summaryrefslogtreecommitdiffstats
path: root/iptables
diff options
context:
space:
mode:
authorPhil Sutter <phil@nwl.cc>2019-05-13 19:12:24 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2019-05-15 17:14:40 +0200
commit8b59c16fc3d51bf9d7896d5430910e9014dfda57 (patch)
tree0513382e8f0d964767c17719a0e9201bbd419a4f /iptables
parent10f1d8d3ba0394a8b5669013596190ea2ff38030 (diff)
xtables: Don't leak iter in error path of __nft_chain_zero_counters()
If batch_rule_add() fails, this function leaked the rule iterator object. Fixes: 4c54c892443c2 ("xtables: Catch errors when zeroing rule rounters") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables')
-rw-r--r--iptables/nft.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/iptables/nft.c b/iptables/nft.c
index 6354b7e8..dab1db59 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -3374,8 +3374,10 @@ static int __nft_chain_zero_counters(struct nftnl_chain *c, void *data)
* rule based on its handle only.
*/
nftnl_rule_unset(r, NFTNL_RULE_POSITION);
- if (!batch_rule_add(h, NFT_COMPAT_RULE_REPLACE, r))
+ if (!batch_rule_add(h, NFT_COMPAT_RULE_REPLACE, r)) {
+ nftnl_rule_iter_destroy(iter);
return -1;
+ }
}
r = nftnl_rule_iter_next(iter);
}