svn commit: r299420 - head/sys/netpfil/ipfw

[Andrey V. Elsukov]

Author: ae
Date: Wed May 11 10:04:32 2016
New Revision: 299420
URL: https://svnweb.freebsd.org/changeset/base/299420

Log:
  Fix memory leak possible in error case.
  Use free_rule() instead of free(), it will also release memory allocated
  for rule counters.
  
  Obtained from:	Yandex LLC
  Sponsored by:	Yandex LLC

Modified:
  head/sys/netpfil/ipfw/ip_fw_sockopt.c

Modified: head/sys/netpfil/ipfw/ip_fw_sockopt.c
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw_sockopt.c	Wed May 11 10:03:13 2016	(r299419)
+++ head/sys/netpfil/ipfw/ip_fw_sockopt.c	Wed May 11 10:04:32 2016	(r299420)
@@ -2751,7 +2751,7 @@ add_rules(struct ip_fw_chain *chain, ip_
 	if ((error = commit_rules(chain, cbuf, rtlv->count)) != 0) {
 		/* Free allocate krules */
 		for (i = 0, ci = cbuf; i < rtlv->count; i++, ci++)
-			free(ci->krule, M_IPFW);
+			free_rule(ci->krule);
 	}
 
 	if (cbuf != NULL && cbuf != &rci)
@@ -3574,7 +3574,9 @@ ipfw_ctl(struct sockopt *sopt)
 			ci.krule = krule;
 			import_rule0(&ci);
 			error = commit_rules(chain, &ci, 1);
-			if (!error && sopt->sopt_dir == SOPT_GET) {
+			if (error != 0)
+				free_rule(ci.krule);
+			else if (sopt->sopt_dir == SOPT_GET) {
 				if (is7) {
 					error = convert_rule_to_7(rule);
 					size = RULESIZE7(rule);