diff options
| author | Renato Westphal <renato@cvs.openbsd.org> | 2016-06-18 17:11:38 +0000 |
|---|---|---|
| committer | Renato Westphal <renato@cvs.openbsd.org> | 2016-06-18 17:11:38 +0000 |
| commit | 68c2a6fad0bd8b003e6d4a985d0adefe97ed2953 (patch) | |
| tree | 33b51c81874c86d7fd6736ecf4d50a10d162c784 | |
| parent | b9753ae1da754556287aea9592069fd7566a7991 (diff) | |
Fix use after free bug.
| -rw-r--r-- | usr.sbin/ldpd/adjacency.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/usr.sbin/ldpd/adjacency.c b/usr.sbin/ldpd/adjacency.c index 80120903a30..8af0d0e564f 100644 --- a/usr.sbin/ldpd/adjacency.c +++ b/usr.sbin/ldpd/adjacency.c @@ -1,4 +1,4 @@ -/* $OpenBSD: adjacency.c,v 1.24 2016/06/13 20:13:34 renato Exp $ */ +/* $OpenBSD: adjacency.c,v 1.25 2016/06/18 17:11:37 renato Exp $ */ /* * Copyright (c) 2013, 2015 Renato Westphal <renato@openbsd.org> @@ -81,8 +81,15 @@ adj_del(struct adj *adj, int send_notif, uint32_t notif_status) LIST_REMOVE(adj, global_entry); if (adj->nbr) LIST_REMOVE(adj, nbr_entry); - if (adj->source.type == HELLO_LINK) + switch (adj->source.type) { + case HELLO_LINK: LIST_REMOVE(adj, ia_entry); + break; + case HELLO_TARGETED: + adj->source.target->adj = NULL; + break; + } + free(adj); /* last adjacency deleted */ |