mirror of
https://git.proxmox.com/git/mirror_frr
synced 2025-08-04 13:31:48 +00:00
ospf6d: fix use-after-free
ospf6_route_remove may free the ospf6_route passed to it if the refcount reaches zero, in which case zeroing the ->flag field constitutes a uaf Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
This commit is contained in:
parent
f1deac618b
commit
8f599166fb
@ -1455,13 +1455,14 @@ ospf6_intra_route_calculation (struct ospf6_area *oa)
|
||||
{
|
||||
if (hook_add)
|
||||
(*hook_add) (route);
|
||||
route->flag = 0;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* Redo the summaries as things might have changed */
|
||||
ospf6_abr_originate_summary (route);
|
||||
route->flag = 0;
|
||||
}
|
||||
route->flag = 0;
|
||||
}
|
||||
|
||||
if (IS_OSPF6_DEBUG_EXAMIN (INTRA_PREFIX))
|
||||
|
Loading…
Reference in New Issue
Block a user