From d8f70b86d7fd55c0beb3e93abec9a33fd5a96ee3 Mon Sep 17 00:00:00 2001
From: Donald Sharp <sharpd@cumulusnetworks.com>
Date: Thu, 17 Mar 2016 17:26:46 -0400
Subject: [PATCH] ospfd: Fix Dereference of Null Pointer during config

This construct:

struct ospf *ospf = vty->index;
if (!ospf)
  return CMD_SUCCESS;

Is present throughout the entire ospfd code base.  The command:
distance ospf external 255

Is not protected by this construct. I added this construct
to the command and in addition did a quick search to find
any others not protected and to protect them.

Ticket: CM-9725
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
Reviewed-by: Don Slice <dslice@cumulusnetworks.com>
---
 ospfd/ospf_vty.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/ospfd/ospf_vty.c b/ospfd/ospf_vty.c
index 66d74c655c..9122a219df 100644
--- a/ospfd/ospf_vty.c
+++ b/ospfd/ospf_vty.c
@@ -2463,6 +2463,9 @@ DEFUN (ospf_timers_min_ls_interval,
   struct ospf *ospf = vty->index;
   unsigned int interval;
 
+  if (!ospf)
+    return CMD_SUCCESS;
+
   if (argc != 1)
     {
       vty_out (vty, "Insufficient arguments%s", VTY_NEWLINE);
@@ -2512,6 +2515,9 @@ DEFUN (ospf_timers_min_ls_arrival,
   struct ospf *ospf = vty->index;
   unsigned int arrival;
 
+  if (!ospf)
+    return CMD_SUCCESS;
+
   if (argc != 1)
     {
       vty_out (vty, "Insufficient arguments%s", VTY_NEWLINE);
@@ -2534,6 +2540,10 @@ DEFUN (no_ospf_timers_min_ls_arrival,
        "OSPF minimum arrival interval delay\n")
 {
   struct ospf *ospf = vty->index;
+
+  if (!ospf)
+    return CMD_SUCCESS;
+
   ospf->min_ls_arrival = OSPF_MIN_LS_ARRIVAL;
 
   return CMD_SUCCESS;
@@ -8077,6 +8087,9 @@ DEFUN (ospf_redistribute_source,
   int metric = -1;
   struct ospf_redist *red;
 
+  if (!ospf)
+    return CMD_SUCCESS;
+
   if (argc < 4)
     return CMD_WARNING; /* should not happen */
 
@@ -8164,6 +8177,9 @@ DEFUN (ospf_redistribute_instance_source,
   u_short instance;
   struct ospf_redist *red;
 
+  if (!ospf)
+    return CMD_SUCCESS;
+
   if (strncmp(argv[0], "o", 1) == 0)
     source = ZEBRA_ROUTE_OSPF;
   else
@@ -8493,6 +8509,9 @@ DEFUN (no_ospf_distance_ospf,
 {
   struct ospf *ospf = vty->index;
 
+  if (!ospf)
+    return CMD_SUCCESS;
+
   if (argc < 3)
     return CMD_WARNING;
 
@@ -8534,6 +8553,9 @@ DEFUN (ospf_distance_ospf,
 {
   struct ospf *ospf = vty->index;
 
+  if (!ospf)
+    return CMD_SUCCESS;
+
   if (argc < 3) /* should not happen */
     return CMD_WARNING;