bgpd: Fix use after free in aspath_prepend with confeds
* bgp_aspath.c: (aspath_prepend) aspath_delete_confed_seq may result
in as2 being updated, and seg2 becoming invalid. E.g. if the first
segment of of as2 is confeds. However, code there after unconditionally
reads from seg2.
Reset seg2, and re-do the empty check on it.
Caught by valgrinding tools/aspathtest.
diff --git a/bgpd/bgp_aspath.c b/bgpd/bgp_aspath.c
index 613aa44..8c87d17 100644
--- a/bgpd/bgp_aspath.c
+++ b/bgpd/bgp_aspath.c
@@ -1380,7 +1380,18 @@
/* Delete any AS_CONFED_SEQUENCE segment from as2. */
if (seg1->type == AS_SEQUENCE && seg2->type == AS_CONFED_SEQUENCE)
as2 = aspath_delete_confed_seq (as2);
-
+
+ /* as2 may have been updated */
+ seg2 = as2->segments;
+
+ /* as2 may be empty now due to aspath_delete_confed_seq, recheck */
+ if (seg2 == NULL)
+ {
+ as2->segments = assegment_dup_all (as1->segments);
+ aspath_str_update (as2);
+ return as2;
+ }
+
/* Compare last segment type of as1 and first segment type of as2. */
if (seg1->type != seg2->type)
return aspath_merge (as1, as2);