iptables: fix regression with unintended free in need_protomatch

xtables_find_match memory allocation is funny. It can return something
allocated in a linked list or return a just allocated match clone and is
never freed.

This caused confusion and made a broken patch where an unintended free
is done in the case of entry not cloned.
xtables_find_match have a way to comunicate that the entry is cloned by
returning a looping linked list where the next entry is the same entry.
We can use this to understand where the entry has to be freed.

Fixes: ffba75c9cd8f ("iptables: free xtables_match if found in need_protomatch")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Tested-by: Rui Salvaterra <rsalvaterra@gmail.com>

diff --git a/iptables.c b/iptables.c
index 83308ec240bdc0e189db246ea1f7c81a56bec8e3..d03d1dd2933e8000712a0696c4e0d60fa6142347 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -718,7 +718,9 @@ need_protomatch(struct fw3_ipt_rule *r, const char *pname)
        if (!match)
                return true;
 
-       free(match);
+       /* Free any kind of clone from xtables_find_match */
+       if (match == match->next)
+               free(match);
        return !r->protocol_loaded;
 }