BIRD crashing when disabled OSPF protocol state is requested

23 Jan 2014

      Hi,

I think I found a bug in BIRD (tested with versions 1.3.9 and 1.4.0).
When OSPF state is requested for a disabled OSPF protocol, the BIRD
process segfaults.

Steps to reproduce:

1. use this bird.conf:
----cut here----
protocol device {
        scan time 10;
}

protocol kernel {
        persist;
}

protocol ospf something {
        disabled;
        area 0.0.0.0 {
                interface "dummy*";
        };
}
----cut here----

2. run bird

3. query for protocol state:
   # birdc show ospf state something

4. BIRD crashes

I guess there is some null-pointer dereference in the ospf_sh_state
function.

Regards,

Ondřej Caletka,
CESNET