BFD: Fix invalid read from pollfd array

It is possible that sockets_add() are called between sockets_prepare()
and sockets_fire() during poll loop in birdloop_main(), so we need to
use loop->poll_fd.used instead of loop->sock_num to find the last field.

diff --git a/proto/bfd/io.c b/proto/bfd/io.c
index 79ed9af71e03e793921123af5d7309f9780bf992..8f4f50074c4d1248a7540ec87b2e912567629511 100644 (file)
--- a/proto/bfd/io.c
+++ b/proto/bfd/io.c
@@ -589,7 +589,7 @@ sockets_fire(struct birdloop *loop)
   times_update(loop);
 
   /* Last fd is internal wakeup fd */
-  if (pfd[loop->sock_num].revents & POLLIN)
+  if (pfd[poll_num].revents & POLLIN)
     wakeup_drain(loop);
 
   int i;