diff options
| author | Renato Westphal <renato@opensourcerouting.org> | 2016-11-28 15:00:05 -0200 |
|---|---|---|
| committer | Renato Westphal <renato@opensourcerouting.org> | 2016-11-28 16:46:22 -0200 |
| commit | f4f59de462018e48c639978cfe57cf4301a0d209 (patch) | |
| tree | 24c5d6c3eea911806083722ecb5a7721a9552808 /lib/command_match.c | |
| parent | 5a8dfcd891fd12bb9db8f504bf3a083cea4f3cbd (diff) | |
bgpd: fix invalid memory access in peer_free()
We shoult not call bgp_unlock() before calling
bgp_delete_connected_nexthop() in the peer_free() function. Otherwise,
if bgp->lock reaches zero, bgp_free() is called and peer->bgp becomes
an invalid pointer in the bgp_delete_connected_nexthop() function.
To fix this, move the call to bgp_unlock() to the end of peer_free().
Bug exposed by commit 37d361e ("bgpd: plug several memleaks").
Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
Diffstat (limited to 'lib/command_match.c')
0 files changed, 0 insertions, 0 deletions