bgpd: fix memory leak on malformed attribute

When bgp_attr_parse returns BGP_ATTR_PARSE_ERROR, it may already have
parsed and allocated some attributes before hitting that error.  Free
the attr's data before returning.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>

diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c
index 80651f155a45f8be7c88279e2ed553f710e4cbe2..65c6cac16ac77afc9152d50a35e9f9582125f37c 100644 (file)
--- a/bgpd/bgp_packet.c
+++ b/bgpd/bgp_packet.c
@@ -1720,7 +1720,10 @@ bgp_update_receive (struct peer *peer, bgp_size_t size)
       attr_parse_ret = bgp_attr_parse (peer, &attr, attribute_len, 
                            &mp_update, &mp_withdraw);
       if (attr_parse_ret == BGP_ATTR_PARSE_ERROR)
-       return -1;
+       {
+         bgp_attr_unintern_sub (&attr);
+         return -1;
+       }
     }
   
   /* Logging the attribute. */