diff options
| author | Pavel Tvrdik <pawel.tvrdik@gmail.com> | 2016-09-08 13:45:36 +0200 |
|---|---|---|
| committer | Ondrej Zajicek (work) <santiago@crfreenet.org> | 2016-09-15 16:18:32 +0200 |
| commit | 0f5054f6850c7419933a6337a34263f565663ee3 (patch) | |
| tree | 27df9c4296a0d465894cd92a8e4301d2bf44a53e /proto/bfd/io.c | |
| parent | a290da25a16b7c79d4a7a87f522b4068bca04979 (diff) | |
BFD: Fix invalid read from pollfd array
It is possible that sockets_add() are called between sockets_prepare()
and sockets_fire() during poll loop in birdloop_main(), so we need to
use loop->poll_fd.used instead of loop->sock_num to find the last field.
Diffstat (limited to 'proto/bfd/io.c')
| -rw-r--r-- | proto/bfd/io.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/proto/bfd/io.c b/proto/bfd/io.c index 79ed9af7..8f4f5007 100644 --- a/proto/bfd/io.c +++ b/proto/bfd/io.c @@ -589,7 +589,7 @@ sockets_fire(struct birdloop *loop) times_update(loop); /* Last fd is internal wakeup fd */ - if (pfd[loop->sock_num].revents & POLLIN) + if (pfd[poll_num].revents & POLLIN) wakeup_drain(loop); int i; |