From: Olivier Dugeon <olivier.dugeon@orange.com>
Date: Fri, 21 Apr 2023 16:16:34 +0000 (+0200)
Subject: lib: Fix memory leak in in Link State
X-Git-Tag: base_9.0~118^2
X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=30584b6f6a5d4d8e1d23a9574d4c9b5def75a4ba;p=matthieu%2Ffrr.git

lib: Fix memory leak in in Link State

When using ls_stream2ted() function to parse Opaque Link State message to local
TED, in case of vertex or subnet deletion, the function return a pointer to the
deleted ls_element instead of NULL. This could lead into a potential pointer
corruption when caller try to access to the deleted ls_element.

This patch ensure that the ls_element pointer return by ls_stream2ted()
function is NULL when the message event is a delete operation for vertex and
subnet. Note that edge deletion was correctly handled.

Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>
---

diff --git a/lib/link_state.c b/lib/link_state.c
index c06a42b64e..933b7d12f3 100644
--- a/lib/link_state.c
+++ b/lib/link_state.c
@@ -496,7 +496,6 @@ void ls_vertex_del(struct ls_ted *ted, struct ls_vertex *vertex)
 	/* Then remove Vertex from Link State Data Base and free memory */
 	vertices_del(&ted->vertices, vertex);
 	XFREE(MTYPE_LS_DB, vertex);
-	vertex = NULL;
 }
 
 void ls_vertex_del_all(struct ls_ted *ted, struct ls_vertex *vertex)
@@ -1773,9 +1772,10 @@ struct ls_vertex *ls_msg2vertex(struct ls_ted *ted, struct ls_message *msg,
 	case LS_MSG_EVENT_DELETE:
 		vertex = ls_find_vertex_by_id(ted, node->adv);
 		if (vertex) {
-			if (delete)
+			if (delete) {
 				ls_vertex_del_all(ted, vertex);
-			else
+				vertex = NULL;
+			} else
 				vertex->status = DELETE;
 		}
 		break;
@@ -1852,9 +1852,10 @@ struct ls_subnet *ls_msg2subnet(struct ls_ted *ted, struct ls_message *msg,
 	case LS_MSG_EVENT_DELETE:
 		subnet = ls_find_subnet(ted, &pref->pref);
 		if (subnet) {
-			if (delete)
+			if (delete) {
 				ls_subnet_del_all(ted, subnet);
-			else
+				subnet = NULL;
+			} else
 				subnet->status = DELETE;
 		}
 		break;