plugged memory leakage in some erroneous cases

Obtained from:	KAME
MFC after:	1 week

1 files changed, 6 insertions, 5 deletions

diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index a45727e..94be84a 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -1781,10 +1781,10 @@ ip6_pcbopts(pktopt, m, so, sopt)
 
 	if (!m || m->m_len == 0) {
 		/*
-		 * Only turning off any previous options.
+		 * Only turning off any previous options, regardless of
+		 * whether the opt is just created or given.
 		 */
-		if (opt)
-			free(opt, M_IP6OPT);
+		free(opt, M_IP6OPT);
 		return(0);
 	}
 
@@ -1793,6 +1793,7 @@ ip6_pcbopts(pktopt, m, so, sopt)
 		priv = 1;
 	if ((error = ip6_setpktoptions(m, opt, priv, 1)) != 0) {
 		ip6_clearpktopts(opt, 1, -1); /* XXX: discard all options */
+		free(opt, M_IP6OPT);
 		return(error);
 	}
 	*pktopt = opt;
@@ -1884,7 +1885,7 @@ ip6_copypktopts(src, canwait)
 
 	dst = malloc(sizeof(*dst), M_IP6OPT, canwait);
 	if (dst == NULL && canwait == M_NOWAIT)
-		goto bad;
+		return (NULL);
 	bzero(dst, sizeof(*dst));
 
 	dst->ip6po_hlim = src->ip6po_hlim;
@@ -1910,13 +1911,13 @@ ip6_copypktopts(src, canwait)
 	return(dst);
 
   bad:
-	printf("ip6_copypktopts: copy failed");
 	if (dst->ip6po_pktinfo) free(dst->ip6po_pktinfo, M_IP6OPT);
 	if (dst->ip6po_nexthop) free(dst->ip6po_nexthop, M_IP6OPT);
 	if (dst->ip6po_hbh) free(dst->ip6po_hbh, M_IP6OPT);
 	if (dst->ip6po_dest1) free(dst->ip6po_dest1, M_IP6OPT);
 	if (dst->ip6po_dest2) free(dst->ip6po_dest2, M_IP6OPT);
 	if (dst->ip6po_rthdr) free(dst->ip6po_rthdr, M_IP6OPT);
+	free(dst, M_IP6OPT);
 	return(NULL);
 }
 #undef PKTOPT_EXTHDRCPY