From: Nick Porter <nick@portercomputing.co.uk>
Date: Thu, 18 Mar 2021 11:40:18 +0000 (+0000)
Subject: v4: Minor fix to map freeing on error (#3996)
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5627311740ea1e38d5ca92a8a152cc7f14caea6c;p=thirdparty%2Ffreeradius-server.git

v4: Minor fix to map freeing on error (#3996)

* Correct fr_dlist_talloc_reverse_free() to clear from the very end

* Free map list in reverse due to talloc parenting

* Don't clear head - it is talloc freed by the caller when an error is returned
---

diff --git a/src/lib/server/map.c b/src/lib/server/map.c
index 5a299b7cff5..fae64e983e4 100644
--- a/src/lib/server/map.c
+++ b/src/lib/server/map.c
@@ -509,7 +509,11 @@ int map_afrom_cs(TALLOC_CTX *ctx, fr_map_list_t *out, CONF_SECTION *cs,
 		if (total++ == max) {
 			cf_log_err(ci, "Map size exceeded");
 		error:
-			fr_dlist_talloc_free(out);
+			/*
+			 *	Free in reverse as successive entries have their
+			 *	prececessors as talloc parents
+			 */
+			fr_dlist_talloc_reverse_free(out);
 			return -1;
 		}
 
diff --git a/src/lib/unlang/xlat_tokenize.c b/src/lib/unlang/xlat_tokenize.c
index 409a1bec218..d2e4b2f1e07 100644
--- a/src/lib/unlang/xlat_tokenize.c
+++ b/src/lib/unlang/xlat_tokenize.c
@@ -519,7 +519,6 @@ static inline int xlat_tokenize_function_args(TALLOC_CTX *ctx, xlat_exp_t **head
 		if (func && (func->input_type != XLAT_INPUT_ARGS)) {
 			fr_strerror_const("Function should be called using the syntax %{func:arg}");
 		error:
-			*head = NULL;
 			talloc_free(node);
 			return -1;
 		}
diff --git a/src/lib/util/dlist.h b/src/lib/util/dlist.h
index d0de511a2ed..9549aff3cb6 100644
--- a/src/lib/util/dlist.h
+++ b/src/lib/util/dlist.h
@@ -663,12 +663,13 @@ static inline void fr_dlist_talloc_free(fr_dlist_head_t *head)
  */
 static inline void fr_dlist_talloc_reverse_free(fr_dlist_head_t *head)
 {
-	void *e = NULL;
+	void *e = NULL, *p;
 
 	e = fr_dlist_tail(head);
 	do {
-		e = fr_dlist_remove(head, e);
+		p = fr_dlist_remove(head, e);
 		talloc_free(e);
+		e = p;
 	} while (e);
 }