summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJohn Lo <loj@cisco.com>2016-05-05 19:55:13 -0400
committerDave Barach <openvpp@barachs.net>2016-05-06 04:55:13 +0000
commit7ae717de72771a4412af2a0ea72c69b87961b8e9 (patch)
treeebb49f212465f5c09a827d6be7a88652ece2811b
parent4e0fcd7932c9032f9de24379ec968fc3611421cb (diff)
Check IP adj_index to make sure it is valid to prevent possible crash
Change-Id: I439aac05638fd40e314bec8756e42a32c436321c Signed-off-by: John Lo <loj@cisco.com>
-rw-r--r--vnet/vnet/ip/ip4_forward.c4
-rw-r--r--vnet/vnet/ip/ip6_forward.c4
2 files changed, 6 insertions, 2 deletions
diff --git a/vnet/vnet/ip/ip4_forward.c b/vnet/vnet/ip/ip4_forward.c
index 63bc0ed8fbf..a50664cc662 100644
--- a/vnet/vnet/ip/ip4_forward.c
+++ b/vnet/vnet/ip/ip4_forward.c
@@ -242,7 +242,9 @@ void ip4_add_del_route (ip4_main_t * im, ip4_add_del_route_args_t * a)
old_adj_index = fib->old_hash_values[0];
/* Avoid spurious reference count increments */
- if (old_adj_index == adj_index && !(a->flags & IP4_ROUTE_FLAG_KEEP_OLD_ADJACENCY))
+ if (old_adj_index == adj_index
+ && adj_index != ~0
+ && !(a->flags & IP4_ROUTE_FLAG_KEEP_OLD_ADJACENCY))
{
ip_adjacency_t * adj = ip_get_adjacency (lm, adj_index);
if (adj->share_count > 0)
diff --git a/vnet/vnet/ip/ip6_forward.c b/vnet/vnet/ip/ip6_forward.c
index e57269a0844..e82e0a6b472 100644
--- a/vnet/vnet/ip/ip6_forward.c
+++ b/vnet/vnet/ip/ip6_forward.c
@@ -271,7 +271,9 @@ void ip6_add_del_route (ip6_main_t * im, ip6_add_del_route_args_t * a)
}
/* Avoid spurious reference count increments */
- if (old_adj_index == adj_index && !(a->flags & IP6_ROUTE_FLAG_KEEP_OLD_ADJACENCY))
+ if (old_adj_index == adj_index
+ && adj_index != ~0
+ && !(a->flags & IP6_ROUTE_FLAG_KEEP_OLD_ADJACENCY))
{
ip_adjacency_t * adj = ip_get_adjacency (lm, adj_index);
if (adj->share_count > 0)