August 2020 - dev - lists.frrouting.org

FRR Slack is sponsored!
by Donald Sharp 27 Aug '20

27 Aug '20

All - VyOS( https://www.vyos.io/ ) has graciously decided to sponsor our slack. This will allow all of us to go back and read the 500k+ messages that have accumulated over the last couple of years as well as have some more interesting integrations with other applications in the future. I would like to take a second and thank the VyOS team for this support of our Community! thanks! donald

3 2

Northbound weekly meeting
by Santosh P K 27 Aug '20

27 Aug '20

1 0

Northbound weekly meeting
by Santosh P K 27 Aug '20

27 Aug '20

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 27 Aug '20

27 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 9 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 8 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 9 of 9 defect(s) ** CID 1496729: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 266 in ecommunity_dup() /bgpd/bgp_ecommunity.c: 268 in ecommunity_dup() ________________________________________________________________________________________________________ *** CID 1496729: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 266 in ecommunity_dup() 260 struct ecommunity *new; 261 262 new = XCALLOC(MTYPE_ECOMMUNITY, sizeof(struct ecommunity)); 263 new->size = ecom->size; 264 new->unit_size = ecom->unit_size; 265 if (new->size) { >>> CID 1496729: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 266 new->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 267 ecom->size * ecom->unit_size); 268 memcpy(new->val, ecom->val, ecom->size * ecom->unit_size); 269 } else 270 new->val = NULL; 271 return new; /bgpd/bgp_ecommunity.c: 268 in ecommunity_dup() 262 new = XCALLOC(MTYPE_ECOMMUNITY, sizeof(struct ecommunity)); 263 new->size = ecom->size; 264 new->unit_size = ecom->unit_size; 265 if (new->size) { 266 new->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 267 ecom->size * ecom->unit_size); >>> CID 1496729: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 268 memcpy(new->val, ecom->val, ecom->size * ecom->unit_size); 269 } else 270 new->val = NULL; 271 return new; 272 } 273 ** CID 1496728: Resource leaks (RESOURCE_LEAK) /pimd/pim_igmp.c: 1016 in pim_igmp_sock_add() ________________________________________________________________________________________________________ *** CID 1496728: Resource leaks (RESOURCE_LEAK) /pimd/pim_igmp.c: 1016 in pim_igmp_sock_add() 1010 sin.sin_family = AF_INET; 1011 sin.sin_addr = ifaddr; 1012 sin.sin_port = 0; 1013 if (bind(fd, (struct sockaddr *) &sin, sizeof(sin)) != 0) { 1014 zlog_warn("Could not bind IGMP socket for %s on %s", 1015 inet_ntoa(ifaddr), ifp->name); >>> CID 1496728: Resource leaks (RESOURCE_LEAK) >>> Handle variable "fd" going out of scope leaks the handle. 1016 return 0; 1017 } 1018 1019 igmp = igmp_sock_new(fd, ifaddr, ifp, mtrace_only); 1020 1021 igmp_read_on(igmp); ** CID 1496727: (FORWARD_NULL) /bgpd/bgp_zebra.c: 2377 in bgp_encode_pbr_rule_action() /bgpd/bgp_zebra.c: 2408 in bgp_encode_pbr_rule_action() ________________________________________________________________________________________________________ *** CID 1496727: (FORWARD_NULL) /bgpd/bgp_zebra.c: 2377 in bgp_encode_pbr_rule_action() 2371 * - FS PBR entries based on iprule 2372 * the latter may contain default routing information injected by FS 2373 */ 2374 if (pbr) 2375 stream_putl(s, pbr->unique); 2376 else >>> CID 1496727: (FORWARD_NULL) >>> Dereferencing null pointer "pbra". 2377 stream_putl(s, pbra->unique); 2378 if (pbr && pbr->flags & MATCH_IP_SRC_SET) 2379 memcpy(&pfx, &(pbr->src), sizeof(struct prefix)); 2380 else { 2381 memset(&pfx, 0, sizeof(pfx)); 2382 pfx.family = fam; /bgpd/bgp_zebra.c: 2408 in bgp_encode_pbr_rule_action() 2402 /* if pbr present, fwmark is not used */ 2403 if (pbr) 2404 stream_putl(s, 0); 2405 else 2406 stream_putl(s, pbra->fwmark); /* fwmark */ 2407 >>> CID 1496727: (FORWARD_NULL) >>> Dereferencing null pointer "pbra". 2408 stream_putl(s, pbra->table_id); 2409 2410 stream_putl(s, 0); /* ifindex unused */ 2411 } 2412 2413 static void bgp_encode_pbr_ipset_match(struct stream *s, ** CID 1496726: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1234 in ecommunity_strip() ________________________________________________________________________________________________________ *** CID 1496726: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1234 in ecommunity_strip() 1228 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); 1229 ecom->size = 0; 1230 return true; 1231 } 1232 1233 /* Strip matching ext community(ies). */ >>> CID 1496726: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - found) * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - found) * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1234 new = XMALLOC(MTYPE_ECOMMUNITY_VAL, 1235 (ecom->size - found) * ecom->unit_size); 1236 q = new; 1237 for (c = 0, p = ecom->val; c < ecom->size; c++, p += ecom->unit_size) { 1238 if (!(p[0] == type && p[1] == subtype)) { 1239 memcpy(q, p, ecom->unit_size); ** CID 1496725: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 294 in ecommunity_merge() /bgpd/bgp_ecommunity.c: 289 in ecommunity_merge() /bgpd/bgp_ecommunity.c: 299 in ecommunity_merge() ________________________________________________________________________________________________________ *** CID 1496725: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 294 in ecommunity_merge() 288 ecom1->val = 289 XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom1->val, 290 (ecom1->size + ecom2->size) * 291 ecom1->unit_size); 292 else 293 ecom1->val = >>> CID 1496725: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom1->size + ecom2->size) * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom1->size + ecom2->size) * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 294 XMALLOC(MTYPE_ECOMMUNITY_VAL, 295 (ecom1->size + ecom2->size) * 296 ecom1->unit_size); 297 298 memcpy(ecom1->val + (ecom1->size * ecom1->unit_size), ecom2->val, 299 ecom2->size * ecom1->unit_size); /bgpd/bgp_ecommunity.c: 289 in ecommunity_merge() 283 /* Merge two Extended Communities Attribute structure. */ 284 struct ecommunity *ecommunity_merge(struct ecommunity *ecom1, 285 struct ecommunity *ecom2) 286 { 287 if (ecom1->val) 288 ecom1->val = >>> CID 1496725: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom1->size + ecom2->size) * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom1->size + ecom2->size) * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 289 XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom1->val, 290 (ecom1->size + ecom2->size) * 291 ecom1->unit_size); 292 else 293 ecom1->val = 294 XMALLOC(MTYPE_ECOMMUNITY_VAL, /bgpd/bgp_ecommunity.c: 299 in ecommunity_merge() 293 ecom1->val = 294 XMALLOC(MTYPE_ECOMMUNITY_VAL, 295 (ecom1->size + ecom2->size) * 296 ecom1->unit_size); 297 298 memcpy(ecom1->val + (ecom1->size * ecom1->unit_size), ecom2->val, >>> CID 1496725: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom2->size * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom2->size * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 299 ecom2->size * ecom1->unit_size); 300 ecom1->size += ecom2->size; 301 302 return ecom1; 303 } 304 ** CID 1496724: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1275 in ecommunity_del_val() /bgpd/bgp_ecommunity.c: 1273 in ecommunity_del_val() /bgpd/bgp_ecommunity.c: 1279 in ecommunity_del_val() ________________________________________________________________________________________________________ *** CID 1496724: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1275 in ecommunity_del_val() 1269 return false; 1270 1271 /* Delete the selected value */ 1272 ecom->size--; 1273 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1274 if (c != 0) >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "c * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "c * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1275 memcpy(p, ecom->val, c * ecom->unit_size); 1276 if ((ecom->size - c) != 0) 1277 memcpy(p + (c)*ecom->unit_size, 1278 ecom->val + (c + 1) * ecom->unit_size, 1279 (ecom->size - c) * ecom->unit_size); 1280 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); /bgpd/bgp_ecommunity.c: 1273 in ecommunity_del_val() 1267 } 1268 if (found == 0) 1269 return false; 1270 1271 /* Delete the selected value */ 1272 ecom->size--; >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1273 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1274 if (c != 0) 1275 memcpy(p, ecom->val, c * ecom->unit_size); 1276 if ((ecom->size - c) != 0) 1277 memcpy(p + (c)*ecom->unit_size, 1278 ecom->val + (c + 1) * ecom->unit_size, /bgpd/bgp_ecommunity.c: 1279 in ecommunity_del_val() 1273 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1274 if (c != 0) 1275 memcpy(p, ecom->val, c * ecom->unit_size); 1276 if ((ecom->size - c) != 0) 1277 memcpy(p + (c)*ecom->unit_size, 1278 ecom->val + (c + 1) * ecom->unit_size, >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - c) * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - c) * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1279 (ecom->size - c) * ecom->unit_size); 1280 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); 1281 ecom->val = p; 1282 return true; 1283 } 1284 ** CID 1496723: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 162 in ecommunity_add_val_internal() /bgpd/bgp_ecommunity.c: 156 in ecommunity_add_val_internal() /bgpd/bgp_ecommunity.c: 104 in ecommunity_add_val_internal() ________________________________________________________________________________________________________ *** CID 1496723: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 162 in ecommunity_add_val_internal() 156 ecom->val = XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom->val, 157 ecom_length_size(ecom, ecom_size)); 158 159 160 memmove(ecom->val + ((ins_idx + 1) * ecom_size), 161 ecom->val + (ins_idx * ecom_size), >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - 1 - ins_idx) * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - 1 - ins_idx) * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 162 (ecom->size - 1 - ins_idx) * ecom_size); 163 memcpy(ecom->val + (ins_idx * ecom_size), 164 eval, ecom_size); 165 166 return true; 167 } /bgpd/bgp_ecommunity.c: 156 in ecommunity_add_val_internal() 150 151 if (ins_idx == -1) 152 ins_idx = c; 153 154 /* Add the value to the structure with numerical sorting. */ 155 ecom->size++; >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 156 ecom->val = XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom->val, 157 ecom_length_size(ecom, ecom_size)); 158 159 160 memmove(ecom->val + ((ins_idx + 1) * ecom_size), 161 ecom->val + (ins_idx * ecom_size), /bgpd/bgp_ecommunity.c: 104 in ecommunity_add_val_internal() 98 const struct ecommunity_val_ipv6 *eval6 = 99 (struct ecommunity_val_ipv6 *)eval; 100 101 /* When this is fist value, just add it. */ 102 if (ecom->val == NULL) { 103 ecom->size = 1; >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 104 ecom->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 105 ecom_length_size(ecom, ecom_size)); 106 memcpy(ecom->val, eval, ecom_size); 107 return true; 108 } 109 ** CID 1496722: Incorrect expression (USELESS_CALL) ________________________________________________________________________________________________________ *** CID 1496722: Incorrect expression (USELESS_CALL) /bgpd/bgp_flowspec_vty.c: 276 in route_vty_out_flowspec() 270 char timebuf[BGP_UPTIME_LEN]; 271 struct bgp_dest *dest = NULL; 272 273 if (path) 274 dest = path->net; 275 if (dest) >>> CID 1496722: Incorrect expression (USELESS_CALL) >>> Calling "bgp_dest_get_bgp_table_info(dest)" is only useful for its return value, which is ignored. 276 bgp_dest_get_bgp_table_info(dest); 277 if (p == NULL || p->family != AF_FLOWSPEC) 278 return; 279 if (json_paths) { 280 if (display == NLRI_STRING_FORMAT_JSON) 281 json_nlri_path = json_object_new_object(); ** CID 1496721: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 367 in ecommunity_cmp() ________________________________________________________________________________________________________ *** CID 1496721: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 367 in ecommunity_cmp() 361 return false; 362 363 if (ecom1->unit_size != ecom2->unit_size) 364 return false; 365 366 return (ecom1->size == ecom2->size >>> CID 1496721: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t const" (8 bits, unsigned) is promoted in "ecom1->size * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom1->size * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 367 && memcmp(ecom1->val, ecom2->val, ecom1->size * 368 ecom1->unit_size) == 0); 369 } 370 371 /* Initialize Extended Comminities related hash. */ 372 void ecommunity_init(void) ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 26 Aug '20

