From 5854884d5462bdb440c32969eb7aa2c0ed0ad467 Mon Sep 17 00:00:00 2001 From: Benoît Ganne Date: Thu, 16 Apr 2020 12:38:48 +0200 Subject: fib: fix use-after-free MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Type: fix Change-Id: Ie7081d977dd0d3e7d09bc0d1b4d53863288e443b Signed-off-by: Benoît Ganne (cherry picked from commit 95eb01fdc65b692065ace6d76870d8cc9f3e2c84) --- src/vnet/mfib/mfib_entry.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/src/vnet/mfib/mfib_entry.c b/src/vnet/mfib/mfib_entry.c index f169dc0886e..5362d7b628e 100644 --- a/src/vnet/mfib/mfib_entry.c +++ b/src/vnet/mfib/mfib_entry.c @@ -1078,18 +1078,18 @@ mfib_entry_path_remove (fib_node_index_t mfib_entry_index, mfib_entry_itf_remove(msrc, rpath->frp_sw_if_index); } } - - if (mfib_entry_src_ok_for_delete(msrc)) - { - /* - * this source has no interfaces and no flags. - * it has nothing left to give - remove it - */ - mfib_entry_src_remove(mfib_entry, source); - } } vec_free(path_indices); + if (mfib_entry_src_ok_for_delete(msrc)) + { + /* + * this source has no interfaces and no flags. + * it has nothing left to give - remove it + */ + mfib_entry_src_remove(mfib_entry, source); + } + mfib_entry_recalculate_forwarding(mfib_entry, current_best); return (mfib_entry_ok_for_delete(mfib_entry)); @@ -1425,7 +1425,8 @@ mfib_entry_contribute_forwarding (fib_node_index_t mfib_entry_index, /* * caller does not want the local paths that the entry has */ - dpo_set(dpo, DPO_REPLICATE, rep->rep_proto, + dpo_proto_t rep_proto = rep->rep_proto; + dpo_set(dpo, DPO_REPLICATE, rep_proto, replicate_dup(REPLICATE_FLAGS_NONE, mfib_entry->mfe_rep.dpoi_index)); } -- cgit 1.2.3-korg