commit c29b0f4c291d5ed73f7e1d388bc6d4d4809483a1
from: Omar Polo <op@omarpolo.com>
via: Thomas Adam <thomas@xteddy.org>
date: Sun May 26 14:05:41 2024 UTC

gotwebd: plug leak in get_addrs() error path

h is free'd by add_addr in case of error, but we still leak the
getaddrinfo result.  while here make the check strictier: addr_addr()
fails with -1.

commit - 4131be84e8f3fca2cd1d5f7a36fe763f73f47656
commit + c29b0f4c291d5ed73f7e1d388bc6d4d4809483a1
blob - 93979865f4ad834239ef20b16f08a34de6220396
blob + 11a62a33f5dcf8dbf78a22fe7030c3d1848b689c
--- gotwebd/parse.y
+++ gotwebd/parse.y
@@ -1065,8 +1065,10 @@ get_addrs(const char *hostname, const char *servname, 
 			fatalx("unknown address family %d", res->ai_family);
 		}
 
-		if (add_addr(new_srv, h))
+		if (add_addr(new_srv, h) == -1) {
+			freeaddrinfo(res0);
 			return -1;
+		}
 	}
 	freeaddrinfo(res0);
 	return (0);