commit b608d5b5ac469d47072aedd573e5d3475f4d9cf4
author Paul Jakma <paul.jakma@sun.com> Wed Jul 02 02:12:07 2008 +0000
committer Paul Jakma <paul.jakma@sun.com> Wed Jul 02 02:12:07 2008 +0000
tree a6e130a1dee11accfbffffd154c592d49e4312dc
parent 0b3f3d47b21ddf175bfdd549ba33fbcd34801244

[bgpd] Fix double-free crash in bgp_table_finish, seen with rs-client

2008-07-02 Stephen Hemminger <stephen.hemminger@vyatta.com>

	* bgp_table.{c,h}: (bgp_table_finish) Take a double pointer and
	  scrub pointer in caller, so fixing double-free crashes seen
	  with route-server-client configuration.
	* *.c: Adjust all callers of bgp_table_finish

2008-07-02 Paul Jakma <paul.jakma@sun.com>

	* bgp_table.{c,h}: (bgp_node_delete, bgp_table_free) shouldn't be
	  exported.

bgpd/bgp_table.c

diff --git a/bgpd/bgp_table.c b/bgpd/bgp_table.c
index 810dab5..be59832 100644
--- a/bgpd/bgp_table.c
+++ b/bgpd/bgp_table.c
@@ -28,8 +28,8 @@
 #include "bgpd/bgpd.h"
 #include "bgpd/bgp_table.h"
 
-void bgp_node_delete (struct bgp_node *);
-void bgp_table_free (struct bgp_table *);
+static void bgp_node_delete (struct bgp_node *);
+static void bgp_table_free (struct bgp_table *);
 
 struct bgp_table *
 bgp_table_init (afi_t afi, safi_t safi)
@@ -47,9 +47,10 @@
 }
 
 void
-bgp_table_finish (struct bgp_table *rt)
+bgp_table_finish (struct bgp_table **rt)
 {
-  bgp_table_free (rt);
+  bgp_table_free (*rt);
+  *rt = NULL;
 }
 
 static struct bgp_node *
@@ -84,7 +85,7 @@
 }
 
 /* Free route table. */
-void
+static void
 bgp_table_free (struct bgp_table *rt)
 {
   struct bgp_node *tmp_node;
@@ -360,7 +361,7 @@
 }
 
 /* Delete node from the routing table. */
-void
+static void
 bgp_node_delete (struct bgp_node *node)
 {
   struct bgp_node *child;