tree c5dad1170dd671a48e949b92073afff78671a69e
parent dcc21851aa5f284bf57ccb2b662f4ff5b5a44321
author Paul Jakma <paul.jakma@hpe.com> 1466159819 +0100
committer Paul Jakma <paul.jakma@hpe.com> 1473759406 +0100

bgpd: Fix use after free in aspath_prepend with confeds

* bgp_aspath.c: (aspath_prepend) aspath_delete_confed_seq may result
  in as2 being updated, and seg2 becoming invalid. E.g. if the first
  segment of of as2 is confeds. However, code there after unconditionally
  reads from seg2.

  Reset seg2, and re-do the empty check on it.

  Caught by valgrinding tools/aspathtest.