From owner-svn-src-all@freebsd.org Wed Jun 8 09:40:08 2016 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 26494B6F879; Wed, 8 Jun 2016 09:40:08 +0000 (UTC) (envelope-from truckman@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id D21E31ECC; Wed, 8 Jun 2016 09:40:07 +0000 (UTC) (envelope-from truckman@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u589e7X3052251; Wed, 8 Jun 2016 09:40:07 GMT (envelope-from truckman@FreeBSD.org) Received: (from truckman@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u589e7kn052250; Wed, 8 Jun 2016 09:40:07 GMT (envelope-from truckman@FreeBSD.org) Message-Id: <201606080940.u589e7kn052250@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: truckman set sender to truckman@FreeBSD.org using -f From: Don Lewis Date: Wed, 8 Jun 2016 09:40:07 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r301592 - head/lib/libc/resolv X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jun 2016 09:40:08 -0000 Author: truckman Date: Wed Jun 8 09:40:06 2016 New Revision: 301592 URL: https://svnweb.freebsd.org/changeset/base/301592 Log: Don't leak addrinfo if ai->ai_addrlen <= minsiz test fails. If the ai->ai_addrlen <= minsiz test fails, then freeaddrinfo() does not get called to free the memory just allocated by getaddrinfo(). Fix by moving ai->ai_addrlen <= minsiz to a separate nested if block, and keep freeaddrinfo() in the outer block so that freeaddrinfo() will be called whenever getaddrinfo() succeeds. Reported by: Coverity CID: 1273652 Reviewed by: ume MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D6756 Modified: head/lib/libc/resolv/res_init.c Modified: head/lib/libc/resolv/res_init.c ============================================================================== --- head/lib/libc/resolv/res_init.c Wed Jun 8 09:36:07 2016 (r301591) +++ head/lib/libc/resolv/res_init.c Wed Jun 8 09:40:06 2016 (r301592) @@ -411,20 +411,21 @@ __res_vinit(res_state statp, int preinit hints.ai_socktype = SOCK_DGRAM; /*dummy*/ hints.ai_flags = AI_NUMERICHOST; sprintf(sbuf, "%u", NAMESERVER_PORT); - if (getaddrinfo(cp, sbuf, &hints, &ai) == 0 && - ai->ai_addrlen <= minsiz) { - if (statp->_u._ext.ext != NULL) { - memcpy(&statp->_u._ext.ext->nsaddrs[nserv], - ai->ai_addr, ai->ai_addrlen); + if (getaddrinfo(cp, sbuf, &hints, &ai) == 0) { + if (ai->ai_addrlen <= minsiz) { + if (statp->_u._ext.ext != NULL) { + memcpy(&statp->_u._ext.ext->nsaddrs[nserv], + ai->ai_addr, ai->ai_addrlen); + } + if (ai->ai_addrlen <= + sizeof(statp->nsaddr_list[nserv])) { + memcpy(&statp->nsaddr_list[nserv], + ai->ai_addr, ai->ai_addrlen); + } else + statp->nsaddr_list[nserv].sin_family = 0; + nserv++; } - if (ai->ai_addrlen <= - sizeof(statp->nsaddr_list[nserv])) { - memcpy(&statp->nsaddr_list[nserv], - ai->ai_addr, ai->ai_addrlen); - } else - statp->nsaddr_list[nserv].sin_family = 0; freeaddrinfo(ai); - nserv++; } } continue;