matthieu/frr
1
0
Fork 0
forked from Mirror/frr
Code Pull requests Activity

Merge pull request #15083 from louis-6wind/fix-isis_spftree_del

Browse source 
isisd: fix _isis_spftree_del heap-use-after-free
This commit is contained in:
Donald Sharp 2024-01-04 13:01:21 -05:00 committed by GitHub
parent 2aef6958f8 9fa9a9d865
commit 4e249eb2e4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
isisd/isis_spf.c
View file

@ -378,6 +378,8 @@ isis_spftree_new(struct isis_area *area, struct lspdb_head *lspdb,
static void _isis_spftree_del(struct isis_spftree *spftree) static void _isis_spftree_del(struct isis_spftree *spftree)
{ {
void *info, *backup_info;
hash_clean_and_free(&spftree->prefix_sids, NULL); hash_clean_and_free(&spftree->prefix_sids, NULL);
isis_zebra_rlfa_unregister_all(spftree); isis_zebra_rlfa_unregister_all(spftree);
isis_rlfa_list_clear(spftree); isis_rlfa_list_clear(spftree);
@ -391,10 +393,12 @@ static void _isis_spftree_del(struct isis_spftree *spftree)
list_delete(&spftree->sadj_list); list_delete(&spftree->sadj_list);
isis_vertex_queue_free(&spftree->tents); isis_vertex_queue_free(&spftree->tents);
isis_vertex_queue_free(&spftree->paths); isis_vertex_queue_free(&spftree->paths);
isis_route_table_info_free(spftree->route_table->info); info = spftree->route_table->info;
isis_route_table_info_free(spftree->route_table_backup->info); backup_info = spftree->route_table_backup->info;
route_table_finish(spftree->route_table); route_table_finish(spftree->route_table);
route_table_finish(spftree->route_table_backup); route_table_finish(spftree->route_table_backup);
isis_route_table_info_free(info);
isis_route_table_info_free(backup_info);
} }
void isis_spftree_del(struct isis_spftree *spftree) void isis_spftree_del(struct isis_spftree *spftree)