svn commit: r299191 - stable/10/sys/cam/ctl

[Sean Bruno]

Author: sbruno
Date: Fri May  6 19:11:47 2016
New Revision: 299191
URL: https://svnweb.freebsd.org/changeset/base/299191

Log:
  MFC r298279
  
  Plug memory leak in ctl(4) when ctl_copyin_args() is called with a non-
  null terminated ASCII string.
  
  PR:		207626
  Submitted by:	cturt at hardenedbsd.org

Modified:
  stable/10/sys/cam/ctl/ctl.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/cam/ctl/ctl.c
==============================================================================
--- stable/10/sys/cam/ctl/ctl.c	Fri May  6 17:55:11 2016	(r299190)
+++ stable/10/sys/cam/ctl/ctl.c	Fri May  6 19:11:47 2016	(r299191)
@@ -2447,6 +2447,7 @@ ctl_copyin_args(int num_args, struct ctl
 			 && (tmpptr[args[i].vallen - 1] != '\0')) {
 				snprintf(error_str, error_str_len, "Argument "
 				    "%d value is not NUL-terminated", i);
+				free(tmpptr, M_CTL);
 				goto bailout;
 			}
 			args[i].kvalue = tmpptr;