- check for malloc failure

- plug some memleaks
- avoid close(-1) when open() fails in pcap_open_live()

sent upstream where applicable

ok djm moritz

3 files changed, 51 insertions, 33 deletions

diff --git a/lib/libpcap/fad-getad.c b/lib/libpcap/fad-getad.c
index 94783071dfc..829381a3081 100644
--- a/lib/libpcap/fad-getad.c
+++ b/lib/libpcap/fad-getad.c
@@ -127,11 +127,11 @@ add_or_find_if(pcap_if_t **curdev_ret, pcap_if_t **alldevs, const char *name,
 		 * No, we didn't find it.
 		 * Allocate a new entry.
 		 */
-		curdev = malloc(sizeof(pcap_if_t));
+		curdev = calloc(1, sizeof(pcap_if_t));
 		if (curdev == NULL) {
 			(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
-			    "malloc: %s", pcap_strerror(errno));
-			return (-1);
+			    "calloc: %s", pcap_strerror(errno));
+			goto fail;
 		}
 
 		/*
@@ -140,6 +140,11 @@ add_or_find_if(pcap_if_t **curdev_ret, pcap_if_t **alldevs, const char *name,
 		curdev->next = NULL;
 		len = strlen(name) + 1;
 		curdev->name = malloc(len);
+		if (curdev->name == NULL) {
+			(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
+			    "malloc: %s", pcap_strerror(errno));
+			goto fail;
+		}
 		strlcpy(curdev->name, name, len);
 		if (description != NULL) {
 			/*
@@ -147,12 +152,12 @@ add_or_find_if(pcap_if_t **curdev_ret, pcap_if_t **alldevs, const char *name,
 			 */
 			len = strlen(description) + 1;
 			curdev->description = malloc(len);
+			if (curdev->description == NULL) {
+				(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
+				    "malloc: %s", pcap_strerror(errno));
+				goto fail;
+			}
 			strlcpy(curdev->description, description, len);
-		} else {
-			/*
-			 * We don't.
-			 */
-			curdev->description = NULL;
 		}
 		curdev->addresses = NULL;	/* list starts out as empty */
 		curdev->flags = 0;
@@ -261,6 +266,14 @@ add_or_find_if(pcap_if_t **curdev_ret, pcap_if_t **alldevs, const char *name,
 
 	*curdev_ret = curdev;
 	return (0);
+
+fail:
+	if (curdev != NULL) {
+		free(curdev->name);
+		free(curdev->description);
+		free(curdev);
+	}
+	return (-1);
 }
 
 static int
@@ -294,11 +307,11 @@ add_addr_to_iflist(pcap_if_t **alldevs, const char *name, u_int flags,
 	 *
 	 * Allocate the new entry and fill it in.
 	 */
-	curaddr = malloc(sizeof(pcap_addr_t));
+	curaddr = calloc(1, sizeof(pcap_addr_t));
 	if (curaddr == NULL) {
 		(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
-		    "malloc: %s", pcap_strerror(errno));
-		return (-1);
+		    "calloc: %s", pcap_strerror(errno));
+		goto fail;
 	}
 
 	curaddr->next = NULL;
@@ -307,44 +320,36 @@ add_addr_to_iflist(pcap_if_t **alldevs, const char *name, u_int flags,
 		if (curaddr->addr == NULL) {
 			(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
 			    "malloc: %s", pcap_strerror(errno));
-			free(curaddr);
-			return (-1);
+			goto fail;
 		}
-	} else
-		curaddr->addr = NULL;
+	}
 
 	if (netmask != NULL) {
 		curaddr->netmask = dup_sockaddr(netmask, netmask_size);
 		if (curaddr->netmask == NULL) {
 			(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
 			    "malloc: %s", pcap_strerror(errno));
-			free(curaddr);
-			return (-1);
+			goto fail;
 		}
-	} else
-		curaddr->netmask = NULL;
+	}
 
