isisd: Ensure rcap is freed in error case

donaldsharp · donaldsharp · commit 49efc80d342d · 2022-07-22T13:17:58.000-04:00
unpack_tlv_router_cap allocates memory that in the error
case is not being freed.

Signed-off-by: Donald Sharp &lt;sharpd@nvidia.com&gt;
diff --git a/isisd/isis_tlvs.c b/isisd/isis_tlvs.c
@@ -3580,9 +3580,9 @@ static int pack_tlv_router_cap(const struct isis_router_cap *router_cap,
 }
 
 static int unpack_tlv_router_cap(enum isis_tlv_context context,
-				       uint8_t tlv_type, uint8_t tlv_len,
-				       struct stream *s, struct sbuf *log,
-				       void *dest, int indent)
+				 uint8_t tlv_type, uint8_t tlv_len,
+				 struct stream *s, struct sbuf *log, void *dest,
+				 int indent)
 {
 	struct isis_tlvs *tlvs = dest;
 	struct isis_router_cap *rcap;
@@ -3627,7 +3627,7 @@ static int unpack_tlv_router_cap(enum isis_tlv_context context,
 				log, indent,
 				"WARNING: Router Capability subTLV length too large compared to expected size\n");
 			stream_forward_getp(s, STREAM_READABLE(s));
-
+			XFREE(MTYPE_ISIS_TLV, rcap);
 			return 0;
 		}
 

Original file line number	Diff line number	Diff line change
`@@ -3580,9 +3580,9 @@ static int pack_tlv_router_cap(const struct isis_router_cap *router_cap,`
`3580`	`3580`	`}`
`3581`	`3581`
`3582`	`3582`	`static int unpack_tlv_router_cap(enum isis_tlv_context context,`
`3583`		`- uint8_t tlv_type, uint8_t tlv_len,`
`3584`		`- struct stream s, struct sbuf log,`
`3585`		`- void *dest, int indent)`
	`3583`	`+ uint8_t tlv_type, uint8_t tlv_len,`
	`3584`	`+ struct stream s, struct sbuf log, void *dest,`
	`3585`	`+ int indent)`
`3586`	`3586`	`{`
`3587`	`3587`	`struct isis_tlvs *tlvs = dest;`
`3588`	`3588`	`struct isis_router_cap *rcap;`
`@@ -3627,7 +3627,7 @@ static int unpack_tlv_router_cap(enum isis_tlv_context context,`
`3627`	`3627`	`log, indent,`
`3628`	`3628`	`"WARNING: Router Capability subTLV length too large compared to expected size\n");`
`3629`	`3629`	`stream_forward_getp(s, STREAM_READABLE(s));`
`3630`		`-`
	`3630`	`+ XFREE(MTYPE_ISIS_TLV, rcap);`
`3631`	`3631`	`return 0;`
`3632`	`3632`	`}`
`3633`	`3633`