staticd: Memory leak of string in staticd

XSTRDUP and then calling strsep mangles the pointer returned by XSTRDUP. Keep a copy of the orig and when we are done, free that instead. Signed-off-by: Donald Sharp <[email protected]>
FRRouting · Sep 22, 2023 · ad3af15 · ad3af15
1 parent eceb1ca
commit ad3af15
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/staticd/static_vty.c b/staticd/static_vty.c
@@ -318,7 +318,7 @@ static int static_route_nb_run(struct vty *vty, struct static_route_args *args)
 		}
 		if (args->label) {
 			/* copy of label string (start) */
-			char *ostr;
+			char *ostr, *orig;
 			/* pointer to next segment */
 			char *nump;
 
@@ -329,7 +329,7 @@ static int static_route_nb_run(struct vty *vty, struct static_route_args *args)
 			nb_cli_enqueue_change(vty, xpath_mpls, NB_OP_DESTROY,
 					      NULL);
 
-			ostr = XSTRDUP(MTYPE_TMP, args->label);
+			orig = ostr = XSTRDUP(MTYPE_TMP, args->label);
 			while ((nump = strsep(&ostr, "/")) != NULL) {
 				snprintf(ab_xpath, sizeof(ab_xpath),
 					 FRR_STATIC_ROUTE_NHLB_KEY_XPATH,
@@ -342,7 +342,7 @@ static int static_route_nb_run(struct vty *vty, struct static_route_args *args)
 						      NB_OP_MODIFY, nump);
 				label_stack_id++;
 			}
-			XFREE(MTYPE_TMP, ostr);
+			XFREE(MTYPE_TMP, orig);
 		} else {
 			strlcpy(xpath_mpls, xpath_nexthop, sizeof(xpath_mpls));
 			strlcat(xpath_mpls, FRR_STATIC_ROUTE_NH_LABEL_XPATH,
@@ -352,7 +352,7 @@ static int static_route_nb_run(struct vty *vty, struct static_route_args *args)
 		}
 		if (args->segs) {
 			/* copy of seg string (start) */
-			char *ostr;
+			char *ostr, *orig;
 			/* pointer to next segment */
 			char *nump;
 
@@ -363,7 +363,7 @@ static int static_route_nb_run(struct vty *vty, struct static_route_args *args)
 			nb_cli_enqueue_change(vty, xpath_segs, NB_OP_DESTROY,
 					      NULL);
 
-			ostr = XSTRDUP(MTYPE_TMP, args->segs);
+			orig = ostr = XSTRDUP(MTYPE_TMP, args->segs);
 			while ((nump = strsep(&ostr, "/")) != NULL) {
 				snprintf(ab_xpath, sizeof(ab_xpath),
 					 FRR_STATIC_ROUTE_NH_SRV6_KEY_SEG_XPATH,
@@ -375,7 +375,7 @@ static int static_route_nb_run(struct vty *vty, struct static_route_args *args)
 						      NB_OP_MODIFY, nump);
 				segs_stack_id++;
 			}
-			XFREE(MTYPE_TMP, ostr);
+			XFREE(MTYPE_TMP, orig);
 		} else {
 			strlcpy(xpath_segs, xpath_nexthop, sizeof(xpath_segs));
 			strlcat(xpath_segs, FRR_STATIC_ROUTE_NH_SRV6_SEGS_XPATH,