diff options
author | Stephen Hemminger <shemminger@vyatta.com> | 2010-08-05 10:26:31 -0700 |
---|---|---|
committer | Paul Jakma <paul@quagga.net> | 2011-03-21 13:15:32 +0000 |
commit | 7badc26301c8063dc2c6f171c11f9af4f3d0df20 (patch) | |
tree | 32ccf03522bacb163529e00c10df4798e5365808 /bgpd/bgp_regex.c | |
parent | 368473f6120ff295253bcc0d774c6bd75d8cf98b (diff) |
bgpd: fix use of free memory by update_rsclient
* bgp_route.c: (bgp_static_update_rsclient) BGP sometimes crashes when
removing route server client because of use after free.
The code to update rsclient created a local static copy of bgp attributes
but neglected to handle the extra information pointer. The extra
information was getting freed by bgp_attr_unintern() and reused later when
the copy was passed to bgp_attr_intern().
The fix is to use the attr_dup function to create a copy of the extra
information, then clean it up.
Diffstat (limited to 'bgpd/bgp_regex.c')
0 files changed, 0 insertions, 0 deletions