Author: marius
Date: Sun May 14 13:59:40 2017
New Revision: 318271
URL: https://svnweb.freebsd.org/changeset/base/318271
Log:
MFC: r317343
In fill_ip6(), the value of the pointer av changes before it is
free(3)ed. Thus, introduce a new variable to track the original
value.
Modified:
stable/10/sbin/ipfw/ipv6.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/sbin/ipfw/ipv6.c
==============================================================================
--- stable/10/sbin/ipfw/ipv6.c Sun May 14 13:59:36 2017 (r318270)
+++ stable/10/sbin/ipfw/ipv6.c Sun May 14 13:59:40 2017 (r318271)
@@ -338,6 +338,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
{
int len = 0;
struct in6_addr *d = &(cmd->addr6);
+ char *oav;
/*
* Needed for multiple address.
* Note d[1] points to struct in6_add r mask6 of cmd
@@ -375,7 +376,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
return (1);
}
- av = strdup(av);
+ oav = av = strdup(av);
while (av) {
/*
* After the address we can have '/' indicating a mask,
@@ -451,7 +452,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
if (len + 1 > F_LEN_MASK)
errx(EX_DATAERR, "address list too long");
cmd->o.len |= len+1;
- free(av);
+ free(oav);
return (1);
}
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
