--- a/ChangeLog	Fri May 08 12:55:30 2009 -0700
+++ b/ChangeLog	Fri May 08 15:17:52 2009 -0700
@@ -1,6 +1,7 @@
 6.22 2009-05-08
     Prevent auto whitelisting due to outgoing multipart/report
     delivery notifications.
+    Fix memory leak in suppressed auto whitelisting.
 
 6.21 2009-01-03
     Fixes to compile on old systems without memrchr or string::clear().

--- a/dnsbl.spec.in	Fri May 08 12:55:30 2009 -0700
+++ b/dnsbl.spec.in	Fri May 08 15:17:52 2009 -0700
@@ -99,6 +99,7 @@
 * Fri May 08 2009 Carl Byington <carl@five-ten-sg.com> - 6.22-1
 - Prevent auto whitelisting due to outgoing multipart/report
   delivery notifications.
+- Fix memory leak in suppressed auto whitelisting.
 
 * Sat Jan 03 2009 Carl Byington <carl@five-ten-sg.com> - 6.21-1
 - Fixes to compile on old systems without memrchr or string::clear().

--- a/src/dnsbl.cpp	Fri May 08 12:55:30 2009 -0700
+++ b/src/dnsbl.cpp	Fri May 08 15:17:52 2009 -0700
@@ -298,6 +298,8 @@
 void mlfiPriv::reset(bool final) {
     while (!delayer.empty()) {
         DELAYWHITEP dwp = delayer.front();
+        const char *loto = dwp->get_loto();
+        if (loto) free((void*)loto);
         delete dwp;
         delayer.pop_front();
     }
@@ -1138,11 +1140,11 @@
     if (len >= max_local_size) w = NULL;    // too big, pretend we don't have a whitelister
     // record it if we have a whitelister
     if (w) {
-        DELAYWHITEP dwp = new DELAYWHITE(loto, w, &con2);
+        DELAYWHITEP dwp = new DELAYWHITE(loto, w, &con2);   // dwp takes ownership of the string
         priv.delayer.push_back(dwp);
     }
     else {
-        free((void*)loto);
+        free((void*)loto);                                  // or we free it here
     }
 
     // accept the recipient
@@ -1176,7 +1178,7 @@
 sfsistat mlfi_header(SMFICTX* ctx, char* headerf, char* headerv)
 {
     mlfiPriv &priv = *MLFIPRIV;
-    // detect precedence:bulk for avoiding autowhitelisting
+    // headers that avoid autowhitelisting
     if (((strcasecmp(headerf, "precedence") == 0)   && (strcasecmp(headerv, "bulk") == 0)) ||
         ((strcasecmp(headerf, "content-type") == 0) && (strncasecmp(headerv, "multipart/report", 16) == 0))) {
         priv.allow_autowhitelisting = false;
@@ -1196,8 +1198,8 @@
     // delayed autowhitelisting
     while (!priv.delayer.empty()) {
         DELAYWHITEP dwp = priv.delayer.front();
+        const char *loto = dwp->get_loto();
         if (priv.allow_autowhitelisting) {
-            const char   *loto = dwp->get_loto();
             WHITELISTERP w     = dwp->get_w();
             CONTEXTP     con2  = dwp->get_con();
             if (debug_syslog > 1) {
@@ -1208,6 +1210,14 @@
             }
             w->sent(loto);  // don't free it, the whitelister takes ownership of the string
         }
+        else {
+            if (debug_syslog > 1) {
+                char msg[maxlen];
+                snprintf(msg, sizeof(msg), "avoid whitelist reply from <%s> for outgoing auto-responder", loto);
+                my_syslog(&priv, msg);
+            }
+            if (loto) free((void*)loto);// or we free it here
+        }
         delete dwp;
         priv.delayer.pop_front();
     }