From 0c762f107e6a5f6c56c42c0aba48f6aa9c6f1eef Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 25 Oct 2018 12:24:30 +0200 Subject: [PATCH] ip-route: Fix for memleak in error path Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1602555 Upstream Status: iproute2.git commit e5da392ff8e39 commit e5da392ff8e3979b86cad04b238ffbbc8076e005 Author: Phil Sutter Date: Thu Oct 18 14:30:31 2018 +0200 ip-route: Fix for memleak in error path If call to rta_addattr_l() failed, parse_encap_seg6() would leak memory. Fix this by making sure calls to free() are not skipped. Fixes: bd59e5b1517b0 ("ip-route: Fix segfault with many nexthops") Signed-off-by: Phil Sutter Signed-off-by: Stephen Hemminger --- ip/iproute_lwtunnel.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/ip/iproute_lwtunnel.c b/ip/iproute_lwtunnel.c index 969a476..85045d4 100644 --- a/ip/iproute_lwtunnel.c +++ b/ip/iproute_lwtunnel.c @@ -498,6 +498,7 @@ static int parse_encap_seg6(struct rtattr *rta, size_t len, int *argcp, int argc = *argcp; int encap = -1; __u32 hmac = 0; + int ret = 0; int srhlen; while (argc > 0) { @@ -539,16 +540,19 @@ static int parse_encap_seg6(struct rtattr *rta, size_t len, int *argcp, memcpy(tuninfo->srh, srh, srhlen); if (rta_addattr_l(rta, len, SEG6_IPTUNNEL_SRH, tuninfo, - sizeof(*tuninfo) + srhlen)) - return -1; - - free(tuninfo); - free(srh); + sizeof(*tuninfo) + srhlen)) { + ret = -1; + goto out; + } *argcp = argc + 1; *argvp = argv - 1; - return 0; +out: + free(tuninfo); + free(srh); + + return ret; } struct lwt_x { -- 1.8.3.1