diff options
| author | Quentin Young <qlyoung@cumulusnetworks.com> | 2017-06-06 19:53:48 +0200 |
|---|---|---|
| committer | Quentin Young <qlyoung@cumulusnetworks.com> | 2017-06-07 02:55:05 +0200 |
| commit | 7596c208a4cfa853044148dd24ecff8b8f8575e0 (patch) | |
| tree | 0801a9a1b4a4ad2b96ee7a4bddf22a2805606764 /isisd | |
| parent | zebra: fix misc zebra leaks (diff) | |
| download | frr-7596c208a4cfa853044148dd24ecff8b8f8575e0.tar.xz frr-7596c208a4cfa853044148dd24ecff8b8f8575e0.zip | |
isisd: fix heap uaf
Fix #671
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
Diffstat (limited to 'isisd')
| -rw-r--r-- | isisd/isis_adjacency.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/isisd/isis_adjacency.c b/isisd/isis_adjacency.c index f55092487..de1ccaad1 100644 --- a/isisd/isis_adjacency.c +++ b/isisd/isis_adjacency.c @@ -212,7 +212,7 @@ isis_adj_state_change (struct isis_adjacency *adj, enum isis_adj_state new_state if (circuit->circ_type == CIRCUIT_T_BROADCAST) { - for (level = IS_LEVEL_1; level <= IS_LEVEL_2; level++) + for (level = IS_LEVEL_1; adj && level <= IS_LEVEL_2; level++) { if ((adj->level & level) == 0) continue; @@ -236,6 +236,7 @@ isis_adj_state_change (struct isis_adjacency *adj, enum isis_adj_state new_state } isis_event_adjacency_state_change (adj, new_state); isis_delete_adj (adj); + adj = NULL; } if (circuit->u.bc.lan_neighs[level - 1]) @@ -252,7 +253,7 @@ isis_adj_state_change (struct isis_adjacency *adj, enum isis_adj_state new_state } else if (circuit->circ_type == CIRCUIT_T_P2P) { - for (level = IS_LEVEL_1; level <= IS_LEVEL_2; level++) + for (level = IS_LEVEL_1; adj && level <= IS_LEVEL_2; level++) { if ((adj->level & level) == 0) continue; @@ -285,6 +286,7 @@ isis_adj_state_change (struct isis_adjacency *adj, enum isis_adj_state new_state } isis_event_adjacency_state_change (adj, new_state); isis_delete_adj (adj); + adj = NULL; } } } |