rconn: Avoid memory leak in rconn_send_with_limit() on queue overflow.

Bug #14357.
Reported-by: Luca Giraudo <lgiraudo@nicira.com>
Signed-off-by: Ben Pfaff <blp@nicira.com>

diff --git a/lib/rconn.c b/lib/rconn.c
index ddf578c..0b55ed0 100644 (file)
--- a/lib/rconn.c
+++ b/lib/rconn.c
@@ -632,14 +632,13 @@ int
 rconn_send_with_limit(struct rconn *rc, struct ofpbuf *b,
                       struct rconn_packet_counter *counter, int queue_limit)
 {
-    int retval;
-    retval = (counter->n_packets >= queue_limit
-              ? EAGAIN
-              : rconn_send(rc, b, counter));
-    if (retval) {
+    if (counter->n_packets < queue_limit) {
+        return rconn_send(rc, b, counter);
+    } else {
         COVERAGE_INC(rconn_overflow);
+        ofpbuf_delete(b);
+        return EAGAIN;
     }
-    return retval;
 }
 
 /* Returns the total number of packets successfully sent on the underlying