From 82dcc31367335ac39bcefa30e9bb0d07d2306ae4 Mon Sep 17 00:00:00 2001 From: marius Date: Sun, 14 May 2017 13:59:40 +0000 Subject: [PATCH] MFC: r317343 In fill_ip6(), the value of the pointer av changes before it is free(3)ed. Thus, introduce a new variable to track the original value. git-svn-id: svn://svn.freebsd.org/base/stable/10@318271 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sbin/ipfw/ipv6.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sbin/ipfw/ipv6.c b/sbin/ipfw/ipv6.c index ee9bb623f..d028ffc28 100644 --- a/sbin/ipfw/ipv6.c +++ b/sbin/ipfw/ipv6.c @@ -338,6 +338,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen) { int len = 0; struct in6_addr *d = &(cmd->addr6); + char *oav; /* * Needed for multiple address. * Note d[1] points to struct in6_add r mask6 of cmd @@ -375,7 +376,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen) return (1); } - av = strdup(av); + oav = av = strdup(av); while (av) { /* * After the address we can have '/' indicating a mask, @@ -451,7 +452,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen) if (len + 1 > F_LEN_MASK) errx(EX_DATAERR, "address list too long"); cmd->o.len |= len+1; - free(av); + free(oav); return (1); } -- 2.45.0