From 8b59c16fc3d51bf9d7896d5430910e9014dfda57 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 13 May 2019 19:12:24 +0200 Subject: xtables: Don't leak iter in error path of __nft_chain_zero_counters() If batch_rule_add() fails, this function leaked the rule iterator object. Fixes: 4c54c892443c2 ("xtables: Catch errors when zeroing rule rounters") Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- iptables/nft.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'iptables') diff --git a/iptables/nft.c b/iptables/nft.c index 6354b7e8..dab1db59 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -3374,8 +3374,10 @@ static int __nft_chain_zero_counters(struct nftnl_chain *c, void *data) * rule based on its handle only. */ nftnl_rule_unset(r, NFTNL_RULE_POSITION); - if (!batch_rule_add(h, NFT_COMPAT_RULE_REPLACE, r)) + if (!batch_rule_add(h, NFT_COMPAT_RULE_REPLACE, r)) { + nftnl_rule_iter_destroy(iter); return -1; + } } r = nftnl_rule_iter_next(iter); } -- cgit v1.2.3