From 8e11d702921e51a5eb00b9ee12925cae69039c22 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>

Date: Thu, 18 Jul 2019 18:49:30 +0200

Subject: [PATCH] Fix issues detected by Coverity

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Squashed commit of the following:

commit 6a5fa6c9207961a662f8debbe9172500c752e3ac

Author: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>

Date:   Mon Dec 10 10:34:35 2018 +0000

    build failure on master with NO_DHCPv6 and fix....

    Hi Simon,

    master has a build error when building without HAVE_DHCPv6

    option.c: In function 'dhcp_context_free':

    option.c:1042:15: error: 'struct dhcp_context' has no member named 'template_interface'

           free(ctx->template_interface);

    Sadly, need to put in a little conditional compilation ifdef'erey

    Simplest patch in the world attached

    Cheers,

    Kevin D-B

    012C ACB2 28C6 C53E 9775  9123 B3A2 389B 9DE2 334A

    From 061eb8599636bb360e0b7fa5986935b86db39497 Mon Sep 17 00:00:00 2001

    From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

    Date: Mon, 10 Dec 2018 10:07:33 +0000

    Subject: [PATCH] option: fix non DHCPv6 build error

    option.c: In function 'dhcp_context_free':

    option.c:1042:15: error: 'struct dhcp_context' has no member named 'template_interface'

           free(ctx->template_interface);

    		^~

    Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

    (cherry picked from commit b683cf37f9f3dd3dc5d95d621ee75850d559b2e4)

commit a4be120618a5d8517d23e687003cab53e7db11c9

Author: Petr Menšík <pemensik@redhat.com>

Date:   Sun Dec 16 21:25:29 2018 +0000

    Fix option parsing errors introduced in 59e470381f84f2fdf0640c7bc67827f3f0c64784

    Thanks to Kevin Darbyshire-Bryant for spotting this.

    (cherry picked from commit 137e9f878fafb38369eab7d9dfe84e4228ff5f89)

commit 3e0752faa67ffd25893ebbcbe6a5788699a2e1c9

Author: Petr Menšík <pemensik@redhat.com>

Date:   Fri Nov 2 22:39:39 2018 +0000

    Free config file values on parsing errors.

    This time I have a little bit more controversal patches. But I think

    still useful. They fixes memory leaks that might occur in some cases.

    Most dnsmasq errors is fatal, so it does not matter. But some are not.

    Some parts are reloaded on SIGHUP signal, so it might leak more than once.

    Some example when it changes the failures. Use dhcp-options file with

    this content:

    tag:error,vendor:redhat

    option:ntp-server,1.2.3.4.5

    option6:ntp-server,[:::]

    Is not fatal and dnsmasq will start. On each reload command, it would

    leak some memory. I validated it using valgrind --leak-check=full

    dnsmasq -d. This patch fixes it. It introduces something that might be

    considered constructor and destructor of selected structures.

    (cherry picked from commit 59e470381f84f2fdf0640c7bc67827f3f0c64784)

commit c2a44c21dddffff95346c931feda696704ea73ca

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Oct 24 22:30:18 2018 +0100

    Do not rely on dead code elimination, use array instead.

    Make options bits derived from size and count. Use size of option bits

    and last supported bit in computation. No new change would be required

    when new options are added. Just change OPT_LAST constant.

    (cherry picked from commit 24b87607c1353e94689e8a2190571ab3f3b36f31)

commit 5b9f199a1b16b7aa41cf544e9312c93e893206b3

Author: Petr Menšík <pemensik@redhat.com>

Date:   Fri Aug 17 10:20:05 2018 +0200

    Minor improvements in lease-tools

    Limit max interface name to fit into buffer.

    Make sure pointer have to be always positive.

    Close socket after received reply.

