bgpd: Fixed potential memory leak if additive is false in normal communities

The else portion of the IF dups the community, but doesn't free old

Signed-off-by: Nigel Kukard <nkukard@lbsd.net>

diff --git a/bgpd/bgp_routemap.c b/bgpd/bgp_routemap.c
index 822ddd64383886d925659e27caac22ff080d2ced..2fecdfb9938c006ef0f2602f055b4c2959cf2b8a 100644 (file)
--- a/bgpd/bgp_routemap.c
+++ b/bgpd/bgp_routemap.c
@@ -1401,18 +1401,19 @@ static route_map_result_t route_set_community(void *rule, struct prefix *prefix,
                if (rcs->additive && old) {
                        merge = community_merge(community_dup(old), rcs->com);
 
-                       /* HACK: if the old community is not intern'd,
-                        * we should free it here, or all reference to it may be
-                        * lost.
-                        * Really need to cleanup attribute caching sometime.
-                        */
-                       if (old->refcnt == 0)
-                               community_free(old);
                        new = community_uniq_sort(merge);
                        community_free(merge);
                } else
                        new = community_dup(rcs->com);
 
+               /* HACK: if the old community is not intern'd,
+                * we should free it here, or all reference to it may be
+                * lost.
+                * Really need to cleanup attribute caching sometime.
+                */
+               if (old && old->refcnt == 0)
+                       community_free(old);
+
                /* will be interned by caller if required */
                attr->community = new;