[v4_1_esv] Clean up memory on error conditions

Squashed commit of the following:

commit 4a6276dd17ceb56003f951d01bc9ba241d67cfdc
Author: Shawn Routhier <sar@isc.org>
Date:   Tue Feb 23 11:51:09 2016 -0800

    [rt41774_41esv] Clean up memory on error conditions

diff --git a/RELNOTES b/RELNOTES
index 31b6f72419c3f95a10b45f46ed29539dc304bde8..73db3567e23a8f052b47544d9213b8663146fcca 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -188,6 +188,10 @@ by Eric Young (eay@cryptsoft.com).
   [ISC-Bugs #37954]
   [ISC-Bugs #40752]
 
+- Add a dereference call when handling an error condition while
+  decoding a packet and clean up some memory on error conditions.
+  [ISC-Bugs #41774]
+
                        Changes since 4.1-ESV-R12b1
 
 - None

diff --git a/common/options.c b/common/options.c
index c0628ed283590f1a6bbcb81f3e1935295cbfab65..aeda6c23dc46bc164300bb58be4dcd57560dd50a 100644 (file)
--- a/common/options.c
+++ b/common/options.c
@@ -3,7 +3,7 @@
    DHCP options parsing and reassembly. */
 
 /*
- * Copyright (c) 2004-2012,2014 by Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (c) 2004-2012,2014,2016 by Internet Systems Consortium, Inc. ("ISC")
  * Copyright (c) 1995-2003 by Internet Software Consortium
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -3811,6 +3811,7 @@ void do_packet (interface, packet, len, from_port, from, hfrom)
        /* Allocate packet->options now so it is non-null for all packets */
        decoded_packet->options_valid = 0;
        if (!option_state_allocate (&decoded_packet->options, MDL)) {
+               packet_dereference(&decoded_packet, MDL);
                return;
        }
 

diff --git a/server/dhcp.c b/server/dhcp.c
index 9f10f6c42f6b82157572ad79b6193ec12e3bc332..94a80e4a7367697d1b7a68ae52e2909258f3df7d 100644 (file)
--- a/server/dhcp.c
+++ b/server/dhcp.c
@@ -4314,6 +4314,7 @@ int locate_network (packet)
                        return 0;
                }
                if (data.len != 4) {
+                       data_string_forget (&data, MDL);
                        return 0;
                }
                ia.len = 4;