10111 dat_dictionary_create() use after free

@@ -26,11 +26,13 @@
 /*
  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
-#pragma ident   "%Z%%M% %I%     %E% SMI"
+/*
+ * Copyright (c) 2018, Joyent, Inc.
+ */
 
 /*
  *
  * MODULE: dat_dictionary.c
  *

@@ -142,22 +144,23 @@
         *pp_dictionary = p_dictionary;
 
 bail:
         if (DAT_SUCCESS != status) {
                 if (NULL != p_dictionary) {
-                        dat_os_free(p_dictionary, sizeof (DAT_DICTIONARY));
-
                         if (NULL != p_dictionary->head) {
                                 dat_os_free(p_dictionary->head,
                                     sizeof (DAT_DICTIONARY_NODE));
                         }
 
                         if (NULL != p_dictionary->tail) {
                                 dat_os_free(p_dictionary->tail,
                                     sizeof (DAT_DICTIONARY_NODE));
                         }
+
+                        dat_os_free(p_dictionary, sizeof (DAT_DICTIONARY));
                 }
+
         }
 
         return (status);
 }