26 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 58 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 58 defect(s) ** CID 1496712: Incorrect expression (IDENTICAL_BRANCHES) /ospfd/ospf_ext.c: 589 in ospf_ext_link_delete_adj_sid() ________________________________________________________________________________________________________ *** CID 1496712: Incorrect expression (IDENTICAL_BRANCHES) /ospfd/ospf_ext.c: 589 in ospf_ext_link_delete_adj_sid() 583 { 584 /* Process only (LAN)Adjacency-SID Type */ 585 if (exti->stype != ADJ_SID && exti->stype != LAN_ADJ_SID) 586 return; 587 588 /* Release Primary & Backup Labels from Label Manager */ >>> CID 1496712: Incorrect expression (IDENTICAL_BRANCHES) >>> The same code is executed regardless of whether "exti->stype == ADJ_SID" is true, because the 'then' and 'else' branches are identical. Should one of the branches be modified, or the entire 'if' statement replaced? 589 if (exti->stype == ADJ_SID) { 590 ospf_sr_local_block_release_label(exti->adj_sid[0].value); 591 ospf_sr_local_block_release_label(exti->adj_sid[1].value); 592 } else { 593 ospf_sr_local_block_release_label(exti->adj_sid[0].value); 594 ospf_sr_local_block_release_label(exti->adj_sid[1].value); ** CID 1496711: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496711: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2319 in no_sr_node_msd() 2313 OspfSR.msd = 0; 2314 if (OspfSR.self != NULL) 2315 OspfSR.self->msd = 0; 2316 2317 /* Set Router Information parameters if SR is UP */ 2318 if (OspfSR.status == SR_UP) >>> CID 1496711: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2319 ospf_router_info_update_sr(true, OspfSR.self); 2320 2321 return CMD_SUCCESS; 2322 } 2323 2324 DEFUN (sr_prefix_sid, ** CID 1496710: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496710: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2078 in update_srgb() 2072 OspfSR.srgb.reserved = true; 2073 2074 osr_debug("SR(%s): Got new SRGB [%u/%u]", __func__, OspfSR.srgb.start, 2075 OspfSR.srgb.start + OspfSR.srgb.size - 1); 2076 2077 /* SRGB is reserved, set Router Information parameters */ >>> CID 1496710: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2078 ospf_router_info_update_sr(true, OspfSR.self); 2079 2080 /* and update NHLFE entries */ 2081 hash_iterate(OspfSR.neighbors, 2082 (void (*)(struct hash_bucket *, void *))update_in_nhlfe, 2083 NULL); ** CID 1496709: Control flow issues (DEADCODE) /bgpd/bgp_vty.c: 12806 in bgp_show_all_instances_neighbors_vty() ________________________________________________________________________________________________________ *** CID 1496709: Control flow issues (DEADCODE) /bgpd/bgp_vty.c: 12806 in bgp_show_all_instances_neighbors_vty() 12800 json = NULL; 12801 } 12802 12803 if (use_json) { 12804 vty_out(vty, "}\n"); 12805 if (json) >>> CID 1496709: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "json_object_free(json);". 12806 json_object_free(json); 12807 } 12808 else if (!nbr_output) 12809 vty_out(vty, "%% BGP instance not found\n"); 12810 } 12811 ** CID 1496708: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496708: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2254 in no_sr_local_label_range() 2248 2249 /* SRLB is reserved, Update Self SR-Node and Router Information LSA */ 2250 if (OspfSR.self != NULL) { 2251 OspfSR.self->srlb.lower_bound = DEFAULT_SRLB_LABEL; 2252 OspfSR.self->srlb.range_size = DEFAULT_SRLB_SIZE; 2253 } >>> CID 1496708: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2254 ospf_router_info_update_sr(true, OspfSR.self); 2255 2256 /* and update (LAN)-Adjacency SID */ 2257 ospf_ext_link_srlb_update(); 2258 2259 return CMD_SUCCESS; ** CID 1496707: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496707: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2295 in sr_node_msd() 2289 OspfSR.msd = msd; 2290 if (OspfSR.self != NULL) 2291 OspfSR.self->msd = msd; 2292 2293 /* Set Router Information parameters if SR is UP */ 2294 if (OspfSR.status == SR_UP) >>> CID 1496707: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2295 ospf_router_info_update_sr(true, OspfSR.self); 2296 2297 return CMD_SUCCESS; 2298 } 2299 2300 DEFUN (no_sr_node_msd, ** CID 1496706: Performance inefficiencies (PASS_BY_VALUE) /ospfd/ospf_ri.c: 576 in is_mandated_params_set() ________________________________________________________________________________________________________ *** CID 1496706: Performance inefficiencies (PASS_BY_VALUE) /ospfd/ospf_ri.c: 576 in is_mandated_params_set() 570 | PCE_CAP_ADDITIVE | PCE_CAP_MULTIPLE_REQ; 571 set_pce_cap_flag(cap, &ori->pce_info); 572 573 return; 574 } 575 >>> CID 1496706: Performance inefficiencies (PASS_BY_VALUE) >>> Passing parameter ori of type "struct ospf_router_info" (size 136 bytes) by value. 576 static int is_mandated_params_set(struct ospf_router_info ori) 577 { 578 int rc = 0; 579 580 if (ntohs(ori.router_cap.header.type) == 0) 581 return rc; ** CID 1496643: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496643: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_evpn_mh.c: 362 in zebra_evpn_es_evi_show_vni() 356 vty_out(vty, "%-8s %-30s %-4s\n", "VNI", "ESI", "Type"); 357 } 358 } else { 359 if (!uj) 360 vty_out(vty, "VNI %d doesn't exist\n", vni); 361 } >>> CID 1496643: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "zevpn" to "zebra_evpn_es_evi_show_one_evpn", which dereferences it. 362 zebra_evpn_es_evi_show_one_evpn(zevpn, vty, json, detail); 363 } 364 365 /* Initialize the ES tables maintained per-L2_VNI */ 366 void zebra_evpn_evpn_es_init(zebra_evpn_t *zevpn) 367 { ** CID 1496642: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496642: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_route.c: 3073 in bgp_filtered_routes_count() 3067 3068 for (dest = bgp_table_top(table); dest; dest = bgp_route_next(dest)) { 3069 for (ain = dest->adj_in; ain; ain = ain->next) { 3070 const struct prefix *rn_p = bgp_dest_get_prefix(dest); 3071 struct attr attr = {}; 3072 >>> CID 1496642: Null pointer dereferences (FORWARD_NULL) >>> Passing "&attr" to "bgp_input_filter", which dereferences null "attr.aspath". 