latent bug in rip

[karn@thumper.bellcore.com (Phil R. Karn)]

I just found and fixed a long-latent bug in RIP that caused crashes when
RIP default routes were received.

The problem is actually in iproute.c, in the function rt_blookup(),
which is used by rip to look up an entry in the routing table with
a specific number of significant bits. The problem was that when
the bits parameter is 0 (i.e., the default route is referenced) and
the default route was not set, a garbage pointer was returned.

The beginning of the function should now read

        if(bits == 0){
                if(R_default.iface != NULLIF)
                        return &R_default;
                else
                        return NULLROUTE;
        }
        /* Mask off target according to width */

What's funny about this is that the garbage pointer returned changed
recently when I changed the hash table modulus, so something else has
been getting clobbered all this time but it never seemed to cause
immediate problems...

Phil