From 67224c3ad3df4c5bdcfd97508a89365fb7ddc34d Mon Sep 17 00:00:00 2001 From: Marius Strobl Date: Sun, 14 May 2017 13:59:40 +0000 Subject: [PATCH] MFC: r317343 In fill_ip6(), the value of the pointer av changes before it is free(3)ed. Thus, introduce a new variable to track the original value. --- sbin/ipfw/ipv6.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sbin/ipfw/ipv6.c b/sbin/ipfw/ipv6.c index ee9bb623f3ae..d028ffc28f9b 100644 --- a/sbin/ipfw/ipv6.c +++ b/sbin/ipfw/ipv6.c @@ -338,6 +338,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen) { int len = 0; struct in6_addr *d = &(cmd->addr6); + char *oav; /* * Needed for multiple address. * Note d[1] points to struct in6_add r mask6 of cmd @@ -375,7 +376,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen) return (1); } - av = strdup(av); + oav = av = strdup(av); while (av) { /* * After the address we can have '/' indicating a mask, @@ -451,7 +452,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen) if (len + 1 > F_LEN_MASK) errx(EX_DATAERR, "address list too long"); cmd->o.len |= len+1; - free(av); + free(oav); return (1); }