    (cherry picked from commit 2b38e3823b12ab13f86c3a44648de436daadb1f6)

commit d30a8f4c46a1b446b7d9932d022a09f1ee6b4554

Author: Petr Menšík <pemensik@redhat.com>

Date:   Thu Aug 16 15:48:15 2018 +0200

    Close socket after received reply

commit 6e5dedbb8aa3d27c9477558e66f9d260414340a3

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Aug 15 19:41:07 2018 +0200

    Mark die function as never returning

    Improves static analysis output and reduces false positives.

commit 3d7e9ba115d3c229d678814103dbf3401738dcf5

Author: Petr Menšík <pemensik@redhat.com>

Date:   Wed Aug 15 18:17:00 2018 +0200

    Fix lengths of interface names

    Use helper function similar to copy correctly limited names into

    buffers.

---

 contrib/lease-tools/dhcp_lease_time.c |   2 +-

 contrib/lease-tools/dhcp_release.c    |   3 +-

 contrib/lease-tools/dhcp_release6.c   |   5 +-

 src/bpf.c                             |   2 +-

 src/dhcp.c                            |   9 +-

 src/dnsmasq.h                         |  20 +-

 src/log.c                             |   2 +-

 src/network.c                         |  12 +-

 src/option.c                          | 548 +++++++++++++++++---------

 src/rfc2131.c                         |  10 +-

 src/tftp.c                            |   2 +-

 src/util.c                            |  12 +-

 12 files changed, 408 insertions(+), 219 deletions(-)

diff --git a/contrib/lease-tools/dhcp_lease_time.c b/contrib/lease-tools/dhcp_lease_time.c

index f9d7a85..697d627 100644

--- a/contrib/lease-tools/dhcp_lease_time.c

+++ b/contrib/lease-tools/dhcp_lease_time.c

@@ -83,7 +83,7 @@ static unsigned char *option_find1(unsigned char *p, unsigned char *end, int opt

           if (p >= end - 2)

             return NULL; /* malformed packet */

           opt_len = option_len(p);

-          if (p >= end - (2 + opt_len))

+          if (end - p >= (2 + opt_len))

             return NULL; /* malformed packet */

           if (*p == opt && opt_len >= minsize)

             return p;

diff --git a/contrib/lease-tools/dhcp_release.c b/contrib/lease-tools/dhcp_release.c

index 201fcd3..59883d4 100644

--- a/contrib/lease-tools/dhcp_release.c

+++ b/contrib/lease-tools/dhcp_release.c

@@ -270,7 +270,8 @@ int main(int argc, char **argv)

   /* This voodoo fakes up a packet coming from the correct interface, which really matters for 

      a DHCP server */

-  strcpy(ifr.ifr_name, argv[1]);

+  strncpy(ifr.ifr_name, argv[1], sizeof(ifr.ifr_name)-1);

+  ifr.ifr_name[sizeof(ifr.ifr_name)-1] = '\0';

   if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, &ifr, sizeof(ifr)) == -1)

     {

       perror("cannot setup interface");

diff --git a/contrib/lease-tools/dhcp_release6.c b/contrib/lease-tools/dhcp_release6.c

index 7f79fa7..d680222 100644

--- a/contrib/lease-tools/dhcp_release6.c

+++ b/contrib/lease-tools/dhcp_release6.c

@@ -376,9 +376,12 @@ int send_release_packet(const char* iface, struct dhcp6_packet* packet)

             sleep(1);

             continue;

 	  }

+

+        close(sock);

         return result;

       }

-    

+

+    close(sock);

     fprintf(stderr, "Response timed out\n");

     return -1;   

 }

diff --git a/src/bpf.c b/src/bpf.c

index 49a11bf..ff66d6d 100644

--- a/src/bpf.c

+++ b/src/bpf.c

@@ -169,7 +169,7 @@ int iface_enumerate(int family, void *parm, int (*callback)())

 	      struct in6_ifreq ifr6;

 	      memset(&ifr6, 0, sizeof(ifr6));

-	      strncpy(ifr6.ifr_name, addrs->ifa_name, sizeof(ifr6.ifr_name));

+	      safe_strncpy(ifr6.ifr_name, addrs->ifa_name, sizeof(ifr6.ifr_name));

 	      ifr6.ifr_addr = *((struct sockaddr_in6 *) addrs->ifa_addr);

 	      if (fd != -1 && ioctl(fd, SIOCGIFAFLAG_IN6, &ifr6) != -1)

diff --git a/src/dhcp.c b/src/dhcp.c

index 5a8daec..26f3287 100644

--- a/src/dhcp.c

+++ b/src/dhcp.c

@@ -232,7 +232,7 @@ void dhcp_packet(time_t now, int pxe_fd)