3073 if (bgp_input_filter(peer, rn_p, &attr, afi, safi) 3074 == FILTER_DENY) 3075 filtered = true; 3076 3077 if (bgp_input_modifier( 3078 peer, rn_p, &attr, afi, safi, ** CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) /zebra/zebra_evpn_mh.c: 1690 in zebra_evpn_es_cleanup() 1684 struct zebra_evpn_es *es; 1685 struct zebra_evpn_es *es_next; 1686 1687 RB_FOREACH_SAFE(es, zebra_es_rb_head, 1688 &zmh_info->es_rb_tree, es_next) { 1689 zebra_evpn_local_es_del(es); >>> CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "zebra_evpn_remote_es_flush" dereferences freed pointer "es". 1690 zebra_evpn_remote_es_flush(es); 1691 } 1692 } 1693 1694 /* Only certain types of access ports can be setup as an Ethernet Segment */ 1695 bool zebra_evpn_is_if_es_capable(struct zebra_if *zif) ** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 486 in seqnumber_mismatch() 480 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 481 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 482 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 483 484 ospf6_lsdb_remove_all(on->summary_list); 485 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 486 for (ALL_LSDB(on->retrans_list, lsa)) { 487 ospf6_decrement_retrans_count(lsa); 488 ospf6_lsdb_remove(lsa, on->retrans_list); 489 } 490 491 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2306 in ospf6_lsack_send_neighbor() 2300 2301 memset(sendbuf, 0, iobuflen); 2302 oh = (struct ospf6_header *)sendbuf; 2303 2304 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2305 >>> CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2306 for (ALL_LSDB(on->lsack_list, lsa)) { 2307 /* MTU check */ 2308 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2309 > ospf6_packet_max(on->ospf6_if)) { 2310 /* if we run out of packet size/space here, 2311 better to try again soon. */ ** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2223 in ospf6_lsupdate_send_interface() 2217 lsupdate = (struct ospf6_lsupdate *)((caddr_t)oh 2218 + sizeof(struct ospf6_header)); 2219 2220 p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 2221 lsa_cnt = 0; 2222 >>> CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2223 for (ALL_LSDB(oi->lsupdate_list, lsa)) { 2224 /* MTU check */ 2225 if ((p - sendbuf + ((unsigned int)OSPF6_LSA_SIZE(lsa->header))) 2226 > ospf6_packet_max(oi)) { 2227 if (lsa_cnt) { 2228 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; ** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 306 in ospf6_lsdb_remove_all() 300 { 301 struct ospf6_lsa *lsa; 302 303 if (lsdb == NULL) 304 return; 305 >>> CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 306 for (ALL_LSDB(lsdb, lsa)) 307 ospf6_lsdb_remove(lsa, lsdb); 308 } 309 310 void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa) 311 { ** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 125 in ospf6_neighbor_delete() 119 void ospf6_neighbor_delete(struct ospf6_neighbor *on) 120 { 121 struct ospf6_lsa *lsa; 122 123 ospf6_lsdb_remove_all(on->summary_list); 124 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 125 for (ALL_LSDB(on->retrans_list, lsa)) { 126 ospf6_decrement_retrans_count(lsa); 127 ospf6_lsdb_remove(lsa, on->retrans_list); 128 } 129 130 ospf6_lsdb_remove_all(on->dbdesc_list); ** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1872 in ospf6_dbdesc_send_newone() 1866 ospf6_lsdb_remove_all(on->dbdesc_list); 1867 1868 /* move LSAs from summary_list to dbdesc_list (within neighbor 1869 structure) 1870 so that ospf6_send_dbdesc () can send those LSAs */ 1871 size = sizeof(struct ospf6_lsa_header) + sizeof(struct ospf6_dbdesc); >>> CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 1872 for (ALL_LSDB(on->summary_list, lsa)) { 1873 if (size + sizeof(struct ospf6_lsa_header) 1874 > ospf6_packet_max(on->ospf6_if)) { 1875 ospf6_lsdb_lsa_unlock(lsa); 1876 break; 1877 } ** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 523 in bad_lsreq() 517 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 518 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 519 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 520 521 ospf6_lsdb_remove_all(on->summary_list); 522 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 523 for (ALL_LSDB(on->retrans_list, lsa)) { 524 ospf6_decrement_retrans_count(lsa); 525 ospf6_lsdb_remove(lsa, on->retrans_list); 526 } 527 528 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 310 in negotiation_done() 304 if (IS_OSPF6_DEBUG_NEIGHBOR(EVENT)) 305 zlog_debug("Neighbor Event %s: *NegotiationDone*", on->name); 306 307 /* clear ls-list */ 308 ospf6_lsdb_remove_all(on->summary_list); 309 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 310 for (ALL_LSDB(on->retrans_list, lsa)) { 311 ospf6_decrement_retrans_count(lsa); 312 ospf6_lsdb_remove(lsa, on->retrans_list); 313 } 314 315 /* Interface scoped LSAs */ ** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 324 in ospf6_lsdb_maxage_remover() 318 319 int ospf6_lsdb_maxage_remover(struct ospf6_lsdb *lsdb) 320 { 321 int reschedule = 0; 322 struct ospf6_lsa *lsa; 323 >>> CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 324 for (ALL_LSDB(lsdb, lsa)) { 325 if (!OSPF6_LSA_IS_MAXAGE(lsa)) 326 continue; 327 if (lsa->retrans_count != 0) { 328 reschedule = 1; 329 continue; ** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2385 in ospf6_lsack_send_interface() 2379 2380 memset(sendbuf, 0, iobuflen); 2381 oh = (struct ospf6_header *)sendbuf; 2382 2383 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2384 >>> CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2385 for (ALL_LSDB(oi->lsack_list, lsa)) { 2386 /* MTU check */ 2387 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2388 > ospf6_packet_max(oi)) { 2389 /* if we run out of packet size/space here, 2390 better to try again soon. */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 21 Aug '20

