October 2021 - dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 28 Oct '21

28 Oct '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 28 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 28 defect(s) ** CID 1508210: Error handling issues (CHECKED_RETURN) /zebra/zebra_script.c: 310 in lua_pushzebra_dplane_ctx() ________________________________________________________________________________________________________ *** CID 1508210: Error handling issues (CHECKED_RETURN) /zebra/zebra_script.c: 310 in lua_pushzebra_dplane_ctx() 304 case DPLANE_OP_IPSET_ADD: 305 case DPLANE_OP_IPSET_DELETE: 306 case DPLANE_OP_IPSET_ENTRY_ADD: 307 case DPLANE_OP_IPSET_ENTRY_DELETE: { 308 struct zebra_pbr_ipset ipset; 309 >>> CID 1508210: Error handling issues (CHECKED_RETURN) >>> Calling "dplane_ctx_get_pbr_ipset" without checking return value (as is done elsewhere 4 out of 5 times). 310 dplane_ctx_get_pbr_ipset(ctx, &ipset); 311 /* ipset */ 312 lua_newtable(L); 313 { 314 lua_pushinteger(L, ipset.sock); 315 lua_setfield(L, -2, "sock"); ** CID 1506514: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 1238 in ospf6_grace_lsa_show_info() ________________________________________________________________________________________________________ *** CID 1506514: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 1238 in ospf6_grace_lsa_show_info() 1232 if (!use_json) 1233 vty_out(vty, "TLV info:\n"); 1234 } else { 1235 zlog_debug(" TLV info:"); 1236 } 1237 >>> CID 1506514: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 1238 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 1239 tlvh = TLV_HDR_NEXT(tlvh)) { 1240 switch (ntohs(tlvh->type)) { 1241 case GRACE_PERIOD_TYPE: 1242 gracePeriod = (struct grace_tlv_graceperiod *)tlvh; 1243 sum += TLV_SIZE(tlvh); ** CID 1506513: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 160 in ospf6_extract_grace_lsa_fields() ________________________________________________________________________________________________________ *** CID 1506513: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 160 in ospf6_extract_grace_lsa_fields() 154 int sum = 0; 155 156 lsah = (struct ospf6_lsa_header *)lsa->header; 157 158 length = ntohs(lsah->length) - OSPF6_LSA_HEADER_SIZE; 159 >>> CID 1506513: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 160 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 161 tlvh = TLV_HDR_NEXT(tlvh)) { 162 switch (ntohs(tlvh->type)) { 163 case GRACE_PERIOD_TYPE: 164 gracePeriod = (struct grace_tlv_graceperiod *)tlvh; 165 *interval = ntohl(gracePeriod->interval); ** CID 1506512: (USE_AFTER_FREE) /ospf6d/ospf6_gr_helper.c: 230 in ospf6_check_chg_in_rxmt_list() /ospf6d/ospf6_gr_helper.c: 230 in ospf6_check_chg_in_rxmt_list() ________________________________________________________________________________________________________ *** CID 1506512: (USE_AFTER_FREE) /ospf6d/ospf6_gr_helper.c: 230 in ospf6_check_chg_in_rxmt_list() 224 for (ALL_LSDB(nbr->retrans_list, lsa, lsanext)) { 225 struct ospf6_lsa *lsa_in_db = NULL; 226 227 /* Fetching the same copy of LSA form LSDB to validate the 228 * topochange. 229 */ >>> CID 1506512: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 230 lsa_in_db = 231 ospf6_lsdb_lookup(lsa->header->type, lsa->header->id, 232 lsa->header->adv_router, lsa->lsdb); 233 234 if (lsa_in_db && lsa_in_db->tobe_acknowledged) { 235 ospf6_lsa_unlock(lsa); /ospf6d/ospf6_gr_helper.c: 230 in ospf6_check_chg_in_rxmt_list() 224 for (ALL_LSDB(nbr->retrans_list, lsa, lsanext)) { 225 struct ospf6_lsa *lsa_in_db = NULL; 226 227 /* Fetching the same copy of LSA form LSDB to validate the 228 * topochange. 229 */ >>> CID 1506512: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 230 lsa_in_db = 231 ospf6_lsdb_lookup(lsa->header->type, lsa->header->id, 232 lsa->header->adv_router, lsa->lsdb); 233 234 if (lsa_in_db && lsa_in_db->tobe_acknowledged) { 235 ospf6_lsa_unlock(lsa); ** CID 1505419: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2454 in ospf6_make_lsupdate_list() /ospf6d/ospf6_message.c: 2454 in ospf6_make_lsupdate_list() ________________________________________________________________________________________________________ *** CID 1505419: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2454 in ospf6_make_lsupdate_list() 2448 struct ospf6_lsa *lsa, *lsanext; 2449 2450 /* skip over fixed header */ 2451 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2452 2453 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { >>> CID 1505419: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2454 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2455 + OSPF6_HEADER_SIZE) 2456 > ospf6_packet_max(on->ospf6_if)) { 2457 ospf6_fill_header(on->ospf6_if, (*op)->s, 2458 length + OSPF6_HEADER_SIZE); 2459 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2454 in ospf6_make_lsupdate_list() 2448 struct ospf6_lsa *lsa, *lsanext; 2449 2450 /* skip over fixed header */ 2451 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2452 2453 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { >>> CID 1505419: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2454 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2455 + OSPF6_HEADER_SIZE) 2456 > ospf6_packet_max(on->ospf6_if)) { 2457 ospf6_fill_header(on->ospf6_if, (*op)->s, 2458 length + OSPF6_HEADER_SIZE); 2459 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2453 in ospf6_make_lsupdate_list() 2447 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2448 struct ospf6_lsa *lsa, *lsanext; 2449 2450 /* skip over fixed header */ 2451 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2452 >>> CID 1505419: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2453 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { 2454 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2455 + OSPF6_HEADER_SIZE) 2456 > ospf6_packet_max(on->ospf6_if)) { 2457 ospf6_fill_header(on->ospf6_if, (*op)->s, 2458 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2453 in ospf6_make_lsupdate_list() 2447 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2448 struct ospf6_lsa *lsa, *lsanext; 2449 2450 /* skip over fixed header */ 2451 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2452 >>> CID 1505419: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2453 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { 2454 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2455 + OSPF6_HEADER_SIZE) 2456 > ospf6_packet_max(on->ospf6_if)) { 2457 ospf6_fill_header(on->ospf6_if, (*op)->s, 2458 length + OSPF6_HEADER_SIZE); ** CID 1505418: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2284 in ospf6_make_lsreq() /ospf6d/ospf6_message.c: 2284 in ospf6_make_lsreq() ________________________________________________________________________________________________________ *** CID 1505418: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2278 in ospf6_make_lsreq() 2272 uint16_t length = 0; 2273 struct ospf6_lsa *lsa, *lsanext, *last_req = NULL; 2274 2275 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 2276 if ((length + OSPF6_HEADER_SIZE) 2277 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1505418: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2278 ospf6_lsa_unlock(lsa); 2279 if (lsanext) 2280 ospf6_lsa_unlock(lsanext); 2281 break; 2282 } 2283 stream_putw(s, 0); /* reserved */ /ospf6d/ospf6_message.c: 2278 in ospf6_make_lsreq() 2272 uint16_t length = 0; 2273 struct ospf6_lsa *lsa, *lsanext, *last_req = NULL; 2274 2275 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 2276 if ((length + OSPF6_HEADER_SIZE) 2277 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1505418: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2278 ospf6_lsa_unlock(lsa); 2279 if (lsanext) 2280 ospf6_lsa_unlock(lsanext); 2281 break; 2282 } 2283 stream_putw(s, 0); /* reserved */ /ospf6d/ospf6_message.c: 2284 in ospf6_make_lsreq() 2278 ospf6_lsa_unlock(lsa); 2279 if (lsanext) 2280 ospf6_lsa_unlock(lsanext); 2281 break; 2282 } 2283 stream_putw(s, 0); /* reserved */ >>> CID 1505418: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2284 stream_putw(s, ntohs(lsa->header->type)); 2285 