tree 32ccf03522bacb163529e00c10df4798e5365808
parent 368473f6120ff295253bcc0d774c6bd75d8cf98b
author Stephen Hemminger <shemminger@vyatta.com> 1281029191 -0700
committer Paul Jakma <paul@quagga.net> 1300713332 +0000

bgpd: fix use of free memory by update_rsclient

* bgp_route.c: (bgp_static_update_rsclient) BGP sometimes crashes when
  removing route server client because of use after free.

  The code to update rsclient created a local static copy of bgp attributes
  but neglected to handle the extra information pointer.  The extra
  information was getting freed by bgp_attr_unintern() and reused later when
  the copy was passed to bgp_attr_intern().

  The fix is to use the attr_dup function to create a copy of the extra
  information, then clean it up.