bgpd: Fix a crash caused by mistakenly dequeueing the bestpath on the

multipath list. This causes the multipath list to get truncated
but the multipath count still reflects what it was before truncation.
When we install the route to zebra we fail to fill the nexthop
array with the number of nexthop pointers indicated by the
multipath count and this leads to a NULL pointer crash in
stream_put_in_addr().

Changes:

* bgpd/bgp_mpath.c
  * bgp_info_mpath_update(): If new_mpath is the bestpath we should
    just move to the next mp_list node. Move dequeue of new_mpath and
    the code that updates next_mpath to inside the check that
    new_mpath is not the bestpath.

diff --git a/bgpd/bgp_mpath.c b/bgpd/bgp_mpath.c
index 44823c4baa249fbb2acc9f0d3a580cf03d0eff72..1709c24484921c5f8bbd3ca79340066c2dd68251 100644 (file)
--- a/bgpd/bgp_mpath.c
+++ b/bgpd/bgp_mpath.c
@@ -521,12 +521,13 @@ bgp_info_mpath_update (struct bgp_node *rn, struct bgp_info *new_best,
            */
           new_mpath = listgetdata (mp_node);
           list_delete_node (mp_list, mp_node);
-          if (new_mpath == next_mpath)
-            next_mpath = bgp_info_mpath_next (new_mpath);
-          bgp_info_mpath_dequeue (new_mpath);
           if ((mpath_count < maxpaths) && (new_mpath != new_best) &&
               bgp_info_nexthop_cmp (prev_mpath, new_mpath))
             {
+              if (new_mpath == next_mpath)
+                next_mpath = bgp_info_mpath_next (new_mpath);
+              bgp_info_mpath_dequeue (new_mpath);
+
               bgp_info_mpath_enqueue (prev_mpath, new_mpath);
               prev_mpath = new_mpath;
               mpath_changed = 1;