stream_putl(s, ntohl(lsa->header->id)); 2286 stream_putl(s, ntohl(lsa->header->adv_router)); 2287 length += sizeof(struct ospf6_lsreq_entry); 2288 last_req = lsa; 2289 } /ospf6d/ospf6_message.c: 2284 in ospf6_make_lsreq() 2278 ospf6_lsa_unlock(lsa); 2279 if (lsanext) 2280 ospf6_lsa_unlock(lsanext); 2281 break; 2282 } 2283 stream_putw(s, 0); /* reserved */ >>> CID 1505418: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2284 stream_putw(s, ntohs(lsa->header->type)); 2285 stream_putl(s, ntohl(lsa->header->id)); 2286 stream_putl(s, ntohl(lsa->header->adv_router)); 2287 length += sizeof(struct ospf6_lsreq_entry); 2288 last_req = lsa; 2289 } ** CID 1505417: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2492 in ospf6_make_ls_retrans_list() /ospf6d/ospf6_message.c: 2492 in ospf6_make_ls_retrans_list() ________________________________________________________________________________________________________ *** CID 1505417: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2492 in ospf6_make_ls_retrans_list() 2486 struct ospf6_lsa *lsa, *lsanext; 2487 2488 /* skip over fixed header */ 2489 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2490 2491 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { >>> CID 1505417: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2492 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2493 + OSPF6_HEADER_SIZE) 2494 > ospf6_packet_max(on->ospf6_if)) { 2495 ospf6_fill_header(on->ospf6_if, (*op)->s, 2496 length + OSPF6_HEADER_SIZE); 2497 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2492 in ospf6_make_ls_retrans_list() 2486 struct ospf6_lsa *lsa, *lsanext; 2487 2488 /* skip over fixed header */ 2489 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2490 2491 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { >>> CID 1505417: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2492 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2493 + OSPF6_HEADER_SIZE) 2494 > ospf6_packet_max(on->ospf6_if)) { 2495 ospf6_fill_header(on->ospf6_if, (*op)->s, 2496 length + OSPF6_HEADER_SIZE); 2497 (*op)->length = length + OSPF6_HEADER_SIZE; ** CID 1505415: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505415: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2295 in ospf6_make_lsreq() 2289 } 2290 2291 if (last_req != NULL) { 2292 if (on->last_ls_req != NULL) 2293 on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); 2294 >>> CID 1505415: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 2295 ospf6_lsa_lock(last_req); 2296 on->last_ls_req = last_req; 2297 } 2298 2299 return length; 2300 } /ospf6d/ospf6_message.c: 2295 in ospf6_make_lsreq() 2289 } 2290 2291 if (last_req != NULL) { 2292 if (on->last_ls_req != NULL) 2293 on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); 2294 >>> CID 1505415: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 2295 ospf6_lsa_lock(last_req); 2296 on->last_ls_req = last_req; 2297 } 2298 2299 return length; 2300 } ** CID 1505414: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505414: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2158 in ospf6_make_dbdesc() 2152 stream_putc(s, on->dbdesc_bits); 2153 stream_putl(s, on->dbdesc_seqnum); 2154 2155 /* if this is not initial one, set LSA headers in dbdesc */ 2156 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 2157 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1505414: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2158 ospf6_lsa_age_update_to_send(lsa, 2159 on->ospf6_if->transdelay); 2160 2161 /* MTU check */ 2162 if ((length + sizeof(struct ospf6_lsa_header) 2163 + OSPF6_HEADER_SIZE) /ospf6d/ospf6_message.c: 2158 in ospf6_make_dbdesc() 2152 stream_putc(s, on->dbdesc_bits); 2153 stream_putl(s, on->dbdesc_seqnum); 2154 2155 /* if this is not initial one, set LSA headers in dbdesc */ 2156 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 2157 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1505414: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2158 ospf6_lsa_age_update_to_send(lsa, 2159 on->ospf6_if->transdelay); 2160 2161 /* MTU