[vnetorch] fix use-after-free in removeBfdSession() (#2366)

* using a copy of monitor ip instead of a reference since the reference gets invalidated after the endpoint is erased Signed-off-by: Yakiv Huryk <yhuryk@nvidia.com>
sonic-net · Jul 5, 2022 · e84a901 · e84a901
1 parent 639d10e
commit e84a901
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/orchagent/vnetorch.cpp b/orchagent/vnetorch.cpp
@@ -1579,7 +1579,8 @@ void VNetRouteOrch::delEndpointMonitor(const string& vnet, NextHopGroupKey& next
         if (nexthop_info_[vnet].find(ip) != nexthop_info_[vnet].end()) {
             if (--nexthop_info_[vnet][ip].ref_count == 0)
             {
-                removeBfdSession(vnet, nhk, nexthop_info_[vnet][ip].monitor_addr);
+                IpAddress monitor_addr = nexthop_info_[vnet][ip].monitor_addr;
+                removeBfdSession(vnet, nhk, monitor_addr);
             }
         }
     }