 #ifdef HAVE_LINUX_NETWORK

   /* ARP fiddling uses original interface even if we pretend to use a different one. */

-  strncpy(arp_req.arp_dev, ifr.ifr_name, 16);

+  safe_strncpy(arp_req.arp_dev, ifr.ifr_name, sizeof(arp_req.arp_dev));

 #endif 

   /* If the interface on which the DHCP request was received is an

@@ -255,7 +255,7 @@ void dhcp_packet(time_t now, int pxe_fd)

 	      }

 	    else 

 	      {

-		strncpy(ifr.ifr_name,  bridge->iface, IF_NAMESIZE);

+		safe_strncpy(ifr.ifr_name,  bridge->iface, sizeof(ifr.ifr_name));

 		break;

 	      }

 	  }

@@ -279,7 +279,7 @@ void dhcp_packet(time_t now, int pxe_fd)

       is_relay_reply = 1; 

       iov.iov_len = sz;

 #ifdef HAVE_LINUX_NETWORK

-      strncpy(arp_req.arp_dev, ifr.ifr_name, 16);

+      safe_strncpy(arp_req.arp_dev, ifr.ifr_name, sizeof(arp_req.arp_dev));

 #endif 

     }

   else

@@ -988,8 +988,7 @@ char *host_from_dns(struct in_addr addr)

       if (!legal_hostname(hostname))

 	return NULL;

-      strncpy(daemon->dhcp_buff, hostname, 256);

-      daemon->dhcp_buff[255] = 0;

+      safe_strncpy(daemon->dhcp_buff, hostname, 256);

       strip_hostname(daemon->dhcp_buff);

       return daemon->dhcp_buff;

diff --git a/src/dnsmasq.h b/src/dnsmasq.h

index 6773b69..6b18bb7 100644

--- a/src/dnsmasq.h

+++ b/src/dnsmasq.h

@@ -42,6 +42,12 @@

 #  define __EXTENSIONS__

 #endif

+#if (defined(__GNUC__) && __GNUC__ >= 3) || defined(__clang__)

+#define ATTRIBUTE_NORETURN __attribute__ ((noreturn))

+#else

+#define ATTRIBUTE_NORETURN

+#endif

+

 /* get these before config.h  for IPv6 stuff... */

 #include <sys/types.h> 

 #include <sys/socket.h>

@@ -190,9 +196,6 @@ struct event_desc {

 #define EC_MISC        5

 #define EC_INIT_OFFSET 10

-/* Trust the compiler dead-code eliminator.... */

-#define option_bool(x) (((x) < 32) ? daemon->options & (1u << (x)) : daemon->options2 & (1u << ((x) - 32)))

-

 #define OPT_BOGUSPRIV      0

 #define OPT_FILTER         1

 #define OPT_LOG            2

@@ -252,6 +255,12 @@ struct event_desc {

 #define OPT_TFTP_APREF_MAC 56

 #define OPT_LAST           57

+#define OPTION_BITS (sizeof(unsigned int)*8)

+#define OPTION_SIZE ( (OPT_LAST/OPTION_BITS)+((OPT_LAST%OPTION_BITS)!=0) )

+#define option_var(x) (daemon->options[(x) / OPTION_BITS])

+#define option_val(x) ((1u) << ((x) % OPTION_BITS))

+#define option_bool(x) (option_var(x) & option_val(x))

+

 /* extra flags for my_syslog, we use a couple of facilities since they are known 

    not to occupy the same bits as priorities, no matter how syslog.h is set up. */

 #define MS_TFTP   LOG_USER

@@ -947,7 +956,7 @@ extern struct daemon {

      config file arguments. All set (including defaults)

      in option.c */

-  unsigned int options, options2;

+  unsigned int options[OPTION_SIZE];

   struct resolvc default_resolv, *resolv_files;

   time_t last_resolv;

   char *servers_file;

