LISTNODE_DETACH doesn't clear out the node, and LISTNODE_ATTACH doesn't
set ->next (since it assumes a fresh/zeroed listnode).  As a result, the
new listnode_move_to_tail() created a nice circular list, in turn
crashing ospfd in ospf_write() later.

Reported-by: Martin Winter <[email protected]>
Fixes: 6d83113 ("ospfd: Tweak previous iface RR write patch to avoid 
free/malloc & redundant log")
Cc: Paul Jakma <[email protected]>
Signed-off-by: David Lamparter <[email protected]>
---
One more fix...
... will push relatively quickly.

-David
---
 lib/linklist.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/linklist.h b/lib/linklist.h
index c8d715e..6209c8b 100644
--- a/lib/linklist.h
+++ b/lib/linklist.h
@@ -113,6 +113,7 @@ extern void list_add_list (struct list *, struct list *);
 #define LISTNODE_ATTACH(L,N) \
   do { \
     (N)->prev = (L)->tail; \
+    (N)->next = NULL; \
     if ((L)->head == NULL) \
       (L)->head = (N); \
     else \
-- 
2.0.4


_______________________________________________
Quagga-dev mailing list
[email protected]
https://lists.quagga.net/mailman/listinfo/quagga-dev

Reply via email to