Commit 859cbd75 authored by Ondřej Zajíček's avatar Ondřej Zajíček

Fixes a bug in (mainly) IPv6 BGP.

Stack variable may be used unitialized and that would lead to spurious
rta_free(), which may cause crash. The bug was introduced in 1.4.1 from
merging add-path branch.

Thanks to Peter Andreev for reporting it and Alexander V. Chernikov for
resolving it.
parent 538fec7b
......@@ -1082,7 +1082,7 @@ bgp_do_rx_update(struct bgp_conn *conn,
{
struct bgp_proto *p = conn->bgp;
struct rte_src *src = p->p.main_source;
rta *a0, *a;
rta *a0, *a = NULL;
ip_addr prefix;
int pxlen, err = 0;
u32 path_id = 0;
......@@ -1115,7 +1115,6 @@ bgp_do_rx_update(struct bgp_conn *conn,
if (a0 && ! bgp_set_next_hop(p, a0))
a0 = NULL;
a = NULL;
last_id = 0;
src = p->p.main_source;
......@@ -1187,7 +1186,7 @@ bgp_do_rx_update(struct bgp_conn *conn,
byte *start, *x;
int len, len0;
unsigned af, sub;
rta *a0, *a;
rta *a0, *a = NULL;
ip_addr prefix;
int pxlen, err = 0;
u32 path_id = 0;
......@@ -1234,7 +1233,6 @@ bgp_do_rx_update(struct bgp_conn *conn,
if (a0 && ! bgp_set_next_hop(p, a0))
a0 = NULL;
a = NULL;
last_id = 0;
src = p->p.main_source;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment