git.proxmox.com Git - mirror_frr.git/commit

]> git.proxmox.com Git - mirror_frr.git/commit - ospf6d/ospf6_snmp.c

author	Donald Sharp <sharpd@cumulusnetworks.com>
	Mon, 17 Aug 2020 12:25:12 +0000 (08:25 -0400)
committer	Donald Sharp <sharpd@nvidia.com>
	Sun, 11 Oct 2020 15:16:44 +0000 (11:16 -0400)
commit	2e37407f9d27dec02a49260ac3218126522dc666
tree	f3a0f3ebaa91ceaa200fbf6ac2312e70a21e612c	tree
parent	62270cc3ee99318cbddd3000af4debee35c058c0	commit \| diff

ospf6d, tests: Prevent use after free

The code pattern:

for (ALL_LSDB(lsdb, lsa)) {
remove_lsa(lsa)
}

has a use after free in ALL_LSDB, since we ask for the next pointer,
after it has been freed.

Modify the code such that we grab the next pointer before we can
possibly free it.

Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>

ospf6d/ospf6_asbr.c		diff \| blob \| blame \| history
ospf6d/ospf6_interface.c		diff \| blob \| blame \| history
ospf6d/ospf6_lsdb.c		diff \| blob \| blame \| history
ospf6d/ospf6_lsdb.h		diff \| blob \| blame \| history
ospf6d/ospf6_message.c		diff \| blob \| blame \| history
ospf6d/ospf6_neighbor.c		diff \| blob \| blame \| history
ospf6d/ospf6_snmp.c		diff \| blob \| blame \| history
ospf6d/ospf6_spf.c		diff \| blob \| blame \| history
tests/ospf6d/test_lsdb.c		diff \| blob \| blame \| history

FRRouting mirror

RSS Atom