diff options
| author | Claudio Jeker <claudio@cvs.openbsd.org> | 2005-03-17 16:46:16 +0000 |
|---|---|---|
| committer | Claudio Jeker <claudio@cvs.openbsd.org> | 2005-03-17 16:46:16 +0000 |
| commit | ebe0aee19a7323a6b2434f0efbc6785d3b14f2ea (patch) | |
| tree | 5bd5ccfdeca87b8ff0a35bd8e0e73187b77c84c2 | |
| parent | d148e7dcb63cf6abc4f67ad38ccdf72a00f2e2a0 (diff) | |
Fix an access after free. It is not allowed to use a RB_REMOVE inside of a
RB_FOREACH.
OK norby@ deraadt@
| -rw-r--r-- | usr.sbin/ospfd/rde_spf.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/usr.sbin/ospfd/rde_spf.c b/usr.sbin/ospfd/rde_spf.c index f6f3c3a5678..d34dcd58b3e 100644 --- a/usr.sbin/ospfd/rde_spf.c +++ b/usr.sbin/ospfd/rde_spf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: rde_spf.c,v 1.6 2005/03/14 18:21:29 norby Exp $ */ +/* $OpenBSD: rde_spf.c,v 1.7 2005/03/17 16:46:15 claudio Exp $ */ /* * Copyright (c) 2005 Esben Norby <norby@openbsd.org> @@ -629,13 +629,15 @@ rt_remove(struct rt_node *r) void rt_invalidate(void) { - struct rt_node *r; + struct rt_node *r, *nr; - RB_FOREACH(r, rt_tree, &rt) + for (r = RB_MIN(rt_tree, &rt); r != NULL; r = nr) { + nr = RB_NEXT(rt_tree, &rt, r); if (r->invalid) rt_remove(r); else r->invalid = true; + } } void |