X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec_tun.c;h=23598b7b085c9b11d59e4bf5973eb50043132ae3;hb=59f71132e;hp=07dd9ea409bf22abe1bdc3d495db38a46cd0ae07;hpb=8d6d74cdf43d7560eab3cf609cab27e5deb816e0;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec_tun.c b/src/vnet/ipsec/ipsec_tun.c
index 07dd9ea409b..23598b7b085 100644
--- a/src/vnet/ipsec/ipsec_tun.c
+++ b/src/vnet/ipsec/ipsec_tun.c
@@ -626,6 +626,12 @@ ipsec_tun_protect_update (u32 sw_if_index,
 	    format_vnet_sw_if_index_name, vnet_get_main (), sw_if_index,
 	    format_ip_address, nh);
 
+  if (vec_len (sas_in) > ITP_MAX_N_SA_IN)
+    {
+      rv = VNET_API_ERROR_LIMIT_EXCEEDED;
+      goto out;
+    }
+
   rv = 0;
   im = &ipsec_main;
   if (NULL == nh)
@@ -811,8 +817,8 @@ static void
 ipsec_tun_protect_adj_delegate_adj_deleted (adj_delegate_t * ad)
 {
   /* remove our delegate */
-  adj_delegate_remove (ad->ad_adj_index, ipsec_tun_adj_delegate_type);
   ipsec_tun_protect_add_adj (ad->ad_adj_index, INDEX_INVALID);
+  adj_delegate_remove (ad->ad_adj_index, ipsec_tun_adj_delegate_type);
 }
 
 static void