stv0g/libnl
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

netfilter/ct: fix calling nfnl_*_put() on uninitialized memory after nfnlmsg_*_parse()

Browse source 
nfnlmsg_*_parse() does not assign *result on error. So this will
lead to freeing a dangling pointer.

Error found by coverity.

Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Thomas Haller <thaller@redhat.com>
This commit is contained in:
Thomas Haller 2014-06-10 18:06:37 +02:00
parent d7a9e74f82
commit 90cfeeecac
4 changed files with 4 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/netfilter/ct.c
View file

@ -414,10 +414,9 @@ static int ct_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
int err;
if ((err = nfnlmsg_ct_parse(nlh, &ct)) < 0)
goto errout;
return err;
err = pp->pp_cb((struct nl_object *) ct, pp);
errout:
nfnl_ct_put(ct);
return err;
}

3
lib/netfilter/exp.c
View file

@ -298,10 +298,9 @@ static int exp_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
int err;
if ((err = nfnlmsg_exp_parse(nlh, &exp)) < 0)
goto errout;
return err;
err = pp->pp_cb((struct nl_object *) exp, pp);
errout:
nfnl_exp_put(exp);
return err;
}

3
lib/netfilter/log_msg.c
View file

@ -174,10 +174,9 @@ static int log_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
int err;
if ((err = nfnlmsg_log_msg_parse(nlh, &msg)) < 0)
goto errout;
return err;
err = pp->pp_cb((struct nl_object *) msg, pp);
errout:
nfnl_log_msg_put(msg);
return err;
}

3
lib/netfilter/queue_msg.c
View file

@ -153,10 +153,9 @@ static int queue_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
int err;
if ((err = nfnlmsg_queue_msg_parse(nlh, &msg)) < 0)
goto errout;
return err;
err = pp->pp_cb((struct nl_object *) msg, pp);
errout:
nfnl_queue_msg_put(msg);
return err;
}