From: Benoît Ganne <bganne@cisco.com>
Date: Thu, 16 Apr 2020 10:38:48 +0000 (+0200)
Subject: fib: fix use-after-free
X-Git-Tag: v20.09-rc0~199
X-Git-Url: https://gerrit.fd.io/r/gitweb?p=vpp.git;a=commitdiff_plain;h=95eb01fdc65b692065ace6d76870d8cc9f3e2c84

fib: fix use-after-free

Type: fix

Change-Id: Ie7081d977dd0d3e7d09bc0d1b4d53863288e443b
Signed-off-by: Benoît Ganne <bganne@cisco.com>
---

diff --git a/src/vnet/mfib/mfib_entry.c b/src/vnet/mfib/mfib_entry.c
index 448e6c5e0a8..c08565d966c 100644
--- a/src/vnet/mfib/mfib_entry.c
+++ b/src/vnet/mfib/mfib_entry.c
@@ -1144,18 +1144,18 @@ mfib_entry_path_remove (fib_node_index_t mfib_entry_index,
                 mfib_entry_itf_remove(msrc, rpath->frp_sw_if_index);
             }
         }
-
-        if (mfib_entry_src_ok_for_delete(msrc))
-        {
-            /*
-             * this source has no interfaces and no flags.
-             * it has nothing left to give - remove it
-             */
-            mfib_entry_src_remove(mfib_entry, source);
-        }
     }
     vec_free(path_indices);
 
+    if (mfib_entry_src_ok_for_delete(msrc))
+      {
+        /*
+         * this source has no interfaces and no flags.
+         * it has nothing left to give - remove it
+         */
+        mfib_entry_src_remove(mfib_entry, source);
+      }
+
     mfib_entry_recalculate_forwarding(mfib_entry, current_best);
 
     return (mfib_entry_ok_for_delete(mfib_entry));
@@ -1491,7 +1491,8 @@ mfib_entry_contribute_forwarding (fib_node_index_t mfib_entry_index,
             /*
              * caller does not want the local paths that the entry has
              */
-            dpo_set(dpo, DPO_REPLICATE, rep->rep_proto,
+            dpo_proto_t rep_proto = rep->rep_proto;
+            dpo_set(dpo, DPO_REPLICATE, rep_proto,
                     replicate_dup(REPLICATE_FLAGS_NONE,
                                   mfib_entry->mfe_rep.dpoi_index));
         }