@@ -1205,6 +1214,7 @@ int legal_hostname(char *name);

 char *canonicalise(char *in, int *nomem);

 unsigned char *do_rfc1035_name(unsigned char *p, char *sval, char *limit);

 void *safe_malloc(size_t size);

+void safe_strncpy(char *dest, const char *src, size_t size);

 void safe_pipe(int *fd, int read_noblock);

 void *whine_malloc(size_t size);

 int sa_len(union mysockaddr *addr);

@@ -1233,7 +1243,7 @@ int wildcard_match(const char* wildcard, const char* match);

 int wildcard_matchn(const char* wildcard, const char* match, int num);

 /* log.c */

-void die(char *message, char *arg1, int exit_code);

+void die(char *message, char *arg1, int exit_code) ATTRIBUTE_NORETURN;

 int log_start(struct passwd *ent_pw, int errfd);

 int log_reopen(char *log_file);

diff --git a/src/log.c b/src/log.c

index dae8a75..d0d4780 100644

--- a/src/log.c

+++ b/src/log.c

@@ -232,7 +232,7 @@ static void log_write(void)

 	      logaddr.sun_len = sizeof(logaddr) - sizeof(logaddr.sun_path) + strlen(_PATH_LOG) + 1; 

 #endif

 	      logaddr.sun_family = AF_UNIX;

-	      strncpy(logaddr.sun_path, _PATH_LOG, sizeof(logaddr.sun_path));

+	      safe_strncpy(logaddr.sun_path, _PATH_LOG, sizeof(logaddr.sun_path));

 	      /* Got connection back? try again. */

 	      if (connect(log_fd, (struct sockaddr *)&logaddr, sizeof(logaddr)) != -1)

diff --git a/src/network.c b/src/network.c

index 0381513..efb7b03 100644

--- a/src/network.c

+++ b/src/network.c

@@ -29,7 +29,7 @@ int indextoname(int fd, int index, char *name)

   if (ioctl(fd, SIOCGIFNAME, &ifr) == -1)

     return 0;

-  strncpy(name, ifr.ifr_name, IF_NAMESIZE);

+  safe_strncpy(name, ifr.ifr_name, IF_NAMESIZE);

   return 1;

 }

@@ -82,12 +82,12 @@ int indextoname(int fd, int index, char *name)

   for (i = lifc.lifc_len / sizeof(struct lifreq); i; i--, lifrp++) 

     {

       struct lifreq lifr;

-      strncpy(lifr.lifr_name, lifrp->lifr_name, IF_NAMESIZE);

+      safe_strncpy(lifr.lifr_name, lifrp->lifr_name, IF_NAMESIZE);

       if (ioctl(fd, SIOCGLIFINDEX, &lifr) < 0) 

 	return 0;

       if (lifr.lifr_index == index) {

-	strncpy(name, lifr.lifr_name, IF_NAMESIZE);

+	safe_strncpy(name, lifr.lifr_name, IF_NAMESIZE);

 	return 1;

       }

     }

@@ -188,7 +188,7 @@ int loopback_exception(int fd, int family, struct all_addr *addr, char *name)

   struct ifreq ifr;

   struct irec *iface;

-  strncpy(ifr.ifr_name, name, IF_NAMESIZE);

+  safe_strncpy(ifr.ifr_name, name, IF_NAMESIZE);

   if (ioctl(fd, SIOCGIFFLAGS, &ifr) != -1 &&

       ifr.ifr_flags & IFF_LOOPBACK)

     {

@@ -1284,7 +1284,7 @@ static struct serverfd *allocate_sfd(union mysockaddr *addr, char *intname)

       return NULL;

     }

-  strcpy(sfd->interface, intname); 

+  safe_strncpy(sfd->interface, intname, sizeof(sfd->interface)); 

   sfd->source_addr = *addr;

   sfd->next = daemon->sfds;

   sfd->ifindex = ifindex;

@@ -1452,7 +1452,7 @@ void add_update_server(int flags,

 	serv->flags |= SERV_HAS_DOMAIN;

       if (interface)

-	strcpy(serv->interface, interface);      

