commit e94804bd48628672b61a81cf1c3825e788ab5beb
author Davide Pesavento <davide.pesavento@lip6.fr> Mon Sep 19 17:23:21 2016 +0000
committer Junxiao Shi <git@mail1.yoursunny.com> Mon Sep 19 17:23:21 2016 +0000
tree d55b8c83706c99ae1bb463be4962de9af3bc43f2
parent e342e8de705b256b2f462fffacf1d0fb9e8edec4

rib: fix use-after-free in Rib::erase and RibManagerFixture::clearRib

Change-Id: Ia4c2211f6c48d852e3b73dc84e298d26ad14f708
Refs: #3787

rib/rib.cpp

diff --git a/rib/rib.cpp b/rib/rib.cpp
index 4c4d3c5..eb577bb 100644
--- a/rib/rib.cpp
+++ b/rib/rib.cpp
@@ -1,6 +1,6 @@
 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
 /**
- * Copyright (c) 2014-2015,  Regents of the University of California,
+ * Copyright (c) 2014-2016,  Regents of the University of California,
  *                           Arizona Board of Regents,
  *                           Colorado State University,
  *                           University Pierre & Marie Curie, Sorbonne University,
@@ -162,21 +162,21 @@
 
   // Name prefix exists
   if (ribIt != m_rib.end()) {
-    shared_ptr<RibEntry> entry(ribIt->second);
-
+    shared_ptr<RibEntry> entry = ribIt->second;
     RibEntry::iterator routeIt = entry->findRoute(route);
 
     if (routeIt != entry->end()) {
+      auto faceId = route.faceId;
       entry->eraseRoute(routeIt);
       m_nItems--;
 
       // If this RibEntry no longer has this faceId, unregister from face lookup table
-      if (!entry->hasFaceId(route.faceId)) {
-        m_faceMap[route.faceId].remove(entry);
+      if (!entry->hasFaceId(faceId)) {
+        m_faceMap[faceId].remove(entry);
       }
 
       // If a RibEntry's route list is empty, remove it from the tree
-      if (entry->getRoutes().size() == 0) {
+      if (entry->getRoutes().empty()) {
         eraseEntry(ribIt);
       }
     }