ -907,6 +907,13 @@ static int auc_digest_info(auth_client_t *ca,
   if (n <= 0)
     return n;
 
+  /* The nonce being replaced is owned by this home - it came either from the
+   * challenge, via auth_digest_challenge_get(), or from an earlier
+   * Authentication-Info through this same assignment. Without this free only
+   * the last one is ever released, by auth_digest_challenge_free_params() at
+   * the next challenge, so a server that sends nextnonce on every response
+   * loses one nonce string per response until then. su_free() ignores NULL. */
+  su_free(home, (void *)cda->cda_ac->ac_nonce);
   cda->cda_ac->ac_nonce = nextnonce;
 
   return 1;