bgpd: ensure transit ptr is nulled on free

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
FRRouting · Nov 26, 2019 · 547357c · 547357c
1 parent dd90b4c
commit 547357c
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 10 deletions.
diff --git a/bgpd/bgp_attr.c b/bgpd/bgp_attr.c
@@ -421,14 +421,15 @@ static struct transit *transit_intern(struct transit *transit)
 	return find;
 }
 
-void transit_unintern(struct transit *transit)
+static void transit_unintern(struct transit **transit)
 {
-	if (transit->refcnt)
-		transit->refcnt--;
+	if ((*transit)->refcnt)
+		(*transit)->refcnt--;
 
-	if (transit->refcnt == 0) {
-		hash_release(transit_hash, transit);
-		transit_free(transit);
+	if ((*transit)->refcnt == 0) {
+		hash_release(transit_hash, *transit);
+		transit_free(*transit);
+		*transit = NULL;
 	}
 }
 
@@ -860,7 +861,7 @@ void bgp_attr_unintern_sub(struct attr *attr)
 	UNSET_FLAG(attr->flag, ATTR_FLAG_BIT(BGP_ATTR_CLUSTER_LIST));
 
 	if (attr->transit)
-		transit_unintern(attr->transit);
+		transit_unintern(&attr->transit);
 
 	if (attr->encap_subtlvs)
 		encap_unintern(&attr->encap_subtlvs, ENCAP_SUBTLV_TYPE);

diff --git a/bgpd/bgp_attr.h b/bgpd/bgp_attr.h
@@ -305,9 +305,6 @@ extern unsigned long int attr_unknown_count(void);
 extern int cluster_loop_check(struct cluster_list *, struct in_addr);
 extern void cluster_unintern(struct cluster_list *);
 
-/* Transit attribute prototypes. */
-void transit_unintern(struct transit *);
-
 /* Below exported for unit-test purposes only */
 struct bgp_attr_parser_args {
 	struct peer *peer;