While reviewing fix for bug #728169 I found, or at least I think I've found, another missing free on `nlh' structure in nltest.c:get_bcn() function. So I spawning new bug report from my comment on that bug:
I can't understand the nltest.c:get_bcn() perfectly, but I suspect the `nlh'
structure is not freed at the end of the function.
Apparently a pointer to nlh space is saved as `d' that turns into `rta_parent'
and this into `rta_child'. Then the rta_child iterates over rta_parent and data
are copied from there into `bcn_data' structure in rest of the function.
Finally the function returns 0, nlh data are carried out as copy by bcn_data
argument, but the nlh itself is not not freed.
Affected version: lldpad-0.9.43-3.el6.
It seems like it should be okay to free the nlh structure at the end of the function but I'm not absolutely sure. Also, this tool isn't actually packaged and I don't like the idea of including a special patch for it.
I'll submit a patch upstream for review.