From: Phil Sutter <phil@nwl.cc>
Date: Mon, 13 May 2019 17:12:24 +0000 (+0200)
Subject: xtables: Don't leak iter in error path of __nft_chain_zero_counters()
X-Git-Tag: v1.8.3~17
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8b59c16fc3d51bf9d7896d5430910e9014dfda57;p=thirdparty%2Fiptables.git

xtables: Don't leak iter in error path of __nft_chain_zero_counters()

If batch_rule_add() fails, this function leaked the rule iterator
object.

Fixes: 4c54c892443c2 ("xtables: Catch errors when zeroing rule rounters")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/iptables/nft.c b/iptables/nft.c
index 6354b7e8..dab1db59 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -3374,8 +3374,10 @@ static int __nft_chain_zero_counters(struct nftnl_chain *c, void *data)
 			 * rule based on its handle only.
 			 */
 			nftnl_rule_unset(r, NFTNL_RULE_POSITION);
-			if (!batch_rule_add(h, NFT_COMPAT_RULE_REPLACE, r))
+			if (!batch_rule_add(h, NFT_COMPAT_RULE_REPLACE, r)) {
+				nftnl_rule_iter_destroy(iter);
 				return -1;
+			}
 		}
 		r = nftnl_rule_iter_next(iter);
 	}