+	safe_strncpy(serv->interface, interface, sizeof(serv->interface));

       if (addr)

 	serv->addr = *addr;

       if (source_addr)

diff --git a/src/option.c b/src/option.c

index d358d99..9768efb 100644

--- a/src/option.c

+++ b/src/option.c

@@ -559,14 +559,15 @@ static void *opt_malloc(size_t size)

   return ret;

 }

-static char *opt_string_alloc(char *cp)

+static char *opt_string_alloc(const char *cp)

 {

   char *ret = NULL;

+  size_t len;

-  if (cp && strlen(cp) != 0)

+  if (cp && (len = strlen(cp)) != 0)

     {

-      ret = opt_malloc(strlen(cp)+1);

-      strcpy(ret, cp); 

+      ret = opt_malloc(len+1);

+      memcpy(ret, cp, len+1); 

       /* restore hidden metachars */

       unhide_metas(ret);

@@ -741,6 +742,8 @@ static void do_usage(void)

 }

 #define ret_err(x) do { strcpy(errstr, (x)); return 0; } while (0)

+#define ret_err_free(x,m) do { strcpy(errstr, (x)); free((m)); return 0; } while (0)

+#define goto_err(x) do { strcpy(errstr, (x)); goto on_error; } while (0)

 static char *parse_mysockaddr(char *arg, union mysockaddr *addr) 

 {

@@ -792,7 +795,7 @@ char *parse_server(char *arg, union mysockaddr *addr, union mysockaddr *source_a

     if (interface_opt)

       {

 #if defined(SO_BINDTODEVICE)

-	strncpy(interface, interface_opt, IF_NAMESIZE - 1);

+	safe_strncpy(interface, interface_opt, IF_NAMESIZE);

 #else

 	return _("interface binding not supported");

 #endif

@@ -821,7 +824,7 @@ char *parse_server(char *arg, union mysockaddr *addr, union mysockaddr *source_a

 		return _("interface can only be specified once");

 	      source_addr->in.sin_addr.s_addr = INADDR_ANY;

-	      strncpy(interface, source, IF_NAMESIZE - 1);

+	      safe_strncpy(interface, source, IF_NAMESIZE);

 #else

 	      return _("interface binding not supported");

 #endif

@@ -856,7 +859,7 @@ char *parse_server(char *arg, union mysockaddr *addr, union mysockaddr *source_a

 		return _("interface can only be specified once");

 	      source_addr->in6.sin6_addr = in6addr_any;

-	      strncpy(interface, source, IF_NAMESIZE - 1);

+	      safe_strncpy(interface, source, IF_NAMESIZE);

 #else

 	      return _("interface binding not supported");

 #endif

@@ -894,6 +897,8 @@ static struct server *add_rev4(struct in_addr addr, int msize)

       p += sprintf(p, "%d.", (a >> 24) & 0xff);

       break;

     default:

+      free(serv->domain);

+      free(serv);

       return NULL;

     }

@@ -948,6 +953,99 @@ static char *set_prefix(char *arg)

    return arg;

 }

+static struct dhcp_netid *

+dhcp_netid_create(const char *net, struct dhcp_netid *next)

+{

+  struct dhcp_netid *tt;

+  tt = opt_malloc(sizeof (struct dhcp_netid));

+  tt->net = opt_string_alloc(net);

+  tt->next = next;

+  return tt;

+}

+

+static void dhcp_netid_free(struct dhcp_netid *nid)

+{

+  while (nid)

+    {

+      struct dhcp_netid *tmp = nid;

+      nid = nid->next;

+      free(tmp->net);

+      free(tmp);

+    }

+}

+

+/* Parse one or more tag:s before parameters.