21 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 56 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1496687: Error handling issues (CHECKED_RETURN) /vrrpd/vrrp_packet.c: 95 in vrrp_pkt_checksum() ________________________________________________________________________________________________________ *** CID 1496687: Error handling issues (CHECKED_RETURN) /vrrpd/vrrp_packet.c: 95 in vrrp_pkt_checksum() 89 ph.next_hdr = IPPROTO_VRRP; 90 chksum = in_cksum_with_ph6(&ph, pkt, pktsize); 91 } else if (!v6 && ((pkt->hdr.vertype >> 4) == 3)) { 92 struct ipv4_ph ph = {}; 93 94 ph.src = src->ipaddr_v4; >>> CID 1496687: Error handling issues (CHECKED_RETURN) >>> Calling "inet_pton" without checking return value (as is done elsewhere 15 out of 16 times). 95 inet_pton(AF_INET, VRRP_MCASTV4_GROUP_STR, &ph.dst); 96 ph.proto = IPPROTO_VRRP; 97 ph.len = htons(pktsize); 98 chksum = in_cksum_with_ph4(&ph, pkt, pktsize); 99 } else if (!v6 && ((pkt->hdr.vertype >> 4) == 2)) { 100 chksum = in_cksum(pkt, pktsize); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

BGP-LS Design
by Abhijit Chaudhary 18 Aug '20

18 Aug '20

Dear Olivier, Thanks Olivier for sharing the BGP-LS source code. The team at Niral had reviewed the code, RFC and came up with a high level design. Dear All, Kindly find the BGP-LS design - https://github.com/Niral-Networks/docs/blob/master/FRR-BGP-LS-Design.pdf. We can discuss it during the Telco call tomorrow. Best, - Abhijit +91-9886179612 <http://www.niralnetworks.com/> Building Curated, Open, Disaggregated Networking for 5G and Beyond According to DSCI report, A NASSCOM Initiative, Niral Networks is a key 5G technology player from India <https://www.nasscom.in/sites/default/files/TechSagar_Wireless_and_Networkin…> ---------------------------------------------------------------------- >> >> Message: 1 >> Date: Fri, 24 Jul 2020 18:19:14 +0200 >> From: <olivier.dugeon(a)orange.com> >> To: dev <dev(a)lists.frrouting.org> >> Cc: CRISTIAN ALVARO ALBA ARRIETA <cristian.alba.a(a)uni.pe> >> Subject: [dev] Telco meeting status >> Message-ID: <cf9a4877-20ee-fda0-217f-b291615176a5(a)orange.com> >> Content-Type: text/plain; charset="utf-8" >> >> Dear all, >> >> Following the last Telco meeting, I updated the Wiki page to reflect our >> new usage >> of GitHub Project management facilities: >> https://github.com/FRRouting/frr/wiki/FRR-Telco-SP-projects >> >> Regarding BGP-LS, there is already a #Telco channel on Slack with very >> few discussions. >> So, I propose to use this #Telco channel to discuss on-going development >> around BGP-LS. >> >> Cristain (in Cc:) started its internship within Orange one month ago. >> He'll join >> Slack soon. Cristian started to backport our old BGP-LS code to FRR. >> Please, interact >> with him through Slack to discuss how to organise the work and progress. >> >> As mentioned, I'll start 3 weeks vacations this evening. So, fill free to >> maintain or >> cancel the next Telco meeting in 2 weeks. Allistair will manage it. >> >> Finally, I'll push a preview of Link State PR as WIP. Look at the doxygen >> doc within >> link_state.h for details and usage. >> >> Enjoy your summer. >> >> Regards >> >> Olivier >> >>

