nx-match: Avoid double-free on some error paths.

Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9966
Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9968
Fixes: f1eb32b9641c ("ofp-group: Fix memory leak in error cases parsing group requests.")
Signed-off-by: Ben Pfaff <blp@ovn.org>
Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com>

diff --git a/lib/nx-match.c b/lib/nx-match.c
index 3b030833cb2c71b7169a04c5c875388f6ba3131a..8f98032195afa4f987d10dd6e3f60c5a34da1943 100644 (file)
--- a/lib/nx-match.c
+++ b/lib/nx-match.c
@@ -763,6 +763,7 @@ oxm_pull_field_array(const void *fields_data, size_t fields_len,
                         ofperr_to_string(error));
 
             free(fa->values);
+            fa->values = NULL;
             return error;
         }
     }