Merge pull request #2814 from qlyoung/fix-ospf6d-lsa-uaf-test

ospf6d: fix use after free on LSA
FRRouting · Aug 20, 2018 · a55a8b4 · a55a8b4
2 parents e0909ff + c957f7d
commit a55a8b4
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/ospf6d/ospf6_flood.c b/ospf6d/ospf6_flood.c
@@ -330,6 +330,8 @@ void ospf6_flood_interface(struct ospf6_neighbor *from, struct ospf6_lsa *lsa,
 						zlog_debug(
 							"Requesting the same, remove it, next neighbor");
 					if (req == on->last_ls_req) {
+						/* sanity check refcount */
+						assert(req->lock >= 2);
 						ospf6_lsa_unlock(req);
 						on->last_ls_req = NULL;
 					}