ospfd: cancel SR thread at shutdown

Otherwise if it is scheduled the thread pointer will be accessed after
the shutdown task finishes accessing, having deleted the structure that
owns said pointer, which causes a heap UAF.

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>

diff --git a/ospfd/ospfd.c b/ospfd/ospfd.c
index 79af4a55fb9e1b558f7c656141a35f35c884a1c4..b3c4e4a3654b5fdb2e1bdeb8d2488a4db020df50 100644 (file)
--- a/ospfd/ospfd.c
+++ b/ospfd/ospfd.c
@@ -707,6 +707,7 @@ static void ospf_finish_final(struct ospf *ospf)
        OSPF_TIMER_OFF(ospf->t_read);
        OSPF_TIMER_OFF(ospf->t_write);
        OSPF_TIMER_OFF(ospf->t_opaque_lsa_self);
+       OSPF_TIMER_OFF(ospf->t_sr_update);
 
        close(ospf->fd);
        stream_free(ospf->ibuf);