+ * Moves arg to the end of tags. */

+static struct dhcp_netid * dhcp_tags(char **arg)

+{

+  struct dhcp_netid *id = NULL;

+

+  while (is_tag_prefix(*arg))

+    {

+      char *comma = split(*arg);

+      id = dhcp_netid_create((*arg)+4, id);

+      *arg = comma;

+    };

+  if (!*arg)

+    {

+      dhcp_netid_free(id);

+      id = NULL;

+    }

+  return id;

+}

+

+static void dhcp_netid_list_free(struct dhcp_netid_list *netid)

+{

+  while (netid)

+    {

+      struct dhcp_netid_list *tmplist = netid;

+      netid = netid->next;

+      dhcp_netid_free(tmplist->list);

+      free(tmplist);

+    }

+}

+

+static void dhcp_config_free(struct dhcp_config *config)

+{

+  if (config)

+    {

+      struct hwaddr_config *hwaddr = config->hwaddr;

+      while (hwaddr)

+        {

+	  struct hwaddr_config *tmp = hwaddr;

+          hwaddr = hwaddr->next;

+	  free(tmp);

+        }

+      dhcp_netid_list_free(config->netid);

+      if (config->flags & CONFIG_CLID)

+        free(config->clid);

+      free(config);

+    }

+}

+

+static void dhcp_context_free(struct dhcp_context *ctx)

+{

+  if (ctx)

+    {

+      dhcp_netid_free(ctx->filter);

+      free(ctx->netid.net);

+#ifdef HAVE_DHCP6

+      free(ctx->template_interface);

+#endif

+      free(ctx);

+    }

+}

+

+static void dhcp_opt_free(struct dhcp_opt *opt)

+{

+  if (opt->flags & DHOPT_VENDOR)

+    free(opt->u.vendor_class);

+  dhcp_netid_free(opt->netid);

+  free(opt->val);

+  free(opt);

+}

+

+

 /* This is too insanely large to keep in-line in the switch */

 static int parse_dhcp_opt(char *errstr, char *arg, int flags)

 {

@@ -955,7 +1053,6 @@ static int parse_dhcp_opt(char *errstr, char *arg, int flags)

   char lenchar = 0, *cp;

   int addrs, digs, is_addr, is_addr6, is_hex, is_dec, is_string, dots;

   char *comma = NULL;

-  struct dhcp_netid *np = NULL;

   u16 opt_len = 0;

   int is6 = 0;

   int option_ok = 0;

@@ -1042,14 +1139,9 @@ static int parse_dhcp_opt(char *errstr, char *arg, int flags)

 	}

       else

 	{

-	  new->netid = opt_malloc(sizeof (struct dhcp_netid));

 	  /* allow optional "net:" or "tag:" for consistency */

-	  if (is_tag_prefix(arg))

-	    new->netid->net = opt_string_alloc(arg+4);

-	  else

-	    new->netid->net = opt_string_alloc(set_prefix(arg));

-	  new->netid->next = np;

-	  np = new->netid;

+	  const char *name = (is_tag_prefix(arg)) ? arg+4 : set_prefix(arg);

+	  new->netid = dhcp_netid_create(name, new->netid);

 	}

       arg = comma; 

@@ -1059,7 +1151,7 @@ static int parse_dhcp_opt(char *errstr, char *arg, int flags)

   if (is6)

     {

       if (new->flags & (DHOPT_VENDOR | DHOPT_ENCAPSULATE))

-	ret_err(_("unsupported encapsulation for IPv6 option"));

+	goto_err(_("unsupported encapsulation for IPv6 option"));

       if (opt_len == 0 &&

 	  !(new->flags & DHOPT_RFC3925))

@@ -1073,7 +1165,7 @@ static int parse_dhcp_opt(char *errstr, char *arg, int flags)

   /* option may be missing with rfc3925 match */

   if (!option_ok)

-    ret_err(_("bad dhcp-option"));

+    goto_err(_("bad dhcp-option"));

   if (comma)

     {

@@ -1141,10 +1233,10 @@ static int parse_dhcp_opt(char *errstr, char *arg, int flags)

 	  is_string = is_dec = is_hex = 0;

 	  if (!is6 && (!is_addr || dots == 0))

-	    ret_err(_("bad IP address"));

+	    goto_err(_("bad IP address"));

 	   if (is6 && !is_addr6)

-	     ret_err(_("bad IPv6 address"));

+	     goto_err(_("bad IPv6 address"));

 	}

       /* or names */

       else if (opt_len & (OT_NAME | OT_RFC1035_NAME | OT_CSTRING))

@@ -1237,7 +1329,7 @@ static int parse_dhcp_opt(char *errstr, char *arg, int flags)

 	      comma = split(cp);

 	      slash = split_chr(cp, '/');

 	      if (!inet_pton(AF_INET, cp, &in))

