diff options
| author | Phil Sutter <phil@nwl.cc> | 2018-03-01 15:00:29 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-03-02 11:46:56 +0100 |
| commit | edcf3adcf4c4cf58cb0b965b984a512b12181a58 (patch) | |
| tree | c279c10efa0910c43a886fe34aa3d9abcc8318d1 /src | |
| parent | 3570b6bc8b4f136d07121b28cd79b6356e8e969b (diff) | |
evaluate: Fix memleak in stmt_reject_gen_dependency()
The allocated payload expression is not used after returning from that
function, so it needs to be freed again.
Simple test case:
| nft add rule inet t c reject with tcp reset
Valgrind reports definitely lost 144 bytes.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/evaluate.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 54fd6b61..40a9292f 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -2143,8 +2143,10 @@ static int stmt_reject_gen_dependency(struct eval_ctx *ctx, struct stmt *stmt, if (ret <= 0) return ret; - if (payload_gen_dependency(ctx, payload, &nstmt) < 0) - return -1; + if (payload_gen_dependency(ctx, payload, &nstmt) < 0) { + ret = -1; + goto out; + } /* * Unlike payload deps this adds the dependency at the beginning, i.e. @@ -2155,7 +2157,9 @@ static int stmt_reject_gen_dependency(struct eval_ctx *ctx, struct stmt *stmt, * Otherwise we'd log things that won't be rejected. */ list_add(&nstmt->list, &ctx->rule->stmts); - return 0; +out: + xfree(payload); + return ret; } static int stmt_evaluate_reject_inet_family(struct eval_ctx *ctx, |