ripd: fix null-pointer dereference

[mirror_frr.git] / ripd / rip_interface.c

diff --git a/ripd/rip_interface.c b/ripd/rip_interface.c
index 042c9713b266af99264b918b929b28eb0aece5cc..9f1e2d86bfaeb612fa959a16c7240dcd2eed30ee 100644 (file)
--- a/ripd/rip_interface.c
+++ b/ripd/rip_interface.c
@@ -1,21 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
 /* Interface related function for RIP.
  * Copyright (C) 1997, 98 Kunihiro Ishiguro <kunihiro@zebra.org>
- *
- * This file is part of GNU Zebra.
- *
- * GNU Zebra is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2, or (at your option) any
- * later version.
- *
- * GNU Zebra is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; see the file COPYING; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  */
 
 #include <zebra.h>
@@ -29,7 +14,7 @@
 #include "table.h"
 #include "log.h"
 #include "stream.h"
-#include "thread.h"
+#include "frrevent.h"
 #include "zclient.h"
 #include "filter.h"
 #include "sockopt.h"
@@ -428,7 +413,7 @@ static void rip_interface_clean(struct rip_interface *ri)
        ri->enable_interface = 0;
        ri->running = 0;
 
-       thread_cancel(&ri->t_wakeup);
+       EVENT_OFF(ri->t_wakeup);
 }
 
 void rip_interfaces_clean(struct rip *rip)
@@ -472,6 +457,7 @@ static void rip_interface_reset(struct rip_interface *ri)
        ri->sent_updates = 0;
 
        ri->passive = 0;
+       XFREE(MTYPE_TMP, ri->bfd.profile);
 
        rip_interface_clean(ri);
 }
@@ -487,7 +473,7 @@ int rip_if_down(struct interface *ifp)
 
        ri = ifp->info;
 
-       THREAD_OFF(ri->t_wakeup);
+       EVENT_OFF(ri->t_wakeup);
 
        rip = ri->rip;
        if (rip) {
@@ -789,13 +775,13 @@ int rip_enable_if_delete(struct rip *rip, const char *ifname)
 }
 
 /* Join to multicast group and send request to the interface. */
-static void rip_interface_wakeup(struct thread *t)
+static void rip_interface_wakeup(struct event *t)
 {
        struct interface *ifp;
        struct rip_interface *ri;
 
        /* Get interface. */
-       ifp = THREAD_ARG(t);
+       ifp = EVENT_ARG(t);
 
        ri = ifp->info;
 
@@ -900,8 +886,8 @@ void rip_enable_apply(struct interface *ifp)
                        zlog_debug("turn on %s", ifp->name);
 
                /* Add interface wake up thread. */
-               thread_add_timer(master, rip_interface_wakeup, ifp, 1,
-                                &ri->t_wakeup);
+               event_add_timer(master, rip_interface_wakeup, ifp, 1,
+                               &ri->t_wakeup);
                rip_connect_set(ifp, 1);
        } else if (ri->running) {
                /* Might as well clean up the route table as well
@@ -929,7 +915,7 @@ int rip_neighbor_lookup(struct rip *rip, struct sockaddr_in *from)
        struct prefix_ipv4 p;
        struct route_node *node;
 
-       memset(&p, 0, sizeof(struct prefix_ipv4));
+       memset(&p, 0, sizeof(p));
        p.family = AF_INET;
        p.prefix = from->sin_addr;
        p.prefixlen = IPV4_MAX_BITLEN;
@@ -1124,8 +1110,10 @@ void rip_interface_sync(struct interface *ifp)
        struct rip_interface *ri;
 
        ri = ifp->info;
-       if (ri)
+       if (ri) {
                ri->rip = ifp->vrf->info;
+               ri->ifp = ifp;
+       }
 }
 
 /* Called when interface structure allocated. */