svn commit: r298279 - head/sys/cam/ctl

[Sean Bruno]

Author: sbruno
Date: Tue Apr 19 16:48:14 2016
New Revision: 298279
URL: https://svnweb.freebsd.org/changeset/base/298279

Log:
  Plug memory leak in ctl(4) when ctl_copyin_args() is called with a non-
  null terminated ASCII string.
  
  PR:		207626
  Submitted by:	cturt at hardenedbsd.org
  MFC after:	2 days

Modified:
  head/sys/cam/ctl/ctl.c

Modified: head/sys/cam/ctl/ctl.c
==============================================================================
--- head/sys/cam/ctl/ctl.c	Tue Apr 19 15:56:39 2016	(r298278)
+++ head/sys/cam/ctl/ctl.c	Tue Apr 19 16:48:14 2016	(r298279)
@@ -2445,6 +2445,7 @@ ctl_copyin_args(int num_args, struct ctl
 			 && (tmpptr[args[i].vallen - 1] != '\0')) {
 				snprintf(error_str, error_str_len, "Argument "
 				    "%d value is not NUL-terminated", i);
+				free(tmpptr, M_CTL);
 				goto bailout;
 			}
 			args[i].kvalue = tmpptr;