From 7ae717de72771a4412af2a0ea72c69b87961b8e9 Mon Sep 17 00:00:00 2001 From: John Lo Date: Thu, 5 May 2016 19:55:13 -0400 Subject: Check IP adj_index to make sure it is valid to prevent possible crash Change-Id: I439aac05638fd40e314bec8756e42a32c436321c Signed-off-by: John Lo --- vnet/vnet/ip/ip4_forward.c | 4 +++- vnet/vnet/ip/ip6_forward.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/vnet/vnet/ip/ip4_forward.c b/vnet/vnet/ip/ip4_forward.c index 63bc0ed8fbf..a50664cc662 100644 --- a/vnet/vnet/ip/ip4_forward.c +++ b/vnet/vnet/ip/ip4_forward.c @@ -242,7 +242,9 @@ void ip4_add_del_route (ip4_main_t * im, ip4_add_del_route_args_t * a) old_adj_index = fib->old_hash_values[0]; /* Avoid spurious reference count increments */ - if (old_adj_index == adj_index && !(a->flags & IP4_ROUTE_FLAG_KEEP_OLD_ADJACENCY)) + if (old_adj_index == adj_index + && adj_index != ~0 + && !(a->flags & IP4_ROUTE_FLAG_KEEP_OLD_ADJACENCY)) { ip_adjacency_t * adj = ip_get_adjacency (lm, adj_index); if (adj->share_count > 0) diff --git a/vnet/vnet/ip/ip6_forward.c b/vnet/vnet/ip/ip6_forward.c index e57269a0844..e82e0a6b472 100644 --- a/vnet/vnet/ip/ip6_forward.c +++ b/vnet/vnet/ip/ip6_forward.c @@ -271,7 +271,9 @@ void ip6_add_del_route (ip6_main_t * im, ip6_add_del_route_args_t * a) } /* Avoid spurious reference count increments */ - if (old_adj_index == adj_index && !(a->flags & IP6_ROUTE_FLAG_KEEP_OLD_ADJACENCY)) + if (old_adj_index == adj_index + && adj_index != ~0 + && !(a->flags & IP6_ROUTE_FLAG_KEEP_OLD_ADJACENCY)) { ip_adjacency_t * adj = ip_get_adjacency (lm, adj_index); if (adj->share_count > 0) -- cgit 1.2.3-korg