Re: ripd(8) use after free

2017-01-11 Thread Jeremie Courreges-Anglas
Jeremie Courreges-Anglas writes: > Claudio Jeker writes: > >> On Fri, Dec 23, 2016 at 04:16:11PM +0100, Jeremie Courreges-Anglas wrote: >>> >>> In the neighbor fsm, NBR_ACT_DEL frees the neighbor structure. But >>> fields of this structure are later accessed, this is mostly visible with >>> de

Re: ripd(8) use after free

2016-12-27 Thread Jeremie Courreges-Anglas
Claudio Jeker writes: > On Fri, Dec 23, 2016 at 04:16:11PM +0100, Jeremie Courreges-Anglas wrote: >> >> In the neighbor fsm, NBR_ACT_DEL frees the neighbor structure. But >> fields of this structure are later accessed, this is mostly visible with >> debug output: >> >> nbr_del: neighbor ID 10.

Re: ripd(8) use after free

2016-12-27 Thread Claudio Jeker
On Fri, Dec 23, 2016 at 04:16:11PM +0100, Jeremie Courreges-Anglas wrote: > > In the neighbor fsm, NBR_ACT_DEL frees the neighbor structure. But > fields of this structure are later accessed, this is mostly visible with > debug output: > > nbr_del: neighbor ID 10.64.55.33, peerid 3 > nbr_fsm: ev

ripd(8) use after free

2016-12-23 Thread Jeremie Courreges-Anglas
In the neighbor fsm, NBR_ACT_DEL frees the neighbor structure. But fields of this structure are later accessed, this is mostly visible with debug output: nbr_del: neighbor ID 10.64.55.33, peerid 3 nbr_fsm: event 'RESPONSE SENT' resulted in action 'DELETE NBR' and changing state for neighbor ID