proxmox-mirrors/mirror_frr
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_frr synced 2025-08-08 07:37:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #5310 from donaldsharp/ospf_use_after_free

Browse Source 
ospfd: Function order caused use after free.
This commit is contained in:
Sri Mohana Singamsetty 2019-11-11 13:29:28 -08:00 committed by GitHub
commit 5761cee5cc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ospfd/ospf_opaque.c
View File

@ -430,9 +430,9 @@ void ospf_delete_opaque_functab(uint8_t lsa_type, uint8_t opaque_type)
/* Cleanup internal control information, if it /* Cleanup internal control information, if it
* still remains. */ * still remains. */
if (functab->oipt != NULL) { if (functab->oipt != NULL) {
free_opaque_info_owner(functab->oipt);
free_opaque_info_per_type( free_opaque_info_per_type(
functab->oipt); functab->oipt);
free_opaque_info_owner(functab->oipt);
} }
/* Dequeue listnode entry from the list. */ /* Dequeue listnode entry from the list. */
@ -554,8 +554,8 @@ register_opaque_info_per_type(struct ospf_opaque_functab *functab,
case OSPF_OPAQUE_AS_LSA: case OSPF_OPAQUE_AS_LSA:
top = ospf_lookup_by_vrf_id(new->vrf_id); top = ospf_lookup_by_vrf_id(new->vrf_id);
if (new->area != NULL && (top = new->area->ospf) == NULL) { if (new->area != NULL && (top = new->area->ospf) == NULL) {
free_opaque_info_per_type((void *)oipt);
free_opaque_info_owner(oipt); free_opaque_info_owner(oipt);
free_opaque_info_per_type(oipt);
oipt = NULL; oipt = NULL;
goto out; /* This case may not exist. */ goto out; /* This case may not exist. */
} }
@ -567,8 +567,8 @@ register_opaque_info_per_type(struct ospf_opaque_functab *functab,
EC_OSPF_LSA_UNEXPECTED, EC_OSPF_LSA_UNEXPECTED,
"register_opaque_info_per_type: Unexpected LSA-type(%u)", "register_opaque_info_per_type: Unexpected LSA-type(%u)",
new->data->type); new->data->type);
free_opaque_info_per_type((void *)oipt);
free_opaque_info_owner(oipt); free_opaque_info_owner(oipt);
free_opaque_info_per_type(oipt);
oipt = NULL; oipt = NULL;
goto out; /* This case may not exist. */ goto out; /* This case may not exist. */
} }