diff options
| author | David Lamparter <equinox@diac24.net> | 2018-08-20 18:16:46 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-08-20 18:16:46 +0200 |
| commit | a55a8b4538a4a9dd56837d9a2ceeb5ae75573b59 (patch) | |
| tree | 6f8dbc260c20c022dfbcfeafa3304aa2e948f60d | |
| parent | e0909ff51f20af75ea15993f9c1d7f054018cf98 (diff) | |
| parent | c957f7d9798d69fcb49ce6651914c481534b88aa (diff) | |
Merge pull request #2814 from qlyoung/fix-ospf6d-lsa-uaf-test
ospf6d: fix use after free on LSA
| -rw-r--r-- | ospf6d/ospf6_flood.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/ospf6d/ospf6_flood.c b/ospf6d/ospf6_flood.c index 2059d84868..0828c2beb6 100644 --- a/ospf6d/ospf6_flood.c +++ b/ospf6d/ospf6_flood.c @@ -330,6 +330,8 @@ void ospf6_flood_interface(struct ospf6_neighbor *from, struct ospf6_lsa *lsa, zlog_debug( "Requesting the same, remove it, next neighbor"); if (req == on->last_ls_req) { + /* sanity check refcount */ + assert(req->lock >= 2); ospf6_lsa_unlock(req); on->last_ls_req = NULL; } |