Mirror/frr
0
0
Fork 1
mirror of https://github.com/FRRouting/frr.git synced 2025-04-30 13:37:17 +02:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

Merge pull request #18700 from pguibert6WIND/bmp_mirror_heap_use_after_free

Browse source 
bgpd: fix bmp heap use after free on non connected session
This commit is contained in:
Donatas Abraitis 2025-04-29 06:55:32 -07:00 committed by GitHub
parent 593ad76f99 02da52d22e
commit 14267741aa
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
bgpd/bgp_bmp.c
View file

@ -865,6 +865,8 @@ static int bmp_mirror_packet(struct peer *peer, uint8_t type, bgp_size_t size,
bmp->mirrorpos = qitem; bmp->mirrorpos = qitem;
pullwr_bump(bmp->pullwr); pullwr_bump(bmp->pullwr);
} }
if (qitem->refcount == 0)
continue;
bmpbgp->mirror_qsize += sizeof(*qitem) + size; bmpbgp->mirror_qsize += sizeof(*qitem) + size;
bmp_mirrorq_add_tail(&bmpbgp->mirrorq, qitem); bmp_mirrorq_add_tail(&bmpbgp->mirrorq, qitem);