svn commit: r318271 - stable/10/sbin/ipfw

[Marius Strobl]

Author: marius
Date: Sun May 14 13:59:40 2017
New Revision: 318271
URL: https://svnweb.freebsd.org/changeset/base/318271

Log:
  MFC: r317343
  
  In fill_ip6(), the value of the pointer av changes before it is
  free(3)ed. Thus, introduce a new variable to track the original
  value.

Modified:
  stable/10/sbin/ipfw/ipv6.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sbin/ipfw/ipv6.c
==============================================================================
--- stable/10/sbin/ipfw/ipv6.c	Sun May 14 13:59:36 2017	(r318270)
+++ stable/10/sbin/ipfw/ipv6.c	Sun May 14 13:59:40 2017	(r318271)
@@ -338,6 +338,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
 {
 	int len = 0;
 	struct in6_addr *d = &(cmd->addr6);
+	char *oav;
 	/*
 	 * Needed for multiple address.
 	 * Note d[1] points to struct in6_add r mask6 of cmd
@@ -375,7 +376,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
 		return (1);
 	}
 
-	av = strdup(av);
+	oav = av = strdup(av);
 	while (av) {
 		/*
 		 * After the address we can have '/' indicating a mask,
@@ -451,7 +452,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
 	if (len + 1 > F_LEN_MASK)
 		errx(EX_DATAERR, "address list too long");
 	cmd->o.len |= len+1;
-	free(av);
+	free(oav);
 	return (1);
 }