[ospfd] SPF ospf_canonical_nexthops_free bugfix.

diff --git a/ospfd/ChangeLog b/ospfd/ChangeLog
index 7b77cb4e35be982d685864eb75a43e4e80427e8a..751f5d36c2702f8c558ed32b423b861f9014c5f4 100644 (file)
--- a/ospfd/ChangeLog
+++ b/ospfd/ChangeLog
@@ -1,3 +1,10 @@
+2005-11-11 Paul Jakma <paul.jakma@sun.com>
+
+       * ospf_spf.c: (ospf_canonical_nexthops_free) Free only
+         the nexthops pointing to the root vertex. We may visit a
+         vertex twice or the vertex may have some inherited nexthops,
+         if we free other nexthops we could crash.
+ 
 2005-11-04 Paul Jakma <paul.jakma@sun.com>
 
        * ospf_{dump,spf,vty}.c: Oops, use the internal tv_sub

diff --git a/ospfd/ospf_spf.c b/ospfd/ospf_spf.c
index 564ae847c6b2839a300545df963b7872eed294d8..dbd06361285d4bcc4aa5c5078a02860c1f219086 100644 (file)
--- a/ospfd/ospf_spf.c
+++ b/ospfd/ospf_spf.c
@@ -94,11 +94,20 @@ ospf_canonical_nexthops_free (struct vertex *root)
       struct listnode *n2, *nn2;
       struct vertex_parent *vp;
       
+      /* router vertices through an attached network each
+       * have a distinct (canonical / not inherited) nexthop
+       * which must be freed.
+       *
+       * A network vertex can only have router vertices as its
+       * children, so only one level of recursion is possible.
+       */
       if (child->type == OSPF_VERTEX_NETWORK)
         ospf_canonical_nexthops_free (child);
       
+      /* Free child nexthops pointing back to this root vertex */
       for (ALL_LIST_ELEMENTS (child->parents, n2, nn2, vp))
-        vertex_nexthop_free (vp->nexthop);
+        if (vp->parent == root)
+          vertex_nexthop_free (vp->nexthop);
     }
 }      
 \f