From bfffafbb520c9eb72cfba950e245946dc7c9a59d Mon Sep 17 00:00:00 2001
From: Peter Wu <peter@lekensteyn.nl>
Date: Fri, 11 May 2018 21:37:25 +0200
Subject: slirp: fix memleak of guestfwd command

Ensure that the command for the `-net user,smb=...` or `-net
user,guestfwd=...-cmd:...` is freed. Reported by ASAN.

Signed-off-by: Peter Wu <peter@lekensteyn.nl>
---
 slirp/misc.c  | 15 +++++++++++++++
 slirp/misc.h  |  1 +
 slirp/slirp.c |  2 ++
 3 files changed, 18 insertions(+)

diff --git a/slirp/misc.c b/slirp/misc.c
index 260187b6b6..1940a8a75f 100644
--- a/slirp/misc.c
+++ b/slirp/misc.c
@@ -59,6 +59,21 @@ int add_exec(struct ex_list **ex_ptr, int do_pty, char *exec,
 	return 0;
 }
 
+void slirp_destroy_exec_list(struct ex_list *exec_list)
+{
+    struct ex_list *item = exec_list;
+    struct ex_list *next;
+
+    while (item) {
+        next = item->ex_next;
+        if (item->ex_pty == 0) {
+            /* free command only. */
+            g_free((void *)item->ex_exec);
+        }
+        g_free(item);
+        item = next;
+    }
+}
 
 #ifdef _WIN32
 
diff --git a/slirp/misc.h b/slirp/misc.h
index 5211bbd30a..26f3f69a8a 100644
--- a/slirp/misc.h
+++ b/slirp/misc.h
@@ -53,6 +53,7 @@ struct slirp_quehead {
 void slirp_insque(void *, void *);
 void slirp_remque(void *);
 int add_exec(struct ex_list **, int, char *, struct in_addr, int);
+void slirp_destroy_exec_list(struct ex_list *exec_list);
 int fork_exec(struct socket *so, const char *ex, int do_pty);
 
 #endif
diff --git a/slirp/slirp.c b/slirp/slirp.c
index 1cb6b07004..c11f7dd914 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -346,6 +346,8 @@ void slirp_cleanup(Slirp *slirp)
 
     g_rand_free(slirp->grand);
 
+    slirp_destroy_exec_list(slirp->exec_list);
+
     g_free(slirp->vdnssearch);
     g_free(slirp->tftp_prefix);
     g_free(slirp->bootp_filename);
-- 
cgit v1.2.1