netfilter/ct: fix calling nfnl_*_put() on uninitialized memory after nfnlmsg_*_parse()

nfnlmsg_*_parse() does not assign *result on error. So this will
lead to freeing a dangling pointer.

Error found by coverity.

Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Thomas Haller <thaller@redhat.com>

diff --git a/lib/netfilter/ct.c b/lib/netfilter/ct.c
index 04f9d01685d1c382fb91ee56f4c14173287dee09..36a83dbe049846eaa790de0a77d30247bcddf5df 100644 (file)
--- a/lib/netfilter/ct.c
+++ b/lib/netfilter/ct.c
@@ -414,10 +414,9 @@ static int ct_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
        int err;
 
        if ((err = nfnlmsg_ct_parse(nlh, &ct)) < 0)
-               goto errout;
+               return err;
 
        err = pp->pp_cb((struct nl_object *) ct, pp);
-errout:
        nfnl_ct_put(ct);
        return err;
 }

diff --git a/lib/netfilter/exp.c b/lib/netfilter/exp.c
index 86ed8d184632444c81497483bf5a7e73efa67e75..9cfdd2bf7c70304fb29c4eb3ee0ac8e1c88c4246 100644 (file)
--- a/lib/netfilter/exp.c
+++ b/lib/netfilter/exp.c
@@ -298,10 +298,9 @@ static int exp_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
        int err;
 
        if ((err = nfnlmsg_exp_parse(nlh, &exp)) < 0)
-               goto errout;
+               return err;
 
        err = pp->pp_cb((struct nl_object *) exp, pp);
-errout:
        nfnl_exp_put(exp);
        return err;
 }

diff --git a/lib/netfilter/log_msg.c b/lib/netfilter/log_msg.c
index 6e09da2ca83895a3c7f72a5af2da9065381b78b4..5ffdaf80e0edf0dc88873bc369d87119f5448cbb 100644 (file)
--- a/lib/netfilter/log_msg.c
+++ b/lib/netfilter/log_msg.c
@@ -174,10 +174,9 @@ static int log_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
        int err;
 
        if ((err = nfnlmsg_log_msg_parse(nlh, &msg)) < 0)
-               goto errout;
+               return err;
 
        err = pp->pp_cb((struct nl_object *) msg, pp);
-errout:
        nfnl_log_msg_put(msg);
        return err;
 }

diff --git a/lib/netfilter/queue_msg.c b/lib/netfilter/queue_msg.c
index 1425577cfadaa1c85835961fa17c2dbd6783b219..338892333fb8104014ae5d32bf80393f264fae2b 100644 (file)
--- a/lib/netfilter/queue_msg.c
+++ b/lib/netfilter/queue_msg.c
@@ -153,10 +153,9 @@ static int queue_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
        int err;
 
        if ((err = nfnlmsg_queue_msg_parse(nlh, &msg)) < 0)
-               goto errout;
+               return err;
 
        err = pp->pp_cb((struct nl_object *) msg, pp);
-errout:
        nfnl_queue_msg_put(msg);
        return err;
 }