From 6209bb32e5b6d8c15d55422bb4716b3b31c1c7b2 Mon Sep 17 00:00:00 2001
From: John Ferlan <jferlan@redhat.com>
Date: Sep 28 2017 10:29:21 +0000
Subject: nwfilter: Fix possible segfault on sometimes consumed variable


The virNWFilterIPAddrMapAddIPAddr code can consume the @addr parameter
on success when the @ifname is found in the ipAddressMap->hashTable
hash table in the call to virNWFilterVarValueAddValue; however, if
not found in the hash table, then @addr is formatted into a @val
which is stored in the table and on return the caller would be
expected to free @addr.

Thus, the caller has no way to determine on success whether @addr was
consumed, so in order to fix this create a @tmp variable which will
be stored/consumed when virNWFilterVarValueAddValue succeeds. That way
the caller can free @addr whether the function returns success or failure.

---

diff --git a/src/conf/nwfilter_ipaddrmap.c b/src/conf/nwfilter_ipaddrmap.c
index 9c8584c..5668f36 100644
--- a/src/conf/nwfilter_ipaddrmap.c
+++ b/src/conf/nwfilter_ipaddrmap.c
@@ -26,7 +26,9 @@
 
 #include "internal.h"
 
+#include "viralloc.h"
 #include "virerror.h"
+#include "virstring.h"
 #include "datatypes.h"
 #include "nwfilter_params.h"
 #include "nwfilter_ipaddrmap.h"
@@ -52,6 +54,7 @@ virNWFilterIPAddrMapAddIPAddr(const char *ifname, char *addr)
 {
     int ret = -1;
     virNWFilterVarValuePtr val;
+    char *tmp = NULL;
 
     virMutexLock(&ipAddressMapLock);
 
@@ -65,14 +68,18 @@ virNWFilterIPAddrMapAddIPAddr(const char *ifname, char *addr)
             virNWFilterVarValueFree(val);
         goto cleanup;
     } else {
-        if (virNWFilterVarValueAddValue(val, addr) < 0)
+        if (VIR_STRDUP(tmp, addr) < 0)
             goto cleanup;
+        if (virNWFilterVarValueAddValue(val, tmp) < 0)
+            goto cleanup;
+        tmp = NULL;
     }
 
     ret = 0;
 
  cleanup:
     virMutexUnlock(&ipAddressMapLock);
+    VIR_FREE(tmp);
 
     return ret;
 }