From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 25 Oct 2019 11:10:07 +0000 (-0400)
Subject: free vp after dereferencing it
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ee52b362e66f02b46dab0d70549c631bafed8d3e;p=thirdparty%2Ffreeradius-server.git

free vp after dereferencing it
---

diff --git a/src/protocols/dhcpv6/decode.c b/src/protocols/dhcpv6/decode.c
index 91035567c5e..a699c6b3ba7 100644
--- a/src/protocols/dhcpv6/decode.c
+++ b/src/protocols/dhcpv6/decode.c
@@ -88,12 +88,11 @@ static ssize_t decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, UNUSED fr
 		if (!vp) return -1;
 
 		if (fr_value_box_from_network(vp, &vp->data, vp->da->type, vp->da, data, data_len, true) < 0) {
-			fr_pair_list_free(&vp);
-
 			/*
 			 *	Paranoid loop prevention
 			 */
 			if (vp->da->flags.is_unknown) {
+				fr_pair_list_free(&vp);
 				return -1;
 			}
 			goto raw;
diff --git a/src/protocols/radius/decode.c b/src/protocols/radius/decode.c
index ea113b30303..2b60d0dd141 100644
--- a/src/protocols/radius/decode.c
+++ b/src/protocols/radius/decode.c
@@ -1433,12 +1433,11 @@ ssize_t fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_cursor_t *cursor, fr_dic
 	case FR_TYPE_IFID:
 	case FR_TYPE_SIZE:
 		if (fr_value_box_from_network(vp, &vp->data, vp->da->type, vp->da, p, data_len, true) < 0) {
-			fr_pair_list_free(&vp);
-
 			/*
 			 *	Paranoid loop prevention
 			 */
 			if (vp->da->flags.is_unknown) {
+				fr_pair_list_free(&vp);
 				return -1;
 			}
 			goto raw;