svn commit: r318270 - stable/11/sbin/ipfw

[Marius Strobl]

Author: marius
Date: Sun May 14 13:59:36 2017
New Revision: 318270
URL: https://svnweb.freebsd.org/changeset/base/318270

Log:
  MFC: r317343
  
  In fill_ip6(), the value of the pointer av changes before it is
  free(3)ed. Thus, introduce a new variable to track the original
  value.

Modified:
  stable/11/sbin/ipfw/ipv6.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sbin/ipfw/ipv6.c
==============================================================================
--- stable/11/sbin/ipfw/ipv6.c	Sun May 14 13:14:19 2017	(r318269)
+++ stable/11/sbin/ipfw/ipv6.c	Sun May 14 13:59:36 2017	(r318270)
@@ -339,6 +339,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
 {
 	int len = 0;
 	struct in6_addr *d = &(cmd->addr6);
+	char *oav;
 	/*
 	 * Needed for multiple address.
 	 * Note d[1] points to struct in6_add r mask6 of cmd
@@ -365,7 +366,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
 		return (1);
 	}
 
-	av = strdup(av);
+	oav = av = strdup(av);
 	while (av) {
 		/*
 		 * After the address we can have '/' indicating a mask,
@@ -446,7 +447,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, i
 	if (len + 1 > F_LEN_MASK)
 		errx(EX_DATAERR, "address list too long");
 	cmd->o.len |= len+1;
-	free(av);
+	free(oav);
 	return (1);
 }