From: Maria Matejka <mq@ucw.cz>
Date: Tue, 16 Sep 2025 12:09:21 +0000 (+0200)
Subject: fixup! ROA Aggregator: Fix crash on multiwithdraw
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fheads%2F304-crash-roa-multiwithdraw;p=thirdparty%2Fbird.git

fixup! ROA Aggregator: Fix crash on multiwithdraw
---

diff --git a/nest/rt-table.c b/nest/rt-table.c
index 66d3ce75c..259b559f5 100644
--- a/nest/rt-table.c
+++ b/nest/rt-table.c
@@ -562,7 +562,10 @@ rt_aggregate_roa(void *_rag)
 	if (rad->u[p].max_pxlen > max_pxlen)
 	  break;
 	else if (rad->u[p].max_pxlen == max_pxlen)
+	{
 	  found = true;
+	  break;
+	}
 
     /* Found, no withdraw, nothing to do */
     if (found && !withdraw)
@@ -576,13 +579,15 @@ rt_aggregate_roa(void *_rag)
     }
 
     /* Allocate the new list. We expect it to be short. */
-    struct rt_roa_aggregated_adata *rad_new = tmp_alloc(sizeof *rad_new + (count + !withdraw) * sizeof rad_new->u[0]);
+    struct rt_roa_aggregated_adata *rad_new = tmp_alloc(sizeof *rad_new + (count + 1) * sizeof rad_new->u[0]);
 
     if (found && withdraw)
     {
       /* Found, withdraw */
+      count--;
+
       memcpy(&rad_new->u[0], &rad->u[0], p * sizeof rad->u[0]);
-      memcpy(&rad_new->u[p], &rad->u[p+1], (count - p - 1) * sizeof rad->u[0]);
+      memcpy(&rad_new->u[p], &rad->u[p+1], (count - p) * sizeof rad->u[0]);
     }
     else
     {
@@ -593,6 +598,8 @@ rt_aggregate_roa(void *_rag)
 
       rad_new->u[p].asn = asn;
       rad_new->u[p].max_pxlen = max_pxlen;
+
+      count++;
     }
 
     /* Finalize the adata */