diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-08-17 04:41:32 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-08-18 01:58:49 +0200 |
commit | 37268a018e99181a1d203f0a8a6fc5c6670d09b2 (patch) | |
tree | b11ab2fd2ba8b0ef8777eb6739cf09bc65b1187d /src/expr/immediate.c | |
parent | 6e188637782c6c62c7bcade808e59d17639d677d (diff) |
expr: immediate: fix leak in expression destroy path
The verdict can be a chain string, make sure we release it when the expression
is destroyed. This patch adds a new nft_free_data() for this purpose and use it
from the immediate expression.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/expr/immediate.c')
-rw-r--r-- | src/expr/immediate.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/expr/immediate.c b/src/expr/immediate.c index 692d9e9..cf06190 100644 --- a/src/expr/immediate.c +++ b/src/expr/immediate.c @@ -309,10 +309,19 @@ nft_rule_expr_immediate_snprintf(char *buf, size_t len, uint32_t type, return -1; } +static void nft_rule_expr_immediate_free(struct nft_rule_expr *e) +{ + struct nft_expr_immediate *imm = nft_expr_data(e); + + if (e->flags & (1 << NFT_EXPR_IMM_VERDICT)) + nft_free_verdict(&imm->data); +} + struct expr_ops expr_ops_immediate = { .name = "immediate", .alloc_len = sizeof(struct nft_expr_immediate), .max_attr = NFTA_IMMEDIATE_MAX, + .free = nft_rule_expr_immediate_free, .set = nft_rule_expr_immediate_set, .get = nft_rule_expr_immediate_get, .parse = nft_rule_expr_immediate_parse, |