check */ 2162 if ((length + sizeof(struct ospf6_lsa_header) 2163 + OSPF6_HEADER_SIZE) ** CID 1505412: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505412: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2757 in ospf6_make_lsack_interface() 2751 static uint16_t ospf6_make_lsack_interface(struct ospf6_interface *oi, 2752 struct ospf6_packet *op) 2753 { 2754 uint16_t length = 0; 2755 struct ospf6_lsa *lsa, *lsanext; 2756 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2757 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) { 2758 if ((length + sizeof(struct ospf6_lsa_header) 2759 + OSPF6_HEADER_SIZE) 2760 > ospf6_packet_max(oi)) { 2761 /* if we run out of packet size/space here, 2762 better to try again soon. */ /ospf6d/ospf6_message.c: 2772 in ospf6_make_lsack_interface() 2766 2767 ospf6_lsa_unlock(lsa); 2768 if (lsanext) 2769 ospf6_lsa_unlock(lsanext); 2770 break; 2771 } >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2772 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2773 stream_put(op->s, lsa->header, sizeof(struct ospf6_lsa_header)); 2774 length += sizeof(struct ospf6_lsa_header); 2775 2776 assert(lsa->lock == 2); 2777 ospf6_lsdb_remove(lsa, oi->lsack_list); /ospf6d/ospf6_message.c: 2767 in ospf6_make_lsack_interface() 2761 /* if we run out of packet size/space here, 2762 better to try again soon. */ 2763 THREAD_OFF(oi->thread_send_lsack); 2764 thread_add_event(master, ospf6_lsack_send_interface, oi, 2765 0, &oi->thread_send_lsack); 2766 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2767 ospf6_lsa_unlock(lsa); 2768 if (lsanext) 2769 ospf6_lsa_unlock(lsanext); 2770 break; 2771 } 2772 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); /ospf6d/ospf6_message.c: 2757 in ospf6_make_lsack_interface() 2751 static uint16_t ospf6_make_lsack_interface(struct ospf6_interface *oi, 2752 struct ospf6_packet *op) 2753 { 2754 uint16_t length = 0; 2755 struct ospf6_lsa *lsa, *lsanext; 2756 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2757 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) { 2758 if ((length + sizeof(struct ospf6_lsa_header) 2759 + OSPF6_HEADER_SIZE) 2760 > ospf6_packet_max(oi)) { 2761 /* if we run out of packet size/space here, 2762 better to try again soon. */ /ospf6d/ospf6_message.c: 2772 in ospf6_make_lsack_interface() 2766 2767 ospf6_lsa_unlock(lsa); 2768 if (lsanext) 2769 ospf6_lsa_unlock(lsanext); 2770 break; 2771 } >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2772 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2773 stream_put(op->s, lsa->header, sizeof(struct ospf6_lsa_header)); 2774 length += sizeof(struct ospf6_lsa_header); 2775 2776 assert(lsa->lock == 2); 2777 ospf6_lsdb_remove(lsa, oi->lsack_list); ** CID 1505410: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2631 in ospf6_make_lsupdate_interface() /ospf6d/ospf6_message.c: 2631 in ospf6_make_lsupdate_interface() ________________________________________________________________________________________________________ *** CID 1505410: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2630 in ospf6_make_lsupdate_interface() 2624 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2625 struct ospf6_lsa *lsa, *lsanext; 2626 2627 /* skip over fixed header */ 2628 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2629 >>> CID 1505410: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2630 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { 2631 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2632 + OSPF6_HEADER_SIZE 2633 > ospf6_packet_max(oi)) { 2634 ospf6_fill_header(oi, (*op)->s, 2635 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2631 in ospf6_make_lsupdate_interface() 2625 struct ospf6_lsa *lsa, *lsanext; 2626 2627 /* skip over fixed header */ 2628 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2629 2630 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { >>> CID 1505410: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2631 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2632 + OSPF6_HEADER_SIZE 2633 > ospf6_packet_max(oi)) { 