diff options
| author | Olivier Dugeon <olivier.dugeon@orange.com> | 2023-04-21 18:16:34 +0200 |
|---|---|---|
| committer | Olivier Dugeon <olivier.dugeon@orange.com> | 2023-04-21 18:24:51 +0200 |
| commit | 30584b6f6a5d4d8e1d23a9574d4c9b5def75a4ba (patch) | |
| tree | 1009fa3a7ecda1ccecd21d0493f64b678a0043b2 /lib | |
| parent | lib: Link State memory corruption (diff) | |
| download | frr-30584b6f6a5d4d8e1d23a9574d4c9b5def75a4ba.tar.xz frr-30584b6f6a5d4d8e1d23a9574d4c9b5def75a4ba.zip | |
lib: Fix memory leak in in Link State
When using ls_stream2ted() function to parse Opaque Link State message to local
TED, in case of vertex or subnet deletion, the function return a pointer to the
deleted ls_element instead of NULL. This could lead into a potential pointer
corruption when caller try to access to the deleted ls_element.
This patch ensure that the ls_element pointer return by ls_stream2ted()
function is NULL when the message event is a delete operation for vertex and
subnet. Note that edge deletion was correctly handled.
Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/link_state.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/lib/link_state.c b/lib/link_state.c index c06a42b64..933b7d12f 100644 --- a/lib/link_state.c +++ b/lib/link_state.c @@ -496,7 +496,6 @@ void ls_vertex_del(struct ls_ted *ted, struct ls_vertex *vertex) /* Then remove Vertex from Link State Data Base and free memory */ vertices_del(&ted->vertices, vertex); XFREE(MTYPE_LS_DB, vertex); - vertex = NULL; } void ls_vertex_del_all(struct ls_ted *ted, struct ls_vertex *vertex) @@ -1773,9 +1772,10 @@ struct ls_vertex *ls_msg2vertex(struct ls_ted *ted, struct ls_message *msg, case LS_MSG_EVENT_DELETE: vertex = ls_find_vertex_by_id(ted, node->adv); if (vertex) { - if (delete) + if (delete) { ls_vertex_del_all(ted, vertex); - else + vertex = NULL; + } else vertex->status = DELETE; } break; @@ -1852,9 +1852,10 @@ struct ls_subnet *ls_msg2subnet(struct ls_ted *ted, struct ls_message *msg, case LS_MSG_EVENT_DELETE: subnet = ls_find_subnet(ted, &pref->pref); if (subnet) { - if (delete) + if (delete) { ls_subnet_del_all(ted, subnet); - else + subnet = NULL; + } else subnet->status = DELETE; } break; |