security: Fix some typos and potential NULL-deref

This patch against the git tree fixes minor typos, some of them possibily
leading to NULL-pointer dereference in rare conditions.

Signed-off-by: Remi Gacogne <rgacogne-github@coredump.fr>
Signed-off-by: Joachim Nilsson <troglobit@gmail.com>
Acked-by: Feng Lu <lu.feng@6wind.com>

diff --git a/lib/vty.c b/lib/vty.c
index 0d6345c83ab0c2fdcda253b603ede8654ca9294f..96cb1e4b5b55c3be5f8bdbe3b9c14e9c3dfb86ee 100644 (file)
--- a/lib/vty.c
+++ b/lib/vty.c
@@ -1856,9 +1856,11 @@ vty_serv_sock_family (const char* addr, unsigned short port, int family)
     {
       case AF_INET:
         naddr=&su.sin.sin_addr;
+        break;
 #ifdef HAVE_IPV6
       case AF_INET6:
         naddr=&su.sin6.sin6_addr;
+        break;
 #endif 
     }
 

diff --git a/ospf6d/ospf6_snmp.c b/ospf6d/ospf6_snmp.c
index f8a3b9204f9af4768f81fb66fc48a3fd4601c586..466039277c3141f97e7bf5dfdf3cf7d1eea75dd5 100644 (file)
--- a/ospf6d/ospf6_snmp.c
+++ b/ospf6d/ospf6_snmp.c
@@ -528,7 +528,7 @@ ospfv3AreaEntry (struct variable *v, oid *name, size_t *length,
     return NULL;
 
   len = *length - v->namelen;
-  len = (len >= 1 ? sizeof 1 : 0);
+  len = (len >= 1 ? 1 : 0);
   if (exact && len != 1)
     return NULL;
   if (len)

diff --git a/ospfd/ospf_asbr.c b/ospfd/ospf_asbr.c
index a23b4f2be1d4455705080670dbd9ff76a14f742f..7e7c84fd4fea7f079e8bdca97be26edf6b73faa3 100644 (file)
--- a/ospfd/ospf_asbr.c
+++ b/ospfd/ospf_asbr.c
@@ -164,7 +164,8 @@ ospf_external_info_add (u_char type, struct prefix_ipv4 p,
   new->nexthop = nexthop;
   new->tag = 0;
 
-  rn->info = new;
+  if (rn)
+    rn->info = new;
 
   if (IS_DEBUG_OSPF (lsa, LSA_GENERATE))
     zlog_debug ("Redistribute[%s]: %s/%d external info created.",

diff --git a/ospfd/ospf_te.c b/ospfd/ospf_te.c
index 587564a19582020444b59a8259150a97029888de..c605ce68d3a077f244fd6720efd98a9be73bcc4f 100644 (file)
--- a/ospfd/ospf_te.c
+++ b/ospfd/ospf_te.c
@@ -1036,7 +1036,8 @@ ospf_mpls_te_lsa_refresh (struct ospf_lsa *lsa)
   /* If the lsa's age reached to MaxAge, start flushing procedure. */
   if (IS_LSA_MAXAGE (lsa))
     {
-      lp->flags &= ~LPFLG_LSA_ENGAGED;
+      if (lp)
+        lp->flags &= ~LPFLG_LSA_ENGAGED;
       ospf_opaque_lsa_flush_schedule (lsa);
       goto out;
     }

diff --git a/zebra/irdp_packet.c b/zebra/irdp_packet.c
index 28dc171ede7dda9ad34e5e368eb133852a6bac9c..50525043d30ca05df1fd1ce2391cf8a738843693 100644 (file)
--- a/zebra/irdp_packet.c
+++ b/zebra/irdp_packet.c
@@ -287,7 +287,7 @@ send_packet(struct interface *ifp,
   if (!(ifp->flags & IFF_UP))
     return;
 
-  if (!p) 
+  if (p)
     src = ntohl(p->u.prefix4.s_addr);
   else 
     src = 0; /* Is filled in */