ospf6d: fix heap uaf

Fix #667

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>

diff --git a/ospf6d/ospf6_intra.c b/ospf6d/ospf6_intra.c
index 5dd10b4c72f886968c552c6f9eb4d9c9e7fcafd7..80e67ea2a9ecc84f61ec4c044aa6059c8b301dfc 100644 (file)
--- a/ospf6d/ospf6_intra.c
+++ b/ospf6d/ospf6_intra.c
@@ -1621,6 +1621,7 @@ ospf6_intra_brouter_calculation (struct ospf6_area *oa)
             zlog_info ("brouter %s disappears via area %s",
                        brouter_name, oa->name);
           ospf6_route_remove (brouter, oa->ospf6->brouter_table);
+          brouter = NULL;
         }
       else if (CHECK_FLAG (brouter->flag, OSPF6_ROUTE_ADD) ||
                CHECK_FLAG (brouter->flag, OSPF6_ROUTE_CHANGE))
@@ -1644,8 +1645,12 @@ ospf6_intra_brouter_calculation (struct ospf6_area *oa)
           /* But re-originate summaries */
          ospf6_abr_originate_summary (brouter);
         }
-      UNSET_FLAG (brouter->flag, OSPF6_ROUTE_ADD);
-      UNSET_FLAG (brouter->flag, OSPF6_ROUTE_CHANGE);
+
+      if (brouter)
+        {
+          UNSET_FLAG (brouter->flag, OSPF6_ROUTE_ADD);
+          UNSET_FLAG (brouter->flag, OSPF6_ROUTE_CHANGE);
+        }
     }
 
   if (IS_OSPF6_DEBUG_BROUTER_SPECIFIC_AREA_ID (oa->area_id))