Merge pull request #16077 from FRRouting/mergify/bp/stable/10.0/pr-16021

isisd: fix heap-after-free with prefix sid (backport #16021)

1 files changed, 2 insertions, 0 deletions

diff --git a/isisd/isis_spf.c b/isisd/isis_spf.c
index 7a4b45a0de..3b3e1fd973 100644
--- a/isisd/isis_spf.c
+++ b/isisd/isis_spf.c
@@ -703,6 +703,7 @@ static void isis_spf_add_local(struct isis_spftree *spftree,
 		} else { /* vertex->d_N > cost */
 			/*         f) */
 			isis_vertex_queue_delete(&spftree->tents, vertex);
+			hash_release(spftree->prefix_sids, vertex);
 			isis_vertex_del(vertex);
 		}
 	}
@@ -808,6 +809,7 @@ static void process_N(struct isis_spftree *spftree, enum vertextype vtype,
 			/*      4) */
 		} else {
 			isis_vertex_queue_delete(&spftree->tents, vertex);
+			hash_release(spftree->prefix_sids, vertex);
 			isis_vertex_del(vertex);
 		}
 	}