| commit | 5552da8f9abd786fb76019135277003f489626d6 | [log] [tgz] |
|---|---|---|
| author | Paul Jakma <paul.jakma@hpe.com> | Fri Jun 17 11:36:59 2016 +0100 |
| committer | Paul Jakma <paul.jakma@hpe.com> | Tue Sep 13 10:36:46 2016 +0100 |
| tree | c5dad1170dd671a48e949b92073afff78671a69e | |
| parent | dcc21851aa5f284bf57ccb2b662f4ff5b5a44321 [diff] |
bgpd: Fix use after free in aspath_prepend with confeds * bgp_aspath.c: (aspath_prepend) aspath_delete_confed_seq may result in as2 being updated, and seg2 becoming invalid. E.g. if the first segment of of as2 is confeds. However, code there after unconditionally reads from seg2. Reset seg2, and re-do the empty check on it. Caught by valgrinding tools/aspathtest.