bgpd: Fix crash when disabling dampening (BZ#687)

    Vladimir Podobaev reported that the following commands crashed the
daemon.

router bgp 123
 bgp dampening
 no bgp dampening 1 2 3 4
 no bgp dampening

    The problem was that bgp_damp_info_clean() tried to dereference the
already freed reuse_list array in the second call to "no bgp dampening".

    Fixed by checking in bgp_damp_disable() that the dampening it's
enabled before doing the cleanup.

Signed-off-by: Jorge Boncompte [DTI2] <jorge@dti2.net>

diff --git a/bgpd/bgp_damp.c b/bgpd/bgp_damp.c
index a51388335430e5c59eb3971e7aa8950e846b2add..2820f17c799cad3296e823a059c1eb6bcf917b02 100644 (file)
--- a/bgpd/bgp_damp.c
+++ b/bgpd/bgp_damp.c
@@ -498,6 +498,10 @@ bgp_damp_info_clean (void)
 int
 bgp_damp_disable (struct bgp *bgp, afi_t afi, safi_t safi)
 {
+  /* If it wasn't enabled, there's nothing to do. */
+  if (! CHECK_FLAG (bgp->af_flags[afi][safi], BGP_CONFIG_DAMPENING))
+    return 0;
+
   /* Cancel reuse thread. */
   if (damp->t_reuse )
     thread_cancel (damp->t_reuse);