From b9d208fb2ee312884362d18d96e5e7a3b3d8af8f Mon Sep 17 00:00:00 2001
From: Dirkjan Bussink <d.bussink@gmail.com>
Date: Mon, 28 Apr 2014 22:57:16 +0000
Subject: [PATCH] Fix a few memory usage errors

These are either use after free errors or small leaks where memory
is not free'd after some error state is detected.
---
 src/auth.c     | 4 +++-
 src/cfgparse.c | 2 --
 src/haproxy.c  | 2 ++
 src/pattern.c  | 8 ++++----
 4 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/auth.c b/src/auth.c
index 2a53deb..1069c5b 100644
--- a/src/auth.c
+++ b/src/auth.c
@@ -134,6 +134,7 @@ int userlist_postinit()
 				if (!ag) {
 					Alert("userlist '%s': no such group '%s' specified in user '%s'\n",
 					      curuserlist->name, group, curuser->user);
+					free(groups);
 					return ERR_ALERT | ERR_FATAL;
 				}
 
@@ -142,7 +143,8 @@ int userlist_postinit()
 				if (!grl) {
 					Alert("userlist '%s': no more memory when trying to allocate the user groups.\n",
 					      curuserlist->name);
-					return  ERR_ALERT | ERR_FATAL;
+					free(groups);
+					return ERR_ALERT | ERR_FATAL;
 				}
 
 				grl->group = ag;
diff --git a/src/cfgparse.c b/src/cfgparse.c
index 9ec69a1..eb7ec20 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -1578,8 +1578,6 @@ static int create_cond_regex_rule(const char *file, int line,
 	if (dir == SMP_OPT_DIR_REQ && warnif_misplaced_reqxxx(px, file, line, cmd))
 		err_code |= ERR_WARN;
 
-	free(errmsg);
-	return err_code;
  err:
 	free(errmsg);
 	free(preg);
diff --git a/src/haproxy.c b/src/haproxy.c
index 77871b0..060a155 100644
--- a/src/haproxy.c
+++ b/src/haproxy.c
@@ -1610,6 +1610,8 @@ int main(int argc, char **argv)
 			exit(0); /* parent must leave */
 		}
 
+		free(children);
+		children = NULL;
 		/* if we're NOT in QUIET mode, we should now close the 3 first FDs to ensure
 		 * that we can detach from the TTY. We MUST NOT do it in other cases since
 		 * it would have already be done, and 0-2 would have been affected to listening
diff --git a/src/pattern.c b/src/pattern.c
index 51981fd..1d7e4d8 100644
--- a/src/pattern.c
+++ b/src/pattern.c
@@ -1076,8 +1076,8 @@ int pat_idx_list_reg(struct pattern_expr *expr, struct pattern *pat, char **err)
 
 	/* compile regex */
 	if (!regex_comp(pat->ptr.str, patl->pat.ptr.reg, !(expr->mflags & PAT_MF_IGNORE_CASE), 0, err)) {
-		free(patl);
 		free(patl->pat.ptr.reg);
+		free(patl);
 		return 0;
 	}
 
@@ -1458,14 +1458,14 @@ int pat_ref_delete(struct pat_ref *ref, const char *key)
 	/* delete pattern from reference */
 	list_for_each_entry_safe(elt, safe, &ref->head, list) {
 		if (strcmp(key, elt->pattern) == 0) {
+			list_for_each_entry(expr, &ref->pat, list)
+				pattern_delete(expr, elt);
+
 			LIST_DEL(&elt->list);
 			free(elt->sample);
 			free(elt->pattern);
 			free(elt);
 
-			list_for_each_entry(expr, &ref->pat, list)
-				pattern_delete(expr, elt);
-
 			found = 1;
 		}
 	}
-- 
1.9.1