routing: fix use-after-free в route_ping_cancel_for_conn (чтение request_id после u_free) + формат %08x

src/routing_layer/route_ping.c

@@ -120,24 +120,24 @@ void route_ping_cancel_for_conn(struct NAT_DETECTION* nd, struct ETCP_CONN* conn
         struct route_ping_pending* p = *cur;
         struct nat_check_arg* na = (struct nat_check_arg*)p->arg;
 
-        DEBUG_DEBUG(DEBUG_CATEGORY_BGP, "  checking pending req_id=%016llx via=%s link->etcp=%s",
+        DEBUG_DEBUG(DEBUG_CATEGORY_BGP, "  checking pending req_id=%08x via=%s link->etcp=%s",
                     (unsigned)p->request_id,
                     p->via_conn ? p->via_conn->log_name : "NULL",
                     (na && na->link && na->link->etcp) ? na->link->etcp->log_name : "NULL");
 
         if ((na && na->link && na->link->etcp == conn) || p->via_conn == conn) {
             *cur = p->next;
+            uint32_t rid = p->request_id;
             if (p->timeout_timer) {
                 uasync_cancel_timeout(nd->inst->ua, p->timeout_timer);
                 p->timeout_timer = NULL;
             }
             p->cancelled = 1;
-            na->link = NULL;
+            if (na) na->link = NULL;
             u_free(na);
             u_free(p);
             cancelled++;
-            DEBUG_INFO(DEBUG_CATEGORY_BGP, "cancel_for_conn: cancelled req_id=%016llx",
+            DEBUG_INFO(DEBUG_CATEGORY_BGP, "cancel_for_conn: cancelled req_id=%08x", (unsigned)rid);
-                       (unsigned)p->request_id);
         } else {
             cur = &(*cur)->next;
         }