summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ospfd/ChangeLog7
-rw-r--r--ospfd/ospf_spf.c11
2 files changed, 17 insertions, 1 deletions
diff --git a/ospfd/ChangeLog b/ospfd/ChangeLog
index 7b77cb4e..751f5d36 100644
--- a/ospfd/ChangeLog
+++ b/ospfd/ChangeLog
@@ -1,3 +1,10 @@
+2005-11-11 Paul Jakma <paul.jakma@sun.com>
+
+ * ospf_spf.c: (ospf_canonical_nexthops_free) Free only
+ the nexthops pointing to the root vertex. We may visit a
+ vertex twice or the vertex may have some inherited nexthops,
+ if we free other nexthops we could crash.
+
2005-11-04 Paul Jakma <paul.jakma@sun.com>
* ospf_{dump,spf,vty}.c: Oops, use the internal tv_sub
diff --git a/ospfd/ospf_spf.c b/ospfd/ospf_spf.c
index 564ae847..dbd06361 100644
--- a/ospfd/ospf_spf.c
+++ b/ospfd/ospf_spf.c
@@ -94,11 +94,20 @@ ospf_canonical_nexthops_free (struct vertex *root)
struct listnode *n2, *nn2;
struct vertex_parent *vp;
+ /* router vertices through an attached network each
+ * have a distinct (canonical / not inherited) nexthop
+ * which must be freed.
+ *
+ * A network vertex can only have router vertices as its
+ * children, so only one level of recursion is possible.
+ */
if (child->type == OSPF_VERTEX_NETWORK)
ospf_canonical_nexthops_free (child);
+ /* Free child nexthops pointing back to this root vertex */
for (ALL_LIST_ELEMENTS (child->parents, n2, nn2, vp))
- vertex_nexthop_free (vp->nexthop);
+ if (vp->parent == root)
+ vertex_nexthop_free (vp->nexthop);
}
}