commit a11e012e8661629d665e992e765741a5eaa7d017
author Remi Gacogne <rgacogne-github@coredump.fr> Sun Sep 08 13:48:34 2013 +0000
committer Vincent JARDIN <vincent.jardin@6wind.com> Tue Feb 11 10:28:03 2014 +0100
tree d6967d9c5044f8c924aa2f4b62bac8e3bda358e2
parent b52aef18a9f3acc8b24ab5c2631dc574b8e2ec70

security: Fix some typos and potential NULL-deref

This patch against the git tree fixes minor typos, some of them possibily
leading to NULL-pointer dereference in rare conditions.

Signed-off-by: Remi Gacogne <rgacogne-github@coredump.fr>
Signed-off-by: Joachim Nilsson <troglobit@gmail.com>
Acked-by: Feng Lu <lu.feng@6wind.com>

lib/vty.c

diff --git a/lib/vty.c b/lib/vty.c
index 0d6345c..96cb1e4 100644
--- a/lib/vty.c
+++ b/lib/vty.c
@@ -1856,9 +1856,11 @@
     {
       case AF_INET:
         naddr=&su.sin.sin_addr;
+        break;
 #ifdef HAVE_IPV6
       case AF_INET6:
         naddr=&su.sin6.sin6_addr;
+        break;
 #endif	
     }
 

ospf6d/ospf6_snmp.c

diff --git a/ospf6d/ospf6_snmp.c b/ospf6d/ospf6_snmp.c
index f8a3b92..4660392 100644
--- a/ospf6d/ospf6_snmp.c
+++ b/ospf6d/ospf6_snmp.c
@@ -528,7 +528,7 @@
     return NULL;
 
   len = *length - v->namelen;
-  len = (len >= 1 ? sizeof 1 : 0);
+  len = (len >= 1 ? 1 : 0);
   if (exact && len != 1)
     return NULL;
   if (len)

ospfd/ospf_asbr.c

diff --git a/ospfd/ospf_asbr.c b/ospfd/ospf_asbr.c
index a23b4f2..7e7c84f 100644
--- a/ospfd/ospf_asbr.c
+++ b/ospfd/ospf_asbr.c
@@ -164,7 +164,8 @@
   new->nexthop = nexthop;
   new->tag = 0;
 
-  rn->info = new;
+  if (rn)
+    rn->info = new;
 
   if (IS_DEBUG_OSPF (lsa, LSA_GENERATE))
     zlog_debug ("Redistribute[%s]: %s/%d external info created.",

ospfd/ospf_te.c

diff --git a/ospfd/ospf_te.c b/ospfd/ospf_te.c
index 587564a..c605ce6 100644
--- a/ospfd/ospf_te.c
+++ b/ospfd/ospf_te.c
@@ -1036,7 +1036,8 @@
   /* If the lsa's age reached to MaxAge, start flushing procedure. */
   if (IS_LSA_MAXAGE (lsa))
     {
-      lp->flags &= ~LPFLG_LSA_ENGAGED;
+      if (lp)
+        lp->flags &= ~LPFLG_LSA_ENGAGED;
       ospf_opaque_lsa_flush_schedule (lsa);
       goto out;
     }

zebra/irdp_packet.c

diff --git a/zebra/irdp_packet.c b/zebra/irdp_packet.c
index 28dc171..5052504 100644
--- a/zebra/irdp_packet.c
+++ b/zebra/irdp_packet.c
@@ -287,7 +287,7 @@
   if (!(ifp->flags & IFF_UP))
     return;
 
-  if (!p) 
+  if (p)
     src = ntohl(p->u.prefix4.s_addr);
   else 
     src = 0; /* Is filled in */