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 15 Aug '20

15 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 16 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 15 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 16 of 16 defect(s) ** CID 1496644: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_evpn_neigh.c: 722 in zebra_evpn_proc_sync_neigh_update() ________________________________________________________________________________________________________ *** CID 1496644: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_evpn_neigh.c: 722 in zebra_evpn_proc_sync_neigh_update() 716 if (old_bgp_ready) { 717 zebra_evpn_neigh_send_del_to_client( 718 zevpn->vni, &n->ip, &n->emac, n->flags, 719 n->state, false /*force*/); 720 old_bgp_ready = false; 721 } >>> CID 1496644: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "n->mac" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 722 if (n->mac) 723 zebra_evpn_local_neigh_deref_mac( 724 n, false /*send_mac_update*/); 725 } 726 /* clear old fwd info */ 727 n->rem_seq = 0; ** CID 1496643: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496643: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_evpn_mh.c: 362 in zebra_evpn_es_evi_show_vni() 356 vty_out(vty, "%-8s %-30s %-4s\n", "VNI", "ESI", "Type"); 357 } 358 } else { 359 if (!uj) 360 vty_out(vty, "VNI %d doesn't exist\n", vni); 361 } >>> CID 1496643: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "zevpn" to "zebra_evpn_es_evi_show_one_evpn", which dereferences it. 362 zebra_evpn_es_evi_show_one_evpn(zevpn, vty, json, detail); 363 } 364 365 /* Initialize the ES tables maintained per-L2_VNI */ 366 void zebra_evpn_evpn_es_init(zebra_evpn_t *zevpn) 367 { ** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 486 in seqnumber_mismatch() 480 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 481 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 482 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 483 484 ospf6_lsdb_remove_all(on->summary_list); 485 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 486 for (ALL_LSDB(on->retrans_list, lsa)) { 487 ospf6_decrement_retrans_count(lsa); 488 ospf6_lsdb_remove(lsa, on->retrans_list); 489 } 490 491 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2306 in ospf6_lsack_send_neighbor() 2300 2301 memset(sendbuf, 0, iobuflen); 2302 oh = (struct ospf6_header *)sendbuf; 2303 2304 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2305 >>> CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2306 for (ALL_LSDB(on->lsack_list, lsa)) { 2307 /* MTU check */ 2308 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2309 > ospf6_packet_max(on->ospf6_if)) { 2310 /* if we run out of packet size/space here, 2311 better to try again soon. */ ** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2223 in ospf6_lsupdate_send_interface() 2217 lsupdate = (struct ospf6_lsupdate *)((caddr_t)oh 2218 + sizeof(struct ospf6_header)); 2219 2220 p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 2221 lsa_cnt = 0; 2222 >>> CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2223 for (ALL_LSDB(oi->lsupdate_list, lsa)) { 2224 /* MTU check */ 2225 if ((p - sendbuf + ((unsigned int)OSPF6_LSA_SIZE(lsa->header))) 2226 > ospf6_packet_max(oi)) { 2227 if (lsa_cnt) { 2228 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; ** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 306 in ospf6_lsdb_remove_all() 300 { 301 struct ospf6_lsa *lsa; 302 303 if (lsdb == NULL) 304 return; 305 >>> CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 306 for (ALL_LSDB(lsdb, lsa)) 307 ospf6_lsdb_remove(lsa, lsdb); 308 } 309 310 void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa) 311 { ** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 125 in ospf6_neighbor_delete() 119 void ospf6_neighbor_delete(struct ospf6_neighbor *on) 120 { 121 struct ospf6_lsa *lsa; 122 123 ospf6_lsdb_remove_all(on->summary_list); 124 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 125 for (ALL_LSDB(on->retrans_list, lsa)) { 126 ospf6_decrement_retrans_count(lsa); 127 ospf6_lsdb_remove(lsa, on->retrans_list); 128 } 129 130 ospf6_lsdb_remove_all(on->dbdesc_list); ** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1872 in ospf6_dbdesc_send_newone() 1866 ospf6_lsdb_remove_all(on->dbdesc_list); 1867 1868 /* move LSAs from summary_list to dbdesc_list (within neighbor 1869 structure) 1870 so that ospf6_send_dbdesc () can send those LSAs */ 1871 size = sizeof(struct ospf6_lsa_header) + sizeof(struct ospf6_dbdesc); >>> CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 1872 for (ALL_LSDB(on->summary_list, lsa)) { 1873 if (size + sizeof(struct ospf6_lsa_header) 1874 > ospf6_packet_max(on->ospf6_if)) { 1875 ospf6_lsdb_lsa_unlock(lsa); 1876 break; 1877 } ** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 523 in bad_lsreq() 517 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 518 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 519 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 520 521 ospf6_lsdb_remove_all(on->summary_list); 522 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 523 for (ALL_LSDB(on->retrans_list, lsa)) { 524 ospf6_decrement_retrans_count(lsa); 525 ospf6_lsdb_remove(lsa, on->retrans_list); 526 } 527 528 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 310 in negotiation_done() 304 if (IS_OSPF6_DEBUG_NEIGHBOR(EVENT)) 305 zlog_debug("Neighbor Event %s: *NegotiationDone*", on->name); 306 307 /* clear ls-list */ 308 ospf6_lsdb_remove_all(on->summary_list); 309 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 310 for (ALL_LSDB(on->retrans_list, lsa)) { 311 ospf6_decrement_retrans_count(lsa); 312 ospf6_lsdb_remove(lsa, on->retrans_list); 313 } 314 315 /* Interface scoped LSAs */ ** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 324 in ospf6_lsdb_maxage_remover() 318 319 int ospf6_lsdb_maxage_remover(struct ospf6_lsdb *lsdb) 320 { 321 int reschedule = 0; 322 struct ospf6_lsa *lsa; 323 >>> CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 324 for (ALL_LSDB(lsdb, lsa)) { 325 if (!OSPF6_LSA_IS_MAXAGE(lsa)) 326 continue; 327 if (lsa->retrans_count != 0) { 328 reschedule = 1; 329 continue; ** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2385 in ospf6_lsack_send_interface() 2379 2380 memset(sendbuf, 0, iobuflen); 2381 oh = (struct ospf6_header *)sendbuf; 2382 2383 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2384 >>> CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2385 for (ALL_LSDB(oi->lsack_list, lsa)) { 2386 /* MTU check */ 2387 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2388 > ospf6_packet_max(oi)) { 2389 /* if we run out of packet size/space here, 2390 better to try again soon. */ ** CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2040 in ospf6_lsupdate_send_neighbor() 2034 2035 p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 2036 lsa_cnt = 0; 2037 2038 /* lsupdate_list lists those LSA which doesn't need to be 2039 retransmitted. remove those from the list */ >>> CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2040 for (ALL_LSDB(on->lsupdate_list, lsa)) { 2041 /* MTU check */ 2042 if ((p - sendbuf + (unsigned int)OSPF6_LSA_SIZE(lsa->header)) 2043 > ospf6_packet_max(on->ospf6_if)) { 2044 if (lsa_cnt) { 2045 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; ** CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 558 in oneway_received() 552 ospf6_neighbor_state_change(OSPF6_NEIGHBOR_INIT, on, 553 OSPF6_NEIGHBOR_EVENT_ONEWAY_RCVD); 554 thread_add_event(master, neighbor_change, on->ospf6_if, 0, NULL); 555 556 ospf6_lsdb_remove_all(on->summary_list); 557 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 558 for (ALL_LSDB(on->retrans_list, lsa)) { 559 ospf6_decrement_retrans_count(lsa); 560 ospf6_lsdb_remove(lsa, on->retrans_list); 561 } 562 563 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 455 in adj_ok() 449 450 } else if (on->state >= OSPF6_NEIGHBOR_EXSTART && !need_adjacency(on)) { 451 ospf6_neighbor_state_change(OSPF6_NEIGHBOR_TWOWAY, on, 452 OSPF6_NEIGHBOR_EVENT_ADJ_OK); 453 ospf6_lsdb_remove_all(on->summary_list); 454 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 455 for (ALL_LSDB(on->retrans_list, lsa)) { 456 ospf6_decrement_retrans_count(lsa); 457 ospf6_lsdb_remove(lsa, on->retrans_list); 458 } 459 } 460 ** CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1950 in ospf6_lsreq_send() 1944 } 1945 1946 if (last_req != NULL) { 1947 if (on->last_ls_req != NULL) 1948 on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); 1949 >>> CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 1950 ospf6_lsa_lock(last_req); 1951 on->last_ls_req = last_req; 1952 } 1953 1954 oh->type = OSPF6_MESSAGE_TYPE_LSREQ; 1955 oh->length = htons(p - sendbuf); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 12 Aug '20

12 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1496642: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496642: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_route.c: 3072 in bgp_filtered_routes_count() 3066 3067 for (dest = bgp_table_top(table); dest; dest = bgp_route_next(dest)) { 3068 for (ain = dest->adj_in; ain; ain = ain->next) { 3069 const struct prefix *rn_p = bgp_dest_get_prefix(dest); 3070 struct attr attr = {}; 3071 >>> CID 1496642: Null pointer dereferences (FORWARD_NULL) >>> Passing "&attr" to "bgp_input_filter", which dereferences null "attr.aspath". 3072 if (bgp_input_filter(peer, rn_p, &attr, afi, safi) 3073 == FILTER_DENY) 3074 count++; 3075 } 3076 } 3077 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 07 Aug '20