2634 ospf6_fill_header(oi, (*op)->s, 2635 length + OSPF6_HEADER_SIZE); 2636 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2631 in ospf6_make_lsupdate_interface() 2625 struct ospf6_lsa *lsa, *lsanext; 2626 2627 /* skip over fixed header */ 2628 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2629 2630 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { >>> CID 1505410: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2631 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2632 + OSPF6_HEADER_SIZE 2633 > ospf6_packet_max(oi)) { 2634 ospf6_fill_header(oi, (*op)->s, 2635 length + OSPF6_HEADER_SIZE); 2636 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2630 in ospf6_make_lsupdate_interface() 2624 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2625 struct ospf6_lsa *lsa, *lsanext; 2626 2627 /* skip over fixed header */ 2628 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2629 >>> CID 1505410: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2630 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { 2631 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2632 + OSPF6_HEADER_SIZE 2633 > ospf6_packet_max(oi)) { 2634 ospf6_fill_header(oi, (*op)->s, 2635 length + OSPF6_HEADER_SIZE); ** CID 1505407: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505407: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2309 in ospf6_make_lsack_neighbor() 2303 struct ospf6_packet **op) 2304 { 2305 uint16_t length = 0; 2306 struct ospf6_lsa *lsa, *lsanext; 2307 int lsa_cnt = 0; 2308 >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2309 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) { 2310 if ((length + sizeof(struct ospf6_lsa_header) 2311 + OSPF6_HEADER_SIZE) 2312 > ospf6_packet_max(on->ospf6_if)) { 2313 /* if we run out of packet size/space here, 2314 better to try again soon. */ /ospf6d/ospf6_message.c: 2331 in ospf6_make_lsack_neighbor() 2325 ospf6_make_header(OSPF6_MESSAGE_TYPE_LSACK, 2326 on->ospf6_if, (*op)->s); 2327 length = 0; 2328 lsa_cnt = 0; 2329 } 2330 } >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2331 ospf6_lsa_age_update_to_send(lsa, on->ospf6_if->transdelay); 2332 stream_put((*op)->s, lsa->header, 2333 sizeof(struct ospf6_lsa_header)); 2334 length += sizeof(struct ospf6_lsa_header); 2335 2336 assert(lsa->lock == 2); /ospf6d/ospf6_message.c: 2331 in ospf6_make_lsack_neighbor() 2325 ospf6_make_header(OSPF6_MESSAGE_TYPE_LSACK, 2326 on->ospf6_if, (*op)->s); 2327 length = 0; 2328 lsa_cnt = 0; 2329 } 2330 } >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2331 ospf6_lsa_age_update_to_send(lsa, on->ospf6_if->transdelay); 2332 stream_put((*op)->s, lsa->header, 2333 sizeof(struct ospf6_lsa_header)); 2334 length += sizeof(struct ospf6_lsa_header); 2335 2336 assert(lsa->lock == 2); /ospf6d/ospf6_message.c: 2309 in ospf6_make_lsack_neighbor() 2303 struct ospf6_packet **op) 2304 { 2305 uint16_t length = 0; 2306 struct ospf6_lsa *lsa, *lsanext; 2307 int lsa_cnt = 0; 2308 >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2309 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) { 2310 if ((length + sizeof(struct ospf6_lsa_header) 2311 + OSPF6_HEADER_SIZE) 2312 > ospf6_packet_max(on->ospf6_if)) { 2313 /* if we run out of packet size/space here, 2314 better to try again soon. */ ** CID 1504898: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1504898: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_dump.c: 591 in ospf_packet_dump() 585 ospf_packet_hello_dump(s, ntohs(ospfh->length)); 586 break; 587 case OSPF_MSG_DB_DESC: 588 ospf_packet_db_desc_dump(s, ntohs(ospfh->length)); 589 break; 590 case OSPF_MSG_LS_REQ: >>> CID 1504898: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(ospfh->length)" to a tainted sink. 591 ospf_packet_ls_req_dump(s, ntohs(ospfh->length)); 592 break; 593 case OSPF_MSG_LS_UPD: 594 ospf_packet_ls_upd_dump(s, ntohs(ospfh->length)); 595 break; 596 case OSPF_MSG_LS_ACK: ** CID 1504897: Memory - corruptions (OVERRUN) /ospfd/ospf_apiserver.c: 1175 in ospf_apiserver_handle_register_event() ________________________________________________________________________________________________________ *** CID 1504897: Memory - corruptions (OVERRUN) /ospfd/ospf_apiserver.c: 1175 in ospf_apiserver_handle_register_event() 1169 size = ntohs(msg->hdr.msglen); 1170 if (size < OSPF_MAX_LSA_SIZE) { 1171 1172 apiserv->filter = XMALLOC(MTYPE_OSPF_APISERVER_MSGFILTER, size); 1173 1174 /* copy it over. */ >>> CID 1504897: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_filter_type of 4 bytes by passing it to a function which accesses it at byte offset 1498 using argument "size" (which evaluates to 1499). 