[PATCH 2/3] network: pf: fix memory leaks

24 Jul 2026

Properly free result of virSocketAddrFormat() and
virBufferContentAndReset().

Signed-off-by: Roman Bogorodskiy <bogorodskiy@gmail.com>
---
 src/network/network_pf.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/network/network_pf.c b/src/network/network_pf.c
index 724b82c054..95f63ac37f 100644
--- a/src/network/network_pf.c
+++ b/src/network/network_pf.c
@@ -171,6 +171,8 @@ pfAddNatFirewallRules(virNetworkDef *def,
     g_autoptr(virCommand) flush_cmd = virCommandNew(PFCTL);
     virPortRange *portRange = &def->forward.port;
     g_autofree char *portRangeStr = NULL;
+    g_autofree char *addr = NULL;
+    g_autofree char *pf_rules = NULL;
 
     if (prefix < 0) {
         virReportError(VIR_ERR_INTERNAL_ERROR,
@@ -205,36 +207,39 @@ pfAddNatFirewallRules(virNetworkDef *def,
         }
     }
 
+    if (!(addr = virSocketAddrFormat(&ipdef->address)))
+        return -1;
+
     virBufferAsprintf(&pf_rules_buf,
                       "table <natdst> persist { 0.0.0.0/0, ! %s/%d, ! %s, ! %s }\n",
-                      virSocketAddrFormat(&ipdef->address),
+                      addr,
                       prefix,
                       networkLocalMulticastIPv4,
                       networkLocalBroadcast);
     virBufferAsprintf(&pf_rules_buf,
                       "nat pass on %s from %s/%d to <natdst> -> (%s) port %s\n",
                       forwardIf,
-                      virSocketAddrFormat(&ipdef->address),
+                      addr,
                       prefix,
                       forwardIf,
                       portRangeStr);
     virBufferAsprintf(&pf_rules_buf,
                       "pass quick on %s from %s/%d to %s/%d\n",
                       def->bridge,
-                      virSocketAddrFormat(&ipdef->address),
+                      addr,
                       prefix,
-                      virSocketAddrFormat(&ipdef->address),
+                      addr,
                       prefix);
     virBufferAsprintf(&pf_rules_buf,
                       "pass quick on %s from %s/%d to %s\n",
                       def->bridge,
-                      virSocketAddrFormat(&ipdef->address),
+                      addr,
                       prefix,
                       networkLocalMulticastIPv4);
     virBufferAsprintf(&pf_rules_buf,
                       "pass quick on %s from %s/%d to %s\n",
                       def->bridge,
-                      virSocketAddrFormat(&ipdef->address),
+                      addr,
                       prefix,
                       networkLocalBroadcast);
     virBufferAsprintf(&pf_rules_buf,
@@ -246,7 +251,8 @@ pfAddNatFirewallRules(virNetworkDef *def,
     virCommandAddArgFormat(cmd, "libvirt/%s", def->name);
     virCommandAddArgList(cmd, "-f", "-", NULL);
 
-    virCommandSetInputBuffer(cmd, virBufferContentAndReset(&pf_rules_buf));
+    pf_rules = virBufferContentAndReset(&pf_rules_buf);
+    virCommandSetInputBuffer(cmd, pf_rules);
 
     /* pfctl -a libvirt/default -F all */
     /* Flush rules as a separate command, so when it fails, e.g. because the
-- 
2.52.0

    