Repair memory managment in table parsing code.

I need vacations.
Found and verified by Pyun YongHyeon.
ok dhartmei@

2 files changed, 27 insertions, 11 deletions

diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y
index d4f30d919c8..fc539d34d38 100644
--- a/sbin/pfctl/parse.y
+++ b/sbin/pfctl/parse.y
@@ -1,4 +1,4 @@
-/*	$OpenBSD: parse.y,v 1.400 2003/07/14 20:01:07 dhartmei Exp $	*/
+/*	$OpenBSD: parse.y,v 1.401 2003/07/15 17:12:38 cedric Exp $	*/
 
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -852,6 +852,9 @@ not		: '!'		{ $$ = 1; }
 		| /* empty */	{ $$ = 0; }
 
 tabledef	: TABLE '<' STRING '>' table_opts {
+			struct node_host	 *h, *nh;
+			struct node_tinit	 *ti, *nti;
+
 			if (strlen($3) >= PF_TABLE_NAME_SIZE) {
 				yyerror("table name too long, max %d chars",
 				    PF_TABLE_NAME_SIZE - 1);
@@ -860,6 +863,17 @@ tabledef	: TABLE '<' STRING '>' table_opts {
 			if (pf->loadopt & (PFCTL_FLAG_TABLE | PFCTL_FLAG_ALL))
 				if (process_tabledef($3, &$5))
 					YYERROR;
+			for (ti = SIMPLEQ_FIRST(&$5.init_nodes);
+			    ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) {
+				if (ti->file)
+					free(ti->file);
+				for (h = ti->host; h != NULL; h = nh) {
+					nh = h->next;
+					free(h);
+				}
+				nti = SIMPLEQ_NEXT(ti, entries);
+				free (ti);
+			}
 		}
 		;
 
diff --git a/sbin/pfctl/pfctl_parser.c b/sbin/pfctl/pfctl_parser.c
index 55fa1d203bd..7b3ccc560a0 100644
--- a/sbin/pfctl/pfctl_parser.c
+++ b/sbin/pfctl/pfctl_parser.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl_parser.c,v 1.168 2003/07/11 08:29:34 cedric Exp $ */
+/*	$OpenBSD: pfctl_parser.c,v 1.169 2003/07/15 17:12:38 cedric Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -1219,8 +1219,8 @@ int
 append_addr(struct pfr_buffer *b, char *s, int test)
 {
 	char			 *r;
-	struct node_host	*n;
-	int			 not = 0;
+	struct node_host	*h, *n;
+	int			 rv, not = 0;
 
 	for (r = s; *r == '!'; r++)
 		not = !not;
@@ -1228,12 +1228,18 @@ append_addr(struct pfr_buffer *b, char *s, int test)
 		errno = 0;
 		return (-1);
 	}
-	return append_addr_host(b, n, test, not);
+	rv = append_addr_host(b, n, test, not);
+	do {
+		h = n;
+		n = n->next;
+		free(h);
+	} while (n != NULL);
+	return (rv);
 }
 
 /*
  * same as previous function, but with a pre-parsed input and the ability
- * to "negate" the result.
+ * to "negate" the result. Does not free the node_host list.
  * not:
  *      setting it to 1 is equivalent to adding "!" in front of parameter s.
  */
@@ -1241,7 +1247,6 @@ int
 append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not)
 {
 	int			 bits;
-	struct node_host	*h;
 	struct pfr_addr		 addr;
 
 	do {
@@ -1270,10 +1275,7 @@ append_addr_host(struct pfr_buffer *b, struct node_host *n, int test, int not)
 		}
 		if (pfr_buf_add(b, &addr))
 			return (-1);
-		h = n;
-		n = n->next;
-		free(h);
-	} while (n != NULL);
+	} while ((n = n->next) != NULL);
 
 	return (0);
 }