Possible bugs in ns-2.1b4

[Urs Thuermann <thuerman@ibr.cs.tu-bs.de>]

Reading some source of ns-2.1b4 I've found two possible bugs:

1. The function

	int Queue::length()

   is not virtual, so that when I have a pointer Queue *p that in fact
   points to a DRR Queue, when doing

	p->length();

   this unexpectedly calls Queue::length() instead of DRR::length().

   Or is this behavior intended?

2. In DropTail and RED that command "packetqueue-attach" can leave the
   queue in an incosistent state.  The code is (in {drop-tail,red}.cc):

	if (!strcmp(argv[1], "packetqueue-attach")) {
		delete q_;
		if (!(q_ = (PacketQueue*) TclObject::lookup(argv[2])))
			return (TCL_ERROR);
		else {
			pq_ = q_;
			return (TCL_OK);
		}
	}

   When the TclObject::lookup() fails the pointer q_ is NULL but pq_,
   inherited from the Queue class, still points to the old PacketQueue
   which has already been deleted though.  When calling the length()
   member function on the DropTail or RED object, Queue::length() will
   access *pq_ which is invalid.


urs