From 68c2a6fad0bd8b003e6d4a985d0adefe97ed2953 Mon Sep 17 00:00:00 2001 From: Renato Westphal Date: Sat, 18 Jun 2016 17:11:38 +0000 Subject: Fix use after free bug. --- usr.sbin/ldpd/adjacency.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/usr.sbin/ldpd/adjacency.c b/usr.sbin/ldpd/adjacency.c index 80120903a30..8af0d0e564f 100644 --- a/usr.sbin/ldpd/adjacency.c +++ b/usr.sbin/ldpd/adjacency.c @@ -1,4 +1,4 @@ -/* $OpenBSD: adjacency.c,v 1.24 2016/06/13 20:13:34 renato Exp $ */ +/* $OpenBSD: adjacency.c,v 1.25 2016/06/18 17:11:37 renato Exp $ */ /* * Copyright (c) 2013, 2015 Renato Westphal @@ -81,8 +81,15 @@ adj_del(struct adj *adj, int send_notif, uint32_t notif_status) LIST_REMOVE(adj, global_entry); if (adj->nbr) LIST_REMOVE(adj, nbr_entry); - if (adj->source.type == HELLO_LINK) + switch (adj->source.type) { + case HELLO_LINK: LIST_REMOVE(adj, ia_entry); + break; + case HELLO_TARGETED: + adj->source.target->adj = NULL; + break; + } + free(adj); /* last adjacency deleted */ -- cgit v1.2.3