diff options
author | Phil Sutter <phil@nwl.cc> | 2019-05-13 19:12:24 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-05-15 17:14:40 +0200 |
commit | 8b59c16fc3d51bf9d7896d5430910e9014dfda57 (patch) | |
tree | 0513382e8f0d964767c17719a0e9201bbd419a4f | |
parent | 10f1d8d3ba0394a8b5669013596190ea2ff38030 (diff) | |
download | platform_external_iptables-8b59c16fc3d51bf9d7896d5430910e9014dfda57.tar.gz platform_external_iptables-8b59c16fc3d51bf9d7896d5430910e9014dfda57.tar.bz2 platform_external_iptables-8b59c16fc3d51bf9d7896d5430910e9014dfda57.zip |
xtables: Don't leak iter in error path of __nft_chain_zero_counters()
If batch_rule_add() fails, this function leaked the rule iterator
object.
Fixes: 4c54c892443c2 ("xtables: Catch errors when zeroing rule rounters")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r-- | iptables/nft.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/iptables/nft.c b/iptables/nft.c index 6354b7e8..dab1db59 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -3374,8 +3374,10 @@ static int __nft_chain_zero_counters(struct nftnl_chain *c, void *data) * rule based on its handle only. */ nftnl_rule_unset(r, NFTNL_RULE_POSITION); - if (!batch_rule_add(h, NFT_COMPAT_RULE_REPLACE, r)) + if (!batch_rule_add(h, NFT_COMPAT_RULE_REPLACE, r)) { + nftnl_rule_iter_destroy(iter); return -1; + } } r = nftnl_rule_iter_next(iter); } |