From cd4af52574ef8027b8d48989ee6445b6b2f246cc Mon Sep 17 00:00:00 2001 From: Chirag Shah Date: Mon, 14 Aug 2017 18:57:46 -0700 Subject: [PATCH] ospfd: Fix ospfd crash in free_nexthop Fix ANVL-OSPF-5.1 reported ospfd crash. vertex_nexthop_free was added as valgrind reported potential memory leak, but in some cases nexthop would not be available freed. The actual nexthop free is part of ospf_canonical_nexthops_free(), upon trying to free, qfree checks mtype count becomes 0 and asserts. Removing vertex_nexthop_free() from ospf_spf_flush_parents(). Signed-off-by: Chirag Shah --- ospfd/ospf_spf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ospfd/ospf_spf.c b/ospfd/ospf_spf.c index 7437d26da3..891088ecc2 100644 --- a/ospfd/ospf_spf.c +++ b/ospfd/ospf_spf.c @@ -136,8 +136,10 @@ static void ospf_canonical_nexthops_free(struct vertex *root) /* Free child nexthops pointing back to this root vertex */ for (ALL_LIST_ELEMENTS(child->parents, n2, nn2, vp)) - if (vp->parent == root && vp->nexthop) + if (vp->parent == root && vp->nexthop) { vertex_nexthop_free(vp->nexthop); + vp->nexthop = NULL; + } } } @@ -401,8 +403,6 @@ static void ospf_spf_flush_parents(struct vertex *w) /* delete the existing nexthops */ for (ALL_LIST_ELEMENTS(w->parents, ln, nn, vp)) { list_delete_node(w->parents, ln); - if (vp->nexthop) - vertex_nexthop_free(vp->nexthop); vertex_parent_free(vp); } } -- 2.39.5