From 95eb01fdc65b692065ace6d76870d8cc9f3e2c84 Mon Sep 17 00:00:00 2001 From: Benoît Ganne Date: Thu, 16 Apr 2020 12:38:48 +0200 Subject: fib: fix use-after-free MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Type: fix Change-Id: Ie7081d977dd0d3e7d09bc0d1b4d53863288e443b Signed-off-by: Benoît Ganne --- src/vnet/mfib/mfib_entry.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) (limited to 'src/vnet') diff --git a/src/vnet/mfib/mfib_entry.c b/src/vnet/mfib/mfib_entry.c index 448e6c5e0a8..c08565d966c 100644 --- a/src/vnet/mfib/mfib_entry.c +++ b/src/vnet/mfib/mfib_entry.c @@ -1144,18 +1144,18 @@ mfib_entry_path_remove (fib_node_index_t mfib_entry_index, mfib_entry_itf_remove(msrc, rpath->frp_sw_if_index); } } - - if (mfib_entry_src_ok_for_delete(msrc)) - { - /* - * this source has no interfaces and no flags. - * it has nothing left to give - remove it - */ - mfib_entry_src_remove(mfib_entry, source); - } } vec_free(path_indices); + if (mfib_entry_src_ok_for_delete(msrc)) + { + /* + * this source has no interfaces and no flags. + * it has nothing left to give - remove it + */ + mfib_entry_src_remove(mfib_entry, source); + } + mfib_entry_recalculate_forwarding(mfib_entry, current_best); return (mfib_entry_ok_for_delete(mfib_entry)); @@ -1491,7 +1491,8 @@ mfib_entry_contribute_forwarding (fib_node_index_t mfib_entry_index, /* * caller does not want the local paths that the entry has */ - dpo_set(dpo, DPO_REPLICATE, rep->rep_proto, + dpo_proto_t rep_proto = rep->rep_proto; + dpo_set(dpo, DPO_REPLICATE, rep_proto, replicate_dup(REPLICATE_FLAGS_NONE, mfib_entry->mfe_rep.dpoi_index)); } -- cgit 1.2.3-korg