svn commit: r317343 - head/sbin/ipfw

[Marius Strobl]

Author: marius
Date: Sun Apr 23 21:17:59 2017
New Revision: 317343
URL: https://svnweb.freebsd.org/changeset/base/317343

Log:
  In fill_ip6(), the value of the pointer av changes before it is
  free(3)ed. Thus, introduce a new variable to track the original
  value.
  
  Submitted by:		Tom Rix
  Differential Revision:	https://reviews.freebsd.org/D9962

Modified:
  head/sbin/ipfw/ipv6.c

Modified: head/sbin/ipfw/ipv6.c
==============================================================================
--- head/sbin/ipfw/ipv6.c	Sun Apr 23 20:32:46 2017	(r317342)
+++ head/sbin/ipfw/ipv6.c	Sun Apr 23 21:17:59 2017	(r317343)
@@ -339,6 +339,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
 {
 	int len = 0;
 	struct in6_addr *d = &(cmd->addr6);
+	char *oav;
 	/*
 	 * Needed for multiple address.
 	 * Note d[1] points to struct in6_add r mask6 of cmd
@@ -365,7 +366,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
 		return (1);
 	}
 
-	av = strdup(av);
+	oav = av = strdup(av);
 	while (av) {
 		/*
 		 * After the address we can have '/' indicating a mask,
@@ -446,7 +447,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
 	if (len + 1 > F_LEN_MASK)
 		errx(EX_DATAERR, "address list too long");
 	cmd->o.len |= len+1;
-	free(av);
+	free(oav);
 	return (1);
 }