[bgpd] Fix double-free crash in bgp_table_finish, seen with rs-client
2008-07-02 Stephen Hemminger <stephen.hemminger@vyatta.com>
* bgp_table.{c,h}: (bgp_table_finish) Take a double pointer and
scrub pointer in caller, so fixing double-free crashes seen
with route-server-client configuration.
* *.c: Adjust all callers of bgp_table_finish
2008-07-02 Paul Jakma <paul.jakma@sun.com>
* bgp_table.{c,h}: (bgp_node_delete, bgp_table_free) shouldn't be
exported.
diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index 374c4c5..4dc6621 100644
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -1228,7 +1228,7 @@
for (afi = AFI_IP; afi < AFI_MAX; afi++)
for (safi = SAFI_UNICAST; safi < SAFI_MAX; safi++)
if (peer->rib[afi][safi] && ! peer->af_group[afi][safi])
- bgp_table_finish (peer->rib[afi][safi]);
+ bgp_table_finish (&peer->rib[afi][safi]);
/* Buffers. */
if (peer->ibuf)
@@ -1798,7 +1798,7 @@
list_delete_node (bgp->rsclient, pn);
}
- bgp_table_finish (peer->rib[afi][safi]);
+ bgp_table_finish (&peer->rib[afi][safi]);
/* Import policy. */
if (peer->filter[afi][safi].map[RMAP_IMPORT].name)