[bgpd] CID#73, potential crash in bgp statistics if called for AFI/SAFI with emtpy...

2006-10-15 Paul Jakma <paul.jakma@sun.com>

	* bgp_route.c: (bgp_table_stats_walker) NULL deref if table is
	  empty, bgp_table_top may return NULL, Coverity CID#73.

diff --git a/bgpd/ChangeLog b/bgpd/ChangeLog
index c33562da1d6f21606c41af88d00d466cb1b51c43..56107329d6d912aa1b3123f9cd9782f903603fd6 100644 (file)
--- a/bgpd/ChangeLog
+++ b/bgpd/ChangeLog
@@ -1,3 +1,8 @@
+2006-10-15 Paul Jakma <paul.jakma@sun.com>
+
+       * bgp_route.c: (bgp_table_stats_walker) NULL deref if table is
+         empty, bgp_table_top may return NULL, Coverity CID#73.
+
 2006-10-14 Paul Jakma <paul.jakma@sun.com>
 
        * bgp_fsm.h: Remove BGP_EVENT_FLUSH_ADD, dangerous and not

diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c
index cd28b4dfd78ce1a0472631d85e23e1b4da6d3818..7b369748ffa4be05f1b26c8dd5ad70b1f2266294 100644 (file)
--- a/bgpd/bgp_route.c
+++ b/bgpd/bgp_route.c
@@ -8481,7 +8481,8 @@ bgp_table_stats_walker (struct thread *t)
   struct bgp_table_stats *ts = THREAD_ARG (t);
   unsigned int space = 0;
   
-  top = bgp_table_top (ts->table);
+  if (!(top = bgp_table_top (ts->table)))
+    return 0;
 
   switch (top->p.family)
     {