From 87ae24a9c70e803056abf6048c771b7e83e04251 Mon Sep 17 00:00:00 2001
From: Dirkjan Bussink <d.bussink@gmail.com>
Date: Mon, 28 Apr 2014 22:57:16 +0000
Subject: [PATCH] Fix a few memory usage errors

These are either use after free errors or small leaks where memory
is not free'd after some error state is detected.
---
 src/auth.c     | 4 +++-
 src/cfgparse.c | 2 --
 src/haproxy.c  | 1 +
 src/pattern.c  | 8 ++++----
 4 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/auth.c b/src/auth.c
index ad606af..062aeba 100644
--- a/src/auth.c
+++ b/src/auth.c
@@ -134,6 +134,7 @@ int userlist_postinit()
 				if (!ag) {
 					Alert("userlist '%s': no such group '%s' specified in user '%s'\n",
 					      curuserlist->name, group, curuser->user);
+					if (groups) free(groups);
 					return ERR_ALERT | ERR_FATAL;
 				}
 
@@ -142,7 +143,8 @@ int userlist_postinit()
 				if (!grl) {
 					Alert("userlist '%s': no more memory when trying to allocate the user groups.\n",
 					      curuserlist->name);
-					return  ERR_ALERT | ERR_FATAL;
+					if (groups) free(groups);
+					return ERR_ALERT | ERR_FATAL;
 				}
 
 				grl->group = ag;
diff --git a/src/cfgparse.c b/src/cfgparse.c
index 7a869e3..ffb379f 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -1569,8 +1569,6 @@ static int create_cond_regex_rule(const char *file, int line,
 	if (dir == SMP_OPT_DIR_REQ && warnif_misplaced_reqxxx(px, file, line, cmd))
 		err_code |= ERR_WARN;
 
-	free(errmsg);
-	return err_code;
  err:
 	free(errmsg);
 	free(preg);
diff --git a/src/haproxy.c b/src/haproxy.c
index ed2ff21..c1ec783 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -1607,6 +1607,7 @@ int main(int argc, char **argv)
 			exit(0); /* parent must leave */
 		}
 
+		free(children);
 		/* if we're NOT in QUIET mode, we should now close the 3 first FDs to ensure
 		 * that we can detach from the TTY. We MUST NOT do it in other cases since
 		 * it would have already be done, and 0-2 would have been affected to listening
diff --git a/src/pattern.c b/src/pattern.c
index 80dbaab..896c3e5 100644
--- a/src/pattern.c
+++ b/src/pattern.c
@@ -1049,8 +1049,8 @@ int pat_idx_list_reg(struct pattern_expr *expr, struct pattern *pat, char **err)
 
 	/* compile regex */
 	if (!regex_comp(pat->ptr.str, patl->pat.ptr.reg, !(expr->mflags & PAT_MF_IGNORE_CASE), 0, err)) {
-		free(patl);
 		free(patl->pat.ptr.reg);
+		free(patl);
 		return 0;
 	}
 
@@ -1390,14 +1390,14 @@ int pat_ref_delete(struct pat_ref *ref, const char *key)
 	/* delete pattern from reference */
 	list_for_each_entry_safe(elt, safe, &ref->head, list) {
 		if (strcmp(key, elt->pattern) == 0) {
+			list_for_each_entry(expr, &ref->pat, list)
+				pattern_delete(expr, elt);
+
 			LIST_DEL(&elt->list);
 			free(elt->sample);
 			free(elt->pattern);
 			free(elt);
 
-			list_for_each_entry(expr, &ref->pat, list)
-				pattern_delete(expr, elt);
-
 			found = 1;
 		}
 	}
-- 
1.9.1