The function unconditionally dereferenced its parameter, yet it is possible for the passed 'cur_tmpl' pointer when called from exit_error() to be still NULL: It is assigned to by alloc_tmpl_objects() at start of do_parse(), though callers of that function might call exit_error() in beforehand. Fixes: 258b4540f4512 ("conntrack: add struct ct_tmpl") Signed-off-by: Phil Sutter <phil@xxxxxx> --- src/conntrack.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/conntrack.c b/src/conntrack.c index 2bd71e17e6be6..23eaf274a78a1 100644 --- a/src/conntrack.c +++ b/src/conntrack.c @@ -139,6 +139,8 @@ static int alloc_tmpl_objects(struct ct_tmpl *tmpl) static void free_tmpl_objects(struct ct_tmpl *tmpl) { + if (!tmpl) + return; if (tmpl->ct) nfct_destroy(tmpl->ct); if (tmpl->exptuple) -- 2.38.0