From: Donald Sharp Date: Thu, 27 Mar 2025 13:03:52 +0000 (-0400) Subject: eigrpd: Fix possible use after free in nbr deletion X-Git-Url: https://git.puffer.fish/?a=commitdiff_plain;h=694fb7f48fb19fe22b42b651d58876833e461d94;p=mirror%2Ffrr.git eigrpd: Fix possible use after free in nbr deletion Coverity is complaining about use after free's in clearing eigrp neighbors. Clean the code up to not have the problem. Signed-off-by: Donald Sharp --- diff --git a/eigrpd/eigrp_vty.c b/eigrpd/eigrp_vty.c index e68b85d801..1a81a338bb 100644 --- a/eigrpd/eigrp_vty.c +++ b/eigrpd/eigrp_vty.c @@ -333,7 +333,7 @@ DEFPY (clear_ip_eigrp_neighbors, eigrp_hello_send(ei, EIGRP_HELLO_GRACEFUL_SHUTDOWN, NULL); /* iterate over all neighbors on eigrp interface */ - frr_each (eigrp_nbr_hash, &ei->nbr_hash_head, nbr) { + frr_each_safe (eigrp_nbr_hash, &ei->nbr_hash_head, nbr) { if (nbr->state != EIGRP_NEIGHBOR_DOWN) { zlog_debug( "Neighbor %pI4 (%s) is down: manually cleared", @@ -393,7 +393,7 @@ DEFPY (clear_ip_eigrp_neighbors_int, eigrp_hello_send(ei, EIGRP_HELLO_GRACEFUL_SHUTDOWN, NULL); /* iterate over all neighbors on eigrp interface */ - frr_each (eigrp_nbr_hash, &ei->nbr_hash_head, nbr) { + frr_each_safe (eigrp_nbr_hash, &ei->nbr_hash_head, nbr) { if (nbr->state != EIGRP_NEIGHBOR_DOWN) { zlog_debug( "Neighbor %pI4 (%s) is down: manually cleared",