ospf6d: don't access nexthops out of bounds
Given that the && is evaluated lazily from left to right,
i < OSPF6_MULTI_PATH_LIMIT should be checked prior to calling
ospf6_nexthop_is_set on the array element, not the other way around.
Signed-off-by: Christian Franke <chris@opensourcerouting.org>
Signed-off-by: Christian Franke <chris@opensourcerouting.org>
Acked-by: Donald Sharp <sharpd@cumulusnetworks.com>
diff --git a/ospf6d/ospf6_intra.c b/ospf6d/ospf6_intra.c
index 3054b59..591dab3 100644
--- a/ospf6d/ospf6_intra.c
+++ b/ospf6d/ospf6_intra.c
@@ -1289,8 +1289,8 @@
}
else
{
- for (i = 0; ospf6_nexthop_is_set (&ls_entry->nexthop[i]) &&
- i < OSPF6_MULTI_PATH_LIMIT; i++)
+ for (i = 0; i < OSPF6_MULTI_PATH_LIMIT &&
+ ospf6_nexthop_is_set (&ls_entry->nexthop[i]); i++)
ospf6_nexthop_copy (&route->nexthop[i], &ls_entry->nexthop[i]);
}