From: Quentin Young <qlyoung@cumulusnetworks.com>
Date: Tue, 9 Aug 2016 19:30:40 +0000 (+0000)
Subject: lib: Fix use after free in lexer
X-Git-Tag: frr-3.0-branchpoint~129^2~256
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=07079d78bc849dacc7b90c7fec6949687b344974;p=matthieu%2Ffrr.git

lib: Fix use after free in lexer

Fix occasional bug where deleting flex's input
buffer happens earlier than flex expects

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
---

diff --git a/lib/command_parse.y b/lib/command_parse.y
index 51c2331dc7..bbdf11c6e8 100644
--- a/lib/command_parse.y
+++ b/lib/command_parse.y
@@ -152,7 +152,6 @@ start:
 {
   // tack on the command element
   terminate_graph (startnode, currnode, element);
-  cleanup();
 }
 | sentence_root cmd_token_seq '.' placeholder_token
 {
@@ -165,7 +164,6 @@ start:
 
   // tack on the command element
   terminate_graph (startnode, currnode, element);
-  cleanup();
 }
 
 sentence_root: WORD
@@ -394,7 +392,10 @@ parse_command_format(struct graph_node *start, struct cmd_element *cmd)
   yydebug = 0;
 
   // parse command into DFA
-  yyparse(cmd, start);
+  yyparse (cmd, start);
+
+  /* cleanup */
+  cleanup ();
 
   return start;
 }
@@ -416,7 +417,7 @@ cleanup()
   free (docstr_start);
 
   /* cleanup lexer */
-  cleanup_lexer();
+  cleanup_lexer ();
 
   /* clear state pointers */
   seqhead = NULL;