Browse Source

security: Fix some typos and potential NULL-deref

This patch against the git tree fixes minor typos, some of them possibily
leading to NULL-pointer dereference in rare conditions.

Signed-off-by: Remi Gacogne <rgacogne-github@coredump.fr>
Signed-off-by: Joachim Nilsson <troglobit@gmail.com>
Acked-by: Feng Lu <lu.feng@6wind.com>
Remi Gacogne 6 years ago
parent
commit
a11e012e86
5 changed files with 8 additions and 4 deletions
  1. 2 0
      lib/vty.c
  2. 1 1
      ospf6d/ospf6_snmp.c
  3. 2 1
      ospfd/ospf_asbr.c
  4. 2 1
      ospfd/ospf_te.c
  5. 1 1
      zebra/irdp_packet.c

+ 2 - 0
lib/vty.c

@@ -1856,9 +1856,11 @@ vty_serv_sock_family (const char* addr, unsigned short port, int family)
     {
       case AF_INET:
         naddr=&su.sin.sin_addr;
+        break;
 #ifdef HAVE_IPV6
       case AF_INET6:
         naddr=&su.sin6.sin6_addr;
+        break;
 #endif	
     }
 

+ 1 - 1
ospf6d/ospf6_snmp.c

@@ -528,7 +528,7 @@ ospfv3AreaEntry (struct variable *v, oid *name, size_t *length,
     return NULL;
 
   len = *length - v->namelen;
-  len = (len >= 1 ? sizeof 1 : 0);
+  len = (len >= 1 ? 1 : 0);
   if (exact && len != 1)
     return NULL;
   if (len)

+ 2 - 1
ospfd/ospf_asbr.c

@@ -164,7 +164,8 @@ ospf_external_info_add (u_char type, struct prefix_ipv4 p,
   new->nexthop = nexthop;
   new->tag = 0;
 
-  rn->info = new;
+  if (rn)
+    rn->info = new;
 
   if (IS_DEBUG_OSPF (lsa, LSA_GENERATE))
     zlog_debug ("Redistribute[%s]: %s/%d external info created.",

+ 2 - 1
ospfd/ospf_te.c

@@ -1036,7 +1036,8 @@ ospf_mpls_te_lsa_refresh (struct ospf_lsa *lsa)
   /* If the lsa's age reached to MaxAge, start flushing procedure. */
   if (IS_LSA_MAXAGE (lsa))
     {
-      lp->flags &= ~LPFLG_LSA_ENGAGED;
+      if (lp)
+        lp->flags &= ~LPFLG_LSA_ENGAGED;
       ospf_opaque_lsa_flush_schedule (lsa);
       goto out;
     }

+ 1 - 1
zebra/irdp_packet.c

@@ -287,7 +287,7 @@ send_packet(struct interface *ifp,
   if (!(ifp->flags & IFF_UP))
     return;
 
-  if (!p) 
+  if (p)
     src = ntohl(p->u.prefix4.s_addr);
   else 
     src = 0; /* Is filled in */