From: Shawn Routhier <sar@isc.org>
Date: Wed, 11 Jul 2012 21:50:35 +0000 (-0700)
Subject: [rt30024] This is a commit message
X-Git-Tag: v4_3_0a1~82
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3bedb11744faf9c2be24d3e0976800b30451df9a;p=thirdparty%2Fdhcp.git

[rt30024] This is a commit message
Fix a pair of memory leaks.
---

diff --git a/RELNOTES b/RELNOTES
index 53cddaffe..b5c9134f8 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -97,6 +97,12 @@ work on other platforms. Please report any problems and suggested fixes to
   [ISC-Bugs #29852]
   CVE: CVE-2012-3570
 
+! A pair of memory leaks were found and fixed.  Thanks to
+  Glen Eustace of Massey University, New Zealand for finding
+  this issue.
+  [ISC-Bugs #30024]
+  CVE: TBD
+
 			Changes since 4.2.3
 
 ! Add a check for a null pointer before calling the regexec function.
diff --git a/common/options.c b/common/options.c
index 56d2e88ea..f3a3db07d 100644
--- a/common/options.c
+++ b/common/options.c
@@ -2403,6 +2403,8 @@ prepare_option_buffer(struct universe *universe, struct buffer *bp,
 
 	/* And let go of our references. */
       cleanup:
+	if (lbp != NULL)
+		buffer_dereference(&lbp, MDL);
 	option_dereference(&option, MDL);
 
 	return status;
diff --git a/server/dhcpv6.c b/server/dhcpv6.c
index d763c954e..aa22e6916 100644
--- a/server/dhcpv6.c
+++ b/server/dhcpv6.c
@@ -1519,6 +1519,8 @@ lease_to_client(struct data_string *reply_ret,
 		packet_dereference(&reply.packet, MDL);
 	if (reply.client_id.data != NULL)
 		data_string_forget(&reply.client_id, MDL);
+	if (packet_oro.buffer != NULL)
+		data_string_forget(&packet_oro, MDL);
 	reply.renew = reply.rebind = reply.prefer = reply.valid = 0;
 	reply.cursor = 0;
 }