isisd: fix null pointer dereference in send_lsp()

  * isisd/isis_pdu.c: (send_lsp) Handle case where there are no LSPs
    on the LSP transmission queue. This can happen if, for instance,
    the queue is cleared because of protocol events before the
    send_lsp thread gets a chance to run.

diff --git a/isisd/isis_pdu.c b/isisd/isis_pdu.c
index 7375a3ebf7dbc7b80c2a4f189c4d4184f318ae2b..ffc67178b4a04ac93cc6f6ceb7c419bc25142f77 100644 (file)
--- a/isisd/isis_pdu.c
+++ b/isisd/isis_pdu.c
@@ -3033,7 +3033,19 @@ send_lsp (struct thread *thread)
     return retval;
   }
 
-  lsp = listgetdata ((node = listhead (circuit->lsp_queue)));
+  node = listhead (circuit->lsp_queue);
+
+  /*
+   * Handle case where there are no LSPs on the queue. This can
+   * happen, for instance, if an adjacency goes down before this
+   * thread gets a chance to run.
+   */
+  if (!node)
+    {
+      return retval;
+    }
+
+  lsp = listgetdata(node);
 
   /*
    * Do not send if levels do not match