| Message ID | 20181018123031.19854-1-phil@nwl.cc |
|---|---|
| State | Accepted, archived |
| Delegated to: | stephen hemminger |
| Headers | show |
| Series | [iproute] ip-route: Fix for memleak in error path | expand |
On Thu, 18 Oct 2018 14:30:31 +0200 Phil Sutter <phil@nwl.cc> wrote: > If call to rta_addattr_l() failed, parse_encap_seg6() would leak memory. > Fix this by making sure calls to free() are not skipped. > > Fixes: bd59e5b1517b0 ("ip-route: Fix segfault with many nexthops") > Signed-off-by: Phil Sutter <phil@nwl.cc> Applied, thanks.
diff --git a/ip/iproute_lwtunnel.c b/ip/iproute_lwtunnel.c index 969a4763df71d..85045d4fff742 100644 --- a/ip/iproute_lwtunnel.c +++ b/ip/iproute_lwtunnel.c @@ -498,6 +498,7 @@ static int parse_encap_seg6(struct rtattr *rta, size_t len, int *argcp, int argc = *argcp; int encap = -1; __u32 hmac = 0; + int ret = 0; int srhlen; while (argc > 0) { @@ -539,16 +540,19 @@ static int parse_encap_seg6(struct rtattr *rta, size_t len, int *argcp, memcpy(tuninfo->srh, srh, srhlen); if (rta_addattr_l(rta, len, SEG6_IPTUNNEL_SRH, tuninfo, - sizeof(*tuninfo) + srhlen)) - return -1; - - free(tuninfo); - free(srh); + sizeof(*tuninfo) + srhlen)) { + ret = -1; + goto out; + } *argcp = argc + 1; *argvp = argv - 1; - return 0; +out: + free(tuninfo); + free(srh); + + return ret; } struct lwt_x {
If call to rta_addattr_l() failed, parse_encap_seg6() would leak memory. Fix this by making sure calls to free() are not skipped. Fixes: bd59e5b1517b0 ("ip-route: Fix segfault with many nexthops") Signed-off-by: Phil Sutter <phil@nwl.cc> --- ip/iproute_lwtunnel.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)