07 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 6 of 6 defect(s) ** CID 1496619: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496619: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_evpn_mh.c: 360 in zebra_evpn_es_evi_show_vni() 354 vty_out(vty, "%-8s %-30s %-4s\n", "VNI", "ESI", "Type"); 355 } 356 } else { 357 if (!uj) 358 vty_out(vty, "VNI %d doesn't exist\n", vni); 359 } >>> CID 1496619: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "zvni" to "zebra_evpn_es_evi_show_one_vni", which dereferences it. 360 zebra_evpn_es_evi_show_one_vni(zvni, vty, json, detail); 361 } 362 363 /* Initialize the ES tables maintained per-L2_VNI */ 364 void zebra_evpn_vni_es_init(zebra_vni_t *zvni) 365 { ** CID 1496618: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496618: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_evpn_mh.c: 909 in bgp_evpn_type1_route_update() 903 attr_new = pi->attr; 904 905 /* Perform route selection; 906 * this is just to set the flags correctly as local route in 907 * the ES always wins. 908 */ >>> CID 1496618: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "vpn" to "evpn_route_select_install", which dereferences it. 909 evpn_route_select_install(bgp, vpn, rn); 910 bgp_dest_unlock_node(rn); 911 912 /* If this is a new route or some attribute has changed, export the 913 * route to the global table. The route will be advertised to peers 914 * from there. Note that this table is a 2-level tree (RD-level + ** CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) /zebra/zebra_evpn_mh.c: 1688 in zebra_evpn_es_cleanup() 1682 struct zebra_evpn_es *es; 1683 struct zebra_evpn_es *es_next; 1684 1685 RB_FOREACH_SAFE(es, zebra_es_rb_head, 1686 &zmh_info->es_rb_tree, es_next) { 1687 zebra_evpn_local_es_del(es); >>> CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "zebra_evpn_remote_es_flush" dereferences freed pointer "es". 1688 zebra_evpn_remote_es_flush(es); 1689 } 1690 } 1691 1692 /* Only certain types of access ports can be setup as an Ethernet Segment */ 1693 bool zebra_evpn_is_if_es_capable(struct zebra_if *zif) ** CID 1496616: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_vxlan.c: 6885 in zebra_vxlan_proc_sync_neigh_update() ________________________________________________________________________________________________________ *** CID 1496616: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_vxlan.c: 6885 in zebra_vxlan_proc_sync_neigh_update() 6879 if (old_bgp_ready) { 6880 zvni_neigh_send_del_to_client(zvni->vni, &n->ip, 6881 &n->emac, n->flags, n->state, 6882 false /*force*/); 6883 old_bgp_ready = false; 6884 } >>> CID 1496616: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "n->mac" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 6885 if (n->mac) 6886 zebra_vxlan_local_neigh_deref_mac(n, 6887 false /*send_mac_update*/); 6888 } 6889 /* clear old fwd info */ 6890 n->rem_seq = 0; ** CID 1496615: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /zebra/rt_netlink.c: 3206 in netlink_macfdb_update_ctx() ________________________________________________________________________________________________________ *** CID 1496615: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /zebra/rt_netlink.c: 3206 in netlink_macfdb_update_ctx() 3200 vid = dplane_ctx_mac_get_vlan(ctx); 3201 if (vid > 0) 3202 snprintf(vid_buf, sizeof(vid_buf), " VLAN %u", vid); 3203 else 3204 vid_buf[0] = '\0'; 3205 >>> CID 1496615: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "nfy & (8 /* 1 << 3 */)" is always 0 regardless of the values of its operands. This occurs as the logical first operand of "?:". 3206 zlog_debug("Tx %s family %s IF %s(%u)%s %sMAC %s dst %s nhg %u%s%s%s%s%s", 3207 nl_msg_type_to_str(cmd), nl_family_to_str(AF_BRIDGE), 3208 dplane_ctx_get_ifname(ctx), 3209 dplane_ctx_get_ifindex(ctx), vid_buf, 3210 dplane_ctx_mac_is_sticky(ctx) ? "sticky " : "", 3211 prefix_mac2str(mac, buf, sizeof(buf)), ** CID 1496614: Error handling issues (CHECKED_RETURN) /bgpd/bgp_evpn_mh.c: 1445 in bgp_evpn_local_es_up() ________________________________________________________________________________________________________ *** CID 1496614: Error handling issues (CHECKED_RETURN) /bgpd/bgp_evpn_mh.c: 1445 in bgp_evpn_local_es_up() 1439 /* generate EAD-EVI */ 1440 bgp_evpn_local_type1_evi_route_add(bgp, es); 1441 1442 /* generate EAD-ES */ 1443 build_evpn_type1_prefix(&p, BGP_EVPN_AD_ES_ETH_TAG, 1444 &es->esi, es->originator_ip); >>> CID 1496614: Error handling issues (CHECKED_RETURN) >>> Calling "bgp_evpn_type1_route_update" without checking return value (as is done elsewhere 4 out of 5 times). 1445 bgp_evpn_type1_route_update(bgp, es, NULL, &p); 1446 } 1447 1448 static void bgp_evpn_local_es_do_del(struct bgp *bgp, struct bgp_evpn_es *es) 1449 { 1450 struct bgp_evpn_es_evi *es_evi; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0