From: Phil Sutter <phil@nwl.cc>
Date: Wed, 2 Jun 2021 09:55:20 +0000 (+0200)
Subject: nft: Avoid memleak in error path of nft_cmd_new()
X-Git-Tag: v1.8.8~157
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=eab75ed36a4f2;p=thirdparty%2Fiptables.git

nft: Avoid memleak in error path of nft_cmd_new()

If rule allocation fails, free the allocated 'cmd' before returning to
caller.

Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---

diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
index f2b935c5..c3f6c14e 100644
--- a/iptables/nft-cmd.c
+++ b/iptables/nft-cmd.c
@@ -35,8 +35,10 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command,
 
 	if (state) {
 		rule = nft_rule_new(h, chain, table, state);
-		if (!rule)
+		if (!rule) {
+			nft_cmd_free(cmd);
 			return NULL;
+		}
 
 		cmd->obj.rule = rule;