1175 memcpy(apiserv->filter, &rmsg->filter, size); 1176 rc = OSPF_API_OK; 1177 } else 1178 rc = OSPF_API_NOMEMORY; 1179 1180 /* Send a reply back to client with return code */ ** CID 1482217: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1482217: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_packet.c: 355 in ospf_check_md5_digest() 349 EVP_DigestUpdate(ctx, ck->auth_key, OSPF_AUTH_MD5_SIZE); 350 EVP_DigestFinal(ctx, digest, &md5_size); 351 EVP_MD_CTX_free(ctx); 352 #elif CRYPTO_INTERNAL 353 memset(&ctx, 0, sizeof(ctx)); 354 MD5Init(&ctx); >>> CID 1482217: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "length" to a tainted sink. 355 MD5Update(&ctx, ospfh, length); 356 MD5Update(&ctx, ck->auth_key, OSPF_AUTH_MD5_SIZE); 357 MD5Final(digest, &ctx); 358 #endif 359 360 /* compare the two */ ** CID 1482211: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1482211: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_packet.c: 430 in ospf_make_md5_digest() 424 EVP_DigestUpdate(ctx, auth_key, OSPF_AUTH_MD5_SIZE); 425 EVP_DigestFinal(ctx, digest, &md5_size); 426 EVP_MD_CTX_free(ctx); 427 #elif CRYPTO_INTERNAL 428 memset(&ctx, 0, sizeof(ctx)); 429 MD5Init(&ctx); >>> CID 1482211: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(ospfh->length)" to a tainted sink. 430 MD5Update(&ctx, ibuf, ntohs(ospfh->length)); 431 MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE); 432 MD5Final(digest, &ctx); 433 #endif 434 435 /* Append md5 digest to the end of the stream. */ ** CID 1482199: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1482199: Memory - corruptions (OVERRUN) /babeld/message.c: 1277 in flushupdates() 1271 update_source(route->src, seqno, metric); 1272 last_prefix = route->src->prefix; 1273 last_plen = route->src->plen; 1274 } else { 1275 /* There's no route for this prefix. This can happen shortly 1276 after an xroute has been retracted, so send a retraction. */ >>> CID 1482199: Memory - corruptions (OVERRUN) >>> Overrunning array "b[i].prefix" of 16 bytes by passing it to a function which accesses it at byte offset 27. 1277 really_send_update(ifp, myid, b[i].prefix, b[i].plen, 1278 myseqno, INFINITY, NULL, -1); 1279 } 1280 } 1281 schedule_flush_now(ifp); 1282 done: ** CID 1482187: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1482187: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_message.c: 1580 in ospf6_lsupdate_recv() 1574 1575 /* Process LSAs */ 1576 for (p = (char *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 1577 p < OSPF6_MESSAGE_END(oh) 1578 && p + OSPF6_LSA_SIZE(p) <= OSPF6_MESSAGE_END(oh); 1579 p += OSPF6_LSA_SIZE(p)) { >>> CID 1482187: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "((struct ospf6_lsa_header *)p)->length" to a tainted sink. 1580 ospf6_receive_lsa(on, (struct ospf6_lsa_header *)p); 1581 } 1582 1583 assert(p == OSPF6_MESSAGE_END(oh)); 1584 } 1585 ** CID 1482175: (TAINTED_SCALAR) /ospfd/ospf_apiserver.c: 2107 in ospf_apiserver_show_info() /ospfd/ospf_apiserver.c: 2094 in ospf_apiserver_show_info() ________________________________________________________________________________________________________ *** CID 1482175: (TAINTED_SCALAR) /ospfd/ospf_apiserver.c: 2107 in ospf_apiserver_show_info() 2101 " Added using OSPF API: %u octets of opaque data %s", 2102 opaquelen, 2103 VALID_OPAQUE_INFO_LEN(lsa->data) ? "" 2104 : "(Invalid length?)"); 2105 zlog_debug(" Opaque data: "); 2106 >>> CID 1482175: (TAINTED_SCALAR) >>> Using tainted variable "opaquelen" as a loop boundary. 