diff options
| author | bz <bz@FreeBSD.org> | 2012-06-05 13:27:37 +0000 |
|---|---|---|
| committer | bz <bz@FreeBSD.org> | 2012-06-05 13:27:37 +0000 |
| commit | 2d7f5ff3a844e1f1c676401221ad845fec62c38b (patch) | |
| tree | b91a8482c04a4e805d8833b5898fa70bd97360cc | |
| parent | a5121758e97b95da6c53212616a11050e3b774a8 (diff) | |
| download | FreeBSD-src-2d7f5ff3a844e1f1c676401221ad845fec62c38b.zip FreeBSD-src-2d7f5ff3a844e1f1c676401221ad845fec62c38b.tar.gz | |
Plug two interface address refcount leaks in early error return cases
in the ioctl path.
Reported by: rpaulo
Reviewed by: emax
MFC after: 3 days
| -rw-r--r-- | sys/netinet6/in6.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/sys/netinet6/in6.c b/sys/netinet6/in6.c index 682d4d1..2b432cf 100644 --- a/sys/netinet6/in6.c +++ b/sys/netinet6/in6.c @@ -1667,14 +1667,19 @@ in6_lifaddr_ioctl(struct socket *so, u_long cmd, caddr_t data, hostid = IFA_IN6(ifa); /* prefixlen must be <= 64. */ - if (64 < iflr->prefixlen) + if (64 < iflr->prefixlen) { + if (ifa != NULL) + ifa_free(ifa); return EINVAL; + } prefixlen = iflr->prefixlen; /* hostid part must be zero. */ sin6 = (struct sockaddr_in6 *)&iflr->addr; if (sin6->sin6_addr.s6_addr32[2] != 0 || sin6->sin6_addr.s6_addr32[3] != 0) { + if (ifa != NULL) + ifa_free(ifa); return EINVAL; } } else |
