proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-15 08:57:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

lib: Fix memory leak in in Link State

Browse Source 
When using ls_stream2ted() function to parse Opaque Link State message to local
TED, in case of vertex or subnet deletion, the function return a pointer to the
deleted ls_element instead of NULL. This could lead into a potential pointer
corruption when caller try to access to the deleted ls_element.

This patch ensure that the ls_element pointer return by ls_stream2ted()
function is NULL when the message event is a delete operation for vertex and
subnet. Note that edge deletion was correctly handled.

Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
This commit is contained in:
Olivier Dugeon 2023-04-21 18:16:34 +02:00
parent 871b46e7eb
commit 30584b6f6a
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
lib/link_state.c
View File

@ -496,7 +496,6 @@ void ls_vertex_del(struct ls_ted *ted, struct ls_vertex *vertex)
/* Then remove Vertex from Link State Data Base and free memory */ /* Then remove Vertex from Link State Data Base and free memory */
vertices_del(&ted->vertices, vertex); vertices_del(&ted->vertices, vertex);
XFREE(MTYPE_LS_DB, vertex); XFREE(MTYPE_LS_DB, vertex);
vertex = NULL;
} }
void ls_vertex_del_all(struct ls_ted *ted, struct ls_vertex *vertex) void ls_vertex_del_all(struct ls_ted *ted, struct ls_vertex *vertex)
@ -1773,9 +1772,10 @@ struct ls_vertex *ls_msg2vertex(struct ls_ted *ted, struct ls_message *msg,
case LS_MSG_EVENT_DELETE: case LS_MSG_EVENT_DELETE:
vertex = ls_find_vertex_by_id(ted, node->adv); vertex = ls_find_vertex_by_id(ted, node->adv);
if (vertex) { if (vertex) {
if (delete) if (delete) {
ls_vertex_del_all(ted, vertex); ls_vertex_del_all(ted, vertex);
else vertex = NULL;
} else
vertex->status = DELETE; vertex->status = DELETE;
} }
break; break;
@ -1852,9 +1852,10 @@ struct ls_subnet *ls_msg2subnet(struct ls_ted *ted, struct ls_message *msg,
case LS_MSG_EVENT_DELETE: case LS_MSG_EVENT_DELETE:
subnet = ls_find_subnet(ted, &pref->pref); subnet = ls_find_subnet(ted, &pref->pref);
if (subnet) { if (subnet) {
if (delete) if (delete) {
ls_subnet_del_all(ted, subnet); ls_subnet_del_all(ted, subnet);
else subnet = NULL;
} else
subnet->status = DELETE; subnet->status = DELETE;
} }
break; break;