diff options
| author | David Lamparter <equinox@opensourcerouting.org> | 2019-02-18 21:34:06 +0100 |
|---|---|---|
| committer | David Lamparter <equinox@opensourcerouting.org> | 2019-02-18 23:04:21 +0100 |
| commit | 0c77e17821fe8d4bef45a5e067402a15d49e1583 (patch) | |
| tree | 22e794ae2633154d4be81dc385ed3aee7098bc85 /isisd/isis_lsp.c | |
| parent | Merge pull request #3817 from sergeyrar/patch-1 (diff) | |
| download | frr-0c77e17821fe8d4bef45a5e067402a15d49e1583.tar.xz frr-0c77e17821fe8d4bef45a5e067402a15d49e1583.zip | |
isisd: skip over deleted fragments
Since LSP fragments are also on our lspdb dict, lsp_tick() needs to skip
over them after calling lsp_destroy(). Otherwise it ends up accessing
free'd memory.
Fixes: #3533
Signed-off-by: David Lamparter <equinox@diac24.net>
Diffstat (limited to 'isisd/isis_lsp.c')
| -rw-r--r-- | isisd/isis_lsp.c | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/isisd/isis_lsp.c b/isisd/isis_lsp.c index 658624370..b56a56fa3 100644 --- a/isisd/isis_lsp.c +++ b/isisd/isis_lsp.c @@ -1930,6 +1930,27 @@ int lsp_tick(struct thread *thread) area->area_tag, lsp->level, rawlspid_print(lsp->hdr.lsp_id), lsp->hdr.seqno); + + /* if we're aging out fragment 0, + * lsp_destroy() below will delete all + * other fragments too, so we need to + * skip over those + */ + while (!LSP_FRAGMENT(lsp->hdr.lsp_id) + && dnode_next) { + struct isis_lsp *nextlsp; + + nextlsp = dnode_get(dnode_next); + if (memcmp(nextlsp->hdr.lsp_id, + lsp->hdr.lsp_id, + ISIS_SYS_ID_LEN + 1)) + break; + + dnode_next = dict_next( + area->lspdb[level], + dnode_next); + } + lsp_destroy(lsp); lsp = NULL; dict_delete_free(area->lspdb[level], |