-		ret_err(_("bad IPv4 address"));

+		goto_err(_("bad IPv4 address"));

 	      if (!slash)

 		{

 		  memcpy(op, &in, INADDRSZ);

@@ -1282,8 +1374,8 @@ static int parse_dhcp_opt(char *errstr, char *arg, int flags)

 		  op += IN6ADDRSZ;

 		  continue;

 		}

-	  

-	      ret_err(_("bad IPv6 address"));

+

+	      goto_err(_("bad IPv6 address"));

 	    } 

 	  new->len = op - new->val;

 	}

@@ -1310,7 +1402,7 @@ static int parse_dhcp_opt(char *errstr, char *arg, int flags)

 		  if (strcmp (arg, ".") != 0)

 		    {

 		      if (!(dom = canonicalise_opt(arg)))

-			ret_err(_("bad domain in dhcp-option"));

+			goto_err(_("bad domain in dhcp-option"));

 		      domlen = strlen(dom) + 2;

 		    }

@@ -1404,7 +1496,7 @@ static int parse_dhcp_opt(char *errstr, char *arg, int flags)

 		{

 		  char *dom = canonicalise_opt(arg);

 		  if (!dom)

-		    ret_err(_("bad domain in dhcp-option"));

+		    goto_err(_("bad domain in dhcp-option"));

 		  newp = opt_malloc(len + strlen(dom) + 2);

@@ -1442,14 +1534,14 @@ static int parse_dhcp_opt(char *errstr, char *arg, int flags)

       ((new->len > 255) || 

       (new->len > 253 && (new->flags & (DHOPT_VENDOR | DHOPT_ENCAPSULATE))) ||

        (new->len > 250 && (new->flags & DHOPT_RFC3925))))

-    ret_err(_("dhcp-option too long"));

+    goto_err(_("dhcp-option too long"));

   if (flags == DHOPT_MATCH)

     {

       if ((new->flags & (DHOPT_ENCAPSULATE | DHOPT_VENDOR)) ||

 	  !new->netid ||

 	  new->netid->next)

-	ret_err(_("illegal dhcp-match"));

+	goto_err(_("illegal dhcp-match"));

       if (is6)

 	{

@@ -1474,24 +1566,31 @@ static int parse_dhcp_opt(char *errstr, char *arg, int flags)

     }

   return 1;

+on_error:

+  dhcp_opt_free(new);

+  return 0;

 }

 #endif

 void set_option_bool(unsigned int opt)

 {

-  if (opt < 32)

-    daemon->options |= 1u << opt;

-  else

-    daemon->options2 |= 1u << (opt - 32);

+  option_var(opt) |= option_val(opt);

 }

 void reset_option_bool(unsigned int opt)

 {

-  if (opt < 32)

-    daemon->options &= ~(1u << opt);

-  else

-    daemon->options2 &= ~(1u << (opt - 32));

+  option_var(opt) &= ~(option_val(opt));

+}

+

+static void server_list_free(struct server *list)

+{

+  while (list)

+    {

+      struct server *tmp = list;

+      list = list->next;

+      free(tmp);

+    }

 }

 static int one_opt(int option, char *arg, char *errstr, char *gen_err, int command_line, int servers_only)

@@ -1675,13 +1774,13 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma

 	      /* has subnet+len */

 	      err = parse_mysockaddr(arg, &new->addr);

 	      if (err)

-		ret_err(err);

+		ret_err_free(err, new);

 	      if (!atoi_check(end, &new->mask))

-		ret_err(gen_err);

+		ret_err_free(gen_err, new);

 	      new->addr_used = 1;

 	    } 

 	  else if (!atoi_check(arg, &new->mask))

-	    ret_err(gen_err);

+	    ret_err_free(gen_err, new);

           daemon->add_subnet4 = new;

@@ -1693,15 +1792,15 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma

 		  /* has subnet+len */

                   err = parse_mysockaddr(comma, &new->addr);

                   if (err)

-                    ret_err(err);

+                    ret_err_free(err, new);

                   if (!atoi_check(end, &new->mask))