- djm@cvs.openbsd.org 2013/12/19 00:27:57

     [auth-options.c]
     simplify freeing of source-address certificate restriction

diff --git a/ChangeLog b/ChangeLog
index 041cfe83187eccc5fe43376ad7d78071557fcb76..a3689a4afbce87aa7b574f1f0da55af0ed0b25ad 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,9 @@
      Cast client_alive_interval to u_int64_t before assinging to
      max_time_milliseconds to avoid potential integer overflow in the timeout.
      bz#2170, patch from Loganaden Velvindron, ok djm@
+   - djm@cvs.openbsd.org 2013/12/19 00:27:57
+     [auth-options.c]
+     simplify freeing of source-address certificate restriction
 
 20131221
  - (dtucker) [regress/keytype.sh] Actually test ecdsa key types.

diff --git a/auth-options.c b/auth-options.c
index b370b5be611e4f6af781fe30404c0fab91a58a7d..fa209eaab8131ec4932c6fe7dd0e0006eeca153d 100644 (file)
--- a/auth-options.c
+++ b/auth-options.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.c,v 1.61 2013/11/08 00:39:14 djm Exp $ */
+/* $OpenBSD: auth-options.c,v 1.62 2013/12/19 00:27:57 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -432,7 +432,7 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
        u_char *data_blob = NULL;
        u_int nlen, dlen, clen;
        Buffer c, data;
-       int ret = -1, found;
+       int ret = -1, result, found;
 
        buffer_init(&data);
 
@@ -501,11 +501,12 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
                                        goto out;
                                }
                                remote_ip = get_remote_ipaddr();
-                               switch (addr_match_cidr_list(remote_ip,
-                                   allowed)) {
+                               result = addr_match_cidr_list(remote_ip,
+                                   allowed);
+                               free(allowed);
+                               switch (result) {
                                case 1:
                                        /* accepted */
-                                       free(allowed);
                                        break;
                                case 0:
                                        /* no match */
@@ -518,12 +519,11 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
                                            "is not permitted to use this "
                                            "certificate for login.",
                                            remote_ip);
-                                       free(allowed);
                                        goto out;
                                case -1:
+                               default:
                                        error("Certificate source-address "
                                            "contents invalid");
-                                       free(allowed);
                                        goto out;
                                }
                                found = 1;