matthias
/
iproute2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ip-route: Fix for memleak in error path 

If call to rta_addattr_l() failed, parse_encap_seg6() would leak memory.
Fix this by making sure calls to free() are not skipped.

Fixes: bd59e5b151 ("ip-route: Fix segfault with many nexthops")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
This commit is contained in:
Phil Sutter 2018-10-18 14:30:31 +02:00 committed by Stephen Hemminger
parent 3b0070f6b1
commit e5da392ff8
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
ip/iproute_lwtunnel.c
View File

@ -498,6 +498,7 @@ static int parse_encap_seg6(struct rtattr *rta, size_t len, int *argcp,
int argc = *argcp; int argc = *argcp;
int encap = -1; int encap = -1;
__u32 hmac = 0; __u32 hmac = 0;
int ret = 0;
int srhlen; int srhlen;
while (argc > 0) { while (argc > 0) {
@ -539,16 +540,19 @@ static int parse_encap_seg6(struct rtattr *rta, size_t len, int *argcp,
memcpy(tuninfo->srh, srh, srhlen); memcpy(tuninfo->srh, srh, srhlen);
if (rta_addattr_l(rta, len, SEG6_IPTUNNEL_SRH, tuninfo, if (rta_addattr_l(rta, len, SEG6_IPTUNNEL_SRH, tuninfo,
sizeof(*tuninfo) + srhlen)) sizeof(*tuninfo) + srhlen)) {
return -1; ret = -1;
goto out;
free(tuninfo); }
free(srh);
*argcp = argc + 1; *argcp = argc + 1;
*argvp = argv - 1; *argvp = argv - 1;
return 0; out:
free(tuninfo);
free(srh);
return ret;
} }
struct lwt_x { struct lwt_x {