EFence helped to find using of already free rte's in rt_prune().

diff --git a/nest/rt-table.c b/nest/rt-table.c
index 621a8353a6b89dce81ca9fd4ea1790469df8acab..4da6807acc32a50fdb87f5d90b2a3d3763d62349 100644 (file)
--- a/nest/rt-table.c
+++ b/nest/rt-table.c
@@ -328,11 +328,13 @@ rt_prune(rtable *tab)
          net *n = (net *) f;
          rte *e;
          ncnt++;
+       rescan:
          for (e=n->routes; e; e=e->next, rcnt++)
            if (e->attrs->proto->core_state != FS_HAPPY)
              {
                rte_discard(e);
                rdel++;
+               goto rescan;
              }
          if (!n->routes)               /* Orphaned FIB entry? */
            {