 	if (broadaddr != NULL) {
 		curaddr->broadaddr = dup_sockaddr(broadaddr, broadaddr_size);
 		if (curaddr->broadaddr == NULL) {
 			(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
 			    "malloc: %s", pcap_strerror(errno));
-			free(curaddr);
-			return (-1);
+			goto fail;
 		}
-	} else
-		curaddr->broadaddr = NULL;
+	}
 
 	if (dstaddr != NULL) {
 		curaddr->dstaddr = dup_sockaddr(dstaddr, dstaddr_size);
 		if (curaddr->dstaddr == NULL) {
 			(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
 			    "malloc: %s", pcap_strerror(errno));
-			free(curaddr);
-			return (-1);
+			goto fail;
 		}
-	} else
-		curaddr->dstaddr = NULL;
+	}
 
 	/*
 	 * Find the end of the list of addresses.
@@ -374,6 +379,16 @@ add_addr_to_iflist(pcap_if_t **alldevs, const char *name, u_int flags,
 	}
 
 	return (0);
+
+fail:
+	if (curaddr != NULL) {
+		free(curaddr->addr);
+		free(curaddr->netmask);
+		free(curaddr->broadaddr);
+		free(curaddr->dstaddr);
+		free(curaddr);
+	}
+	return (-1);
 }
 
 /*
diff --git a/lib/libpcap/nametoaddr.c b/lib/libpcap/nametoaddr.c
index 74b809b0c24..17fb89a53da 100644
--- a/lib/libpcap/nametoaddr.c
+++ b/lib/libpcap/nametoaddr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nametoaddr.c,v 1.12 2005/10/07 19:32:39 mpf Exp $	*/
+/*	$OpenBSD: nametoaddr.c,v 1.13 2006/01/11 07:31:46 jaredy Exp $	*/
 
 /*
  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996
@@ -321,6 +321,8 @@ pcap_ether_aton(const char *s)
 	register u_int d;
 
 	e = ep = (u_char *)malloc(6);
+	if (e == NULL)
+		bpf_error("malloc");
 
 	while (*s) {
 		if (*s == ':')
diff --git a/lib/libpcap/pcap-bpf.c b/lib/libpcap/pcap-bpf.c
index ac72b43f703..6a9ef0c885b 100644
--- a/lib/libpcap/pcap-bpf.c
+++ b/lib/libpcap/pcap-bpf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pcap-bpf.c,v 1.17 2005/11/18 11:05:39 djm Exp $	*/
+/*	$OpenBSD: pcap-bpf.c,v 1.18 2006/01/11 07:31:46 jaredy Exp $	*/
 
 /*
  * Copyright (c) 1993, 1994, 1995, 1996, 1998
@@ -107,7 +107,7 @@ pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 					(void)lseek(p->fd, 0L, SEEK_SET);
 					goto again;
 				}
-				/* fall through */
+				/* FALLTHROUGH */
 #endif
 			}
 			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read: %s",
@@ -208,6 +208,7 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	pcap_t *p;
 	struct bpf_dltlist bdl;
 
+	bzero(&bdl, sizeof(bdl));
 	p = (pcap_t *)malloc(sizeof(*p));
 	if (p == NULL) {
 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
@@ -276,7 +277,6 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 	 * this interface supports.  If this fails with EINVAL, it's
 	 * not fatal; we just don't get to use the feature later.
 	 */
-	bzero(&bdl, sizeof(bdl));
 	if (ioctl(fd, BIOCGDLTLIST, (caddr_t)&bdl) == 0) {
 		bdl.bfl_list = (u_int *) malloc(sizeof(u_int) *
 		    bdl.bfl_len + 1);
@@ -289,7 +289,6 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 		if (ioctl(fd, BIOCGDLTLIST, (caddr_t)&bdl) < 0) {
 			(void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
 			    "BIOCGDLTLIST: %s", pcap_strerror(errno));
-			free(bdl.bfl_list);
 			goto bad;
 		}
 		p->dlt_count = bdl.bfl_len;
@@ -332,7 +331,9 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
 
 	return (p);
  bad:
-	(void)close(fd);
+	if (fd >= 0)
+		(void)close(fd);
+	free(bdl.bfl_list);
 	free(p);
 	return (NULL);
 }