From 20316daf2d6f15fa2a8a1c38c498ddbaa4f71cde Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Mon, 13 Oct 2025 11:28:59 +0200 Subject: [PATCH] confd: fix possible resource leak in firewall conf change Coverity scan detected a memory leak in the new firewall change() cb where allocated memory from ietf_interfaces_get_all_l3() was not freed on error paths when srx_get_diff() failed or returned NULL. This commit consolidates all cleanup paths to use the 'done:' label, ensuring ifaces, diff, and cfg are properly freed in all exit scenarios. Signed-off-by: Joachim Wiberg --- src/confd/src/infix-firewall.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/confd/src/infix-firewall.c b/src/confd/src/infix-firewall.c index 7223ed15..ebdb4539 100644 --- a/src/confd/src/infix-firewall.c +++ b/src/confd/src/infix-firewall.c @@ -542,10 +542,10 @@ static int change(sr_session_ctx_t *session, uint32_t sub_id, const char *module err = srx_get_diff(session, &diff); if (err) - goto err_release_data; + goto done; if (!diff) - goto err_release_data; + goto done; /* Create /etc/firewalld+ directory structure */ if (fmkpath(0755, FIREWALLD_DIR_NEXT) || @@ -554,7 +554,7 @@ static int change(sr_session_ctx_t *session, uint32_t sub_id, const char *module fmkpath(0755, FIREWALLD_POLICIES_DIR)) { ERROR("Failed creating " FIREWALLD_DIR_NEXT " directory structure"); err = SR_ERR_SYS; - goto err_release_data; + goto done; } if (lydx_get_descendant(diff, "firewall", "default", NULL) || @@ -630,7 +630,7 @@ static int change(sr_session_ctx_t *session, uint32_t sub_id, const char *module if (generate_policy(cnode, name, &priority)) { ERROR("Failed to generate policy %s", name); - goto err_release_data; + goto done; } } } @@ -644,7 +644,7 @@ done: if (diff) lyd_free_tree(diff); -err_release_data: + if (cfg) sr_release_data(cfg);