Merge pull request #18254 from LabNConsulting/aceelindem/ospf6-abr-ca…

…lc-addr-sanity ospf6d: Fix use after free of router in OSPFv3 ABR route calculation.
FRRouting · Feb 26, 2025 · 598eaf3 · 598eaf3
2 parents 62c0f3a + 06af50e
commit 598eaf3
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/ospf6d/ospf6_intra.c b/ospf6d/ospf6_intra.c
@@ -2194,9 +2194,15 @@ void ospf6_intra_brouter_calculation(struct ospf6_area *oa)
 				zlog_info("%s: brouter %s appears via area %s",
 					  __func__, brouter_name, oa->name);
 
+			ospf6_route_lock(brouter);
 			/* newly added */
 			if (hook_add)
 				(*hook_add)(brouter);
+			if (CHECK_FLAG(brouter->flag, OSPF6_ROUTE_WAS_REMOVED)) {
+				ospf6_route_unlock(brouter);
+				brouter = NULL;
+			} else
+				ospf6_route_unlock(brouter);
 		} else {
 			if (IS_OSPF6_DEBUG_BROUTER_SPECIFIC_ROUTER_ID(
 				    brouter_id)