diff options
| author | David Lamparter <equinox@diac24.net> | 2018-08-20 18:16:46 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-08-20 18:16:46 +0200 |
| commit | a55a8b4538a4a9dd56837d9a2ceeb5ae75573b59 (patch) | |
| tree | 6f8dbc260c20c022dfbcfeafa3304aa2e948f60d /ospf6d/ospf6_flood.c | |
| parent | Merge pull request #2829 from donaldsharp/more_upstream (diff) | |
| parent | ospf6d: sanity check refcount correctness (diff) | |
| download | frr-a55a8b4538a4a9dd56837d9a2ceeb5ae75573b59.tar.xz frr-a55a8b4538a4a9dd56837d9a2ceeb5ae75573b59.zip | |
Merge pull request #2814 from qlyoung/fix-ospf6d-lsa-uaf-test
ospf6d: fix use after free on LSA
Diffstat (limited to 'ospf6d/ospf6_flood.c')
| -rw-r--r-- | ospf6d/ospf6_flood.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/ospf6d/ospf6_flood.c b/ospf6d/ospf6_flood.c index 2059d8486..0828c2beb 100644 --- a/ospf6d/ospf6_flood.c +++ b/ospf6d/ospf6_flood.c @@ -330,6 +330,8 @@ void ospf6_flood_interface(struct ospf6_neighbor *from, struct ospf6_lsa *lsa, zlog_debug( "Requesting the same, remove it, next neighbor"); if (req == on->last_ls_req) { + /* sanity check refcount */ + assert(req->lock >= 2); ospf6_lsa_unlock(req); on->last_ls_req = NULL; } |