commit 4310d505a7705022490bac64222121daf194e510
author Vince Lehman <vslehman@memphis.edu> Fri Mar 04 11:58:59 2016 -0600
committer Vince Lehman <vslehman@memphis.edu> Mon Mar 07 11:08:29 2016 -0600
tree 3a1514d321b6c79bfc874d22422844e041fc871e
parent d5fe0cf1584274a4cbfcef52e6386b9faa2c313a

rib: Fix use-after-free in RibEntry::getRouteWithSecondLowestCostByFaceId

refs: #3319

Change-Id: I7c6aeb541a7cd7d83965a87e50be1a0bdf633a2e

rib/rib-entry.cpp

diff --git a/rib/rib-entry.cpp b/rib/rib-entry.cpp
index 39c27d0..64e7195 100644
--- a/rib/rib-entry.cpp
+++ b/rib/rib-entry.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /**
- * Copyright (c) 2014-2015,  Regents of the University of California,
+ * Copyright (c) 2014-2016,  Regents of the University of California,
  *                           Arizona Board of Regents,
  *                           Colorado State University,
  *                           University Pierre & Marie Curie, Sorbonne University,
@@ -200,22 +200,25 @@
 const Route*
 RibEntry::getRouteWithSecondLowestCostByFaceId(uint64_t faceId) const
 {
-  std::vector<Route> matches;
+  std::vector<const Route*> matches;
 
   // Copy routes which have faceId
-  std::copy_if(m_routes.begin(), m_routes.end(), std::back_inserter(matches),
-    [faceId] (const Route& route) { return route.faceId == faceId; });
+  for (const Route& route : m_routes) {
+    if (route.faceId == faceId) {
+      matches.push_back(&route);
+    }
+  }
 
-  // If there are not at least 2 routes, there is no second lowest
+  // If there are less than 2 routes, there is no second lowest
   if (matches.size() < 2) {
     return nullptr;
   }
 
   // Get second lowest cost
   std::nth_element(matches.begin(), matches.begin() + 1, matches.end(),
-    [] (const Route& lhs, const Route& rhs) { return lhs.cost < rhs.cost; });
+    [] (const Route* lhs, const Route* rhs) { return lhs->cost < rhs->cost; });
 
-  return &matches.at(1);
+  return matches.at(1);
 }
 
 const Route*