tshark: plug a memory leak.

Put the "attempt to compile a filter string as a capture filter" code
into a common routine, and, if the attempt succeeds, free up the
generated capture filter code.

Fixes #18837.

1 files changed, 30 insertions, 21 deletions

diff --git a/tshark.c b/tshark.c
index 1238a6ab54..0f8ceddd9e 100644
--- a/tshark.c
+++ b/tshark.c
@@ -758,6 +758,34 @@ must_do_dissection(dfilter_t *rfcode, dfilter_t *dfcode,
         tap_listeners_require_dissection() || dissect_color;
 }
 
+#ifdef HAVE_LIBPCAP
+/*
+ * Check whether a purported *shark packet-matching expression (display
+ * or read filter) looks like a capture filter and, if so, print a
+ * warning.
+ *
+ * Used, for example, if the string in question isn't a valid packet-
+ * matching expression.
+ */
+static void
+warn_about_capture_filter(const char *rfilter)
+{
+    struct bpf_program   fcode;
+    pcap_t *pc;
+
+    pc = pcap_open_dead(DLT_EN10MB, MIN_PACKET_SIZE);
+    if (pc != NULL) {
+        if (pcap_compile(pc, &fcode, rfilter, 0, 0) != -1) {
+            pcap_freecode(&fcode);
+            cmdarg_err_cont(
+                    "  Note: That read filter code looks like a valid capture filter;\n"
+                    "        maybe you mixed them up?");
+        }
+        pcap_close(pc);
+    }
+}
+#endif
+
 int
 main(int argc, char *argv[])
 {
@@ -804,7 +832,6 @@ main(int argc, char *argv[])
     int                  caps_queries = 0;
     GList               *if_list;
     gchar               *err_str, *err_str_secondary;
-    struct bpf_program   fcode;
 #else
     gboolean             capture_option_specified = FALSE;
     volatile int         max_packet_count = 0;
@@ -2092,16 +2119,7 @@ main(int argc, char *argv[])
             extcap_cleanup();
 
 #ifdef HAVE_LIBPCAP
-            pcap_t *pc;
-            pc = pcap_open_dead(DLT_EN10MB, MIN_PACKET_SIZE);
-            if (pc != NULL) {
-                if (pcap_compile(pc, &fcode, rfilter, 0, 0) != -1) {
-                    cmdarg_err_cont(
-                            "  Note: That read filter code looks like a valid capture filter;\n"
-                            "        maybe you mixed them up?");
-                }
-                pcap_close(pc);
-            }
+            warn_about_capture_filter(rfilter);
 #endif
 
             exit_status = INVALID_INTERFACE;
@@ -2117,16 +2135,7 @@ main(int argc, char *argv[])
             extcap_cleanup();
 
 #ifdef HAVE_LIBPCAP
-            pcap_t *pc;
-            pc = pcap_open_dead(DLT_EN10MB, MIN_PACKET_SIZE);
-            if (pc != NULL) {
-                if (pcap_compile(pc, &fcode, dfilter, 0, 0) != -1) {
-                    cmdarg_err_cont(
-                            "  Note: That display filter code looks like a valid capture filter;\n"
-                            "        maybe you mixed them up?");
-                }
-                pcap_close(pc);
-            }
+            warn_about_capture_filter(rfilter);
 #endif
 
             exit_status = INVALID_FILTER;