2107 for (i = 0; i < opaquelen; i++) { 2108 zlog_debug("0x%x ", olsa->data[i]); 2109 } 2110 } 2111 return; 2112 } /ospfd/ospf_apiserver.c: 2094 in ospf_apiserver_show_info() 2088 " Added using OSPF API: %u octets of opaque data %s\n", 2089 opaquelen, 2090 VALID_OPAQUE_INFO_LEN(lsa->data) ? "" 2091 : "(Invalid length?)"); 2092 vty_out(vty, " Opaque data: "); 2093 >>> CID 1482175: (TAINTED_SCALAR) >>> Using tainted variable "opaquelen" as a loop boundary. 2094 for (i = 0; i < opaquelen; i++) { 2095 vty_out(vty, "0x%x ", olsa->data[i]); 2096 } 2097 vty_out(vty, "\n"); 2098 } else { 2099 int i; ** CID 1482165: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_lsa.c: 251 in ospf6_lsa_is_changed() ________________________________________________________________________________________________________ *** CID 1482165: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_lsa.c: 251 in ospf6_lsa_is_changed() 245 length = OSPF6_LSA_SIZE(lsa1->header) - sizeof(struct ospf6_lsa_header); 246 /* Once upper layer verifies LSAs received, length underrun should 247 * become a warning. */ 248 if (length <= 0) 249 return 0; 250 >>> CID 1482165: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "length" to a tainted sink. 251 return memcmp(OSPF6_LSA_HEADER_END(lsa1->header), 252 OSPF6_LSA_HEADER_END(lsa2->header), length); 253 } 254 255 /* ospf6 age functions */ 256 /* calculate birth */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 20 Oct '21

20 Oct '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1485637: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb_allocator.h: 57 in qpb_alloc_ptr_array() ________________________________________________________________________________________________________ *** CID 1485637: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb_allocator.h: 57 in qpb_alloc_ptr_array() 51 * 52 * Allocate space for the specified number of pointers. 53 */ 54 static inline void *qpb_alloc_ptr_array(qpb_allocator_t *allocator, 55 size_t num_ptrs) 56 { >>> CID 1485637: Incorrect expression (SIZEOF_MISMATCH) >>> Passing argument "num_ptrs * 8UL /* sizeof (void *) */" to function "qpb_alloc" which returns a value of type "void *" is suspicious. 57 return qpb_alloc(allocator, num_ptrs * sizeof(void *)); 58 } 59 60 /* 61 * qpb_free 62 */ ** CID 1485635: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb.h: 124 in qpb__l3_prefix__get() ________________________________________________________________________________________________________ *** CID 1485635: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb.h: 124 in qpb__l3_prefix__get() 118 uint8_t family, struct prefix *prefix) 119 { 120 121 switch (family) { 122 123 case AF_INET: >>> CID 1485635: Incorrect expression (SIZEOF_MISMATCH) >>> Passing argument "prefix" of type "struct prefix *" and argument "16UL" ("sizeof (struct prefix_ipv4)") to function "memset" is suspicious because a multiple of "sizeof (struct prefix) /*48*/" is expected. 124 memset(prefix, 0, sizeof(struct prefix_ipv4)); 125 break; 126 127 case AF_INET6: 128 memset(prefix, 0, sizeof(struct prefix_ipv6)); 129 break; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 14 Oct '21

14 Oct '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1482152: (TAINTED_SCALAR) /bfdd/control.c: 465 in control_read() /bfdd/control.c: 469 in control_read() ________________________________________________________________________________________________________ *** CID 1482152: (TAINTED_SCALAR) /bfdd/control.c: 453 in control_read() 447 /* Prepare the buffer to load the message. */ 448 bcs->bcs_version = bcm.bcm_ver; 449 bcs->bcs_type = bcm.bcm_type; 450 451 bcb->bcb_pos = sizeof(bcm); 452 bcb->bcb_left = plen; >>> CID 1482152: (TAINTED_SCALAR) >>> Passing tainted variable "8UL + bcb->bcb_left + 1UL" to a tainted sink. 453 bcb->bcb_buf = XMALLOC(MTYPE_BFDD_NOTIFICATION, 454 sizeof(bcm) + bcb->bcb_left + 1); 455 if (bcb->bcb_buf == NULL) { 456 zlog_warn("%s: not enough memory for message size: %zu", 457 __func__, bcb->bcb_left); 458 control_free