svn commit: r310894 - head/usr.sbin/bsnmpd/tools/bsnmptools

[Ngie Cooper]

Author: ngie
Date: Sat Dec 31 10:01:25 2016
New Revision: 310894
URL: https://svnweb.freebsd.org/changeset/base/310894

Log:
  snmp_pdu_free the right object at the right time in snmptool_walk
  
  r310892 was on the right track, but unfortunately it was resolving
  the problem incorrectly and accidentally leaking memory in the
  process.
  
  - Call snmp_pdu_free on req before calling snmp_pdu_create on it
    at the bottom of the outer while loop
  - Call snmp_pdu_free on resp after calling snmpwalk_nextpdu_create
    in the inner loop
  
  MFC after:	12 days
  X-MFC with:	r310729, r310892
  Reported by:	valgrind

Modified:
  head/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c

Modified: head/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c
==============================================================================
--- head/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c	Sat Dec 31 09:52:00 2016	(r310893)
+++ head/usr.sbin/bsnmpd/tools/bsnmptools/bsnmpget.c	Sat Dec 31 10:01:25 2016	(r310894)
@@ -422,6 +422,7 @@ snmptool_get(struct snmp_toolinfo *snmpt
 		snmp_pdu_create(&req, GET_PDUTYPE(snmptoolctx));
 	}
 
+	snmp_pdu_free(&req);
 	snmp_pdu_free(&resp);
 
 	return (0);
@@ -507,6 +508,7 @@ snmptool_walk(struct snmp_toolinfo *snmp
 			if (op == SNMP_PDU_GETBULK)
 				snmpget_fix_getbulk(&req, GET_MAXREP(snmptoolctx),
 				    GET_NONREP(snmptoolctx));
+			snmp_pdu_free(&resp);
 		}
 
 		/* Just in case our root was a leaf. */
@@ -517,6 +519,7 @@ snmptool_walk(struct snmp_toolinfo *snmp
 					snmp_output_err_resp(snmptoolctx, &resp);
 				else
 					snmp_output_resp(snmptoolctx, &(resp), NULL);
+				snmp_pdu_free(&resp);
 			} else
 				warn("Snmp dialog");
 		}
@@ -526,11 +529,13 @@ snmptool_walk(struct snmp_toolinfo *snmp
 			break;
 		}
 
-		snmp_pdu_free(&resp);
-
+		snmp_pdu_free(&req);
 		snmp_pdu_create(&req, op);
 	}
 
+	snmp_pdu_free(&req);
+	snmp_pdu_free(&resp);
+
 	if (rc == 0)
 		return (0);
 	else