bgpd: Fixed potential memory leak if additive is false

The else portion of the IF dups the lc, but doesn't free old

Signed-off-by: Nigel Kukard <nkukard@lbsd.net>

diff --git a/bgpd/bgp_routemap.c b/bgpd/bgp_routemap.c
index f5ee4fe8976c59385f8a9dec3d17f8cf50e30e35..f76110b7ea44125392017c5cf77163c3c7863b6f 100644 (file)
--- a/bgpd/bgp_routemap.c
+++ b/bgpd/bgp_routemap.c
@@ -1611,18 +1611,19 @@ static route_map_result_t route_set_lcommunity(void *rule,
                        merge = lcommunity_merge(lcommunity_dup(old),
                                                 rcs->lcom);
 
-                       /* HACK: if the old large-community is not intern'd,
-                        * we should free it here, or all reference to it may be
-                        * lost.
-                        * Really need to cleanup attribute caching sometime.
-                        */
-                       if (old->refcnt == 0)
-                               lcommunity_free(&old);
                        new = lcommunity_uniq_sort(merge);
                        lcommunity_free(&merge);
                } else
                        new = lcommunity_dup(rcs->lcom);
 
+               /* HACK: if the old large-community is not intern'd,
+                * we should free it here, or all reference to it may be
+                * lost.
+                * Really need to cleanup attribute caching sometime.
+                */
+               if (old && old->refcnt == 0)
+                       lcommunity_free(&old);
+
                /* will be intern()'d or attr_flush()'d by bgp_update_main() */
                attr->lcommunity = new;