iptables: fix regression with unintended free in need_protomatch

[project/firewall3.git] / iptables.c

diff --git a/iptables.c b/iptables.c
index 83308ec240bdc0e189db246ea1f7c81a56bec8e3..d03d1dd2933e8000712a0696c4e0d60fa6142347 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -718,7 +718,9 @@ need_protomatch(struct fw3_ipt_rule *r, const char *pname)
        if (!match)
                return true;
 
-       free(match);
+       /* Free any kind of clone from xtables_find_match */
+       if (match == match->next)
+               free(match);
        return !r->protocol_loaded;
 }