mirrors/bird
mirrors/bird
0
0
Fork 0
mirror of https://gitlab.nic.cz/labs/bird.git synced 2024-11-08 20:28:43 +00:00
Code Releases Activity

Fixes a bug in (mainly) IPv6 BGP.

Browse Source 
Stack variable may be used unitialized and that would lead to spurious
rta_free(), which may cause crash. The bug was introduced in 1.4.1 from
merging add-path branch.

Thanks to Peter Andreev for reporting it and Alexander V. Chernikov for
resolving it.
This commit is contained in:
Ondrej Zajicek 2014-04-14 12:50:03 +02:00
parent 538fec7b1b
commit 859cbd75e1
1 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
proto/bgp/packets.c
View File

@ -1082,7 +1082,7 @@ bgp_do_rx_update(struct bgp_conn *conn,
{ {
struct bgp_proto *p = conn->bgp; struct bgp_proto *p = conn->bgp;
struct rte_src *src = p->p.main_source; struct rte_src *src = p->p.main_source;
rta *a0, *a; rta *a0, *a = NULL;
ip_addr prefix; ip_addr prefix;
int pxlen, err = 0; int pxlen, err = 0;
u32 path_id = 0; u32 path_id = 0;
@ -1115,7 +1115,6 @@ bgp_do_rx_update(struct bgp_conn *conn,
if (a0 && ! bgp_set_next_hop(p, a0)) if (a0 && ! bgp_set_next_hop(p, a0))
a0 = NULL; a0 = NULL;
a = NULL;
last_id = 0; last_id = 0;
src = p->p.main_source; src = p->p.main_source;
@ -1187,7 +1186,7 @@ bgp_do_rx_update(struct bgp_conn *conn,
byte *start, *x; byte *start, *x;
int len, len0; int len, len0;
unsigned af, sub; unsigned af, sub;
rta *a0, *a; rta *a0, *a = NULL;
ip_addr prefix; ip_addr prefix;
int pxlen, err = 0; int pxlen, err = 0;
u32 path_id = 0; u32 path_id = 0;
@ -1234,7 +1233,6 @@ bgp_do_rx_update(struct bgp_conn *conn,
if (a0 && ! bgp_set_next_hop(p, a0)) if (a0 && ! bgp_set_next_hop(p, a0))
a0 = NULL; a0 = NULL;
a = NULL;
last_id = 0; last_id = 0;
src = p->p.main_source; src = p->p.main_source;