segmentation fault in free

Hello,

I have found a bad bug in iptables. saddrs and daddrs are allocated with calloc in host_to_addr if a hostname resolves to more than one ip address, but each array element if getting freed in do_command. The first free will free the whole array and the others are returning that this is not a pointer or are segfaulting.

Fix for this is attached.

Thanks,
Thomas

Thomas Woerner
Software Engineer            Phone: +49-711-96437-310
Red Hat GmbH                 Fax  : +49-711-96437-111
Hauptstaetterstr. 58         Email: Thomas Woerner <[email protected]>
D-70178 Stuttgart            Web  : http://www.redhat.de/

@@ -2344,11 +2344,8 @@
 		e = NULL;
 	}
 
-	for (c = 0; c < nsaddrs; c++)
-		free(&saddrs[c]);
-
-	for (c = 0; c < ndaddrs; c++)
-		free(&daddrs[c]);
+	free(saddrs);
+	free(daddrs);
 
 	if (opts != original_opts) {
 		free(opts);

Thanks, already fixed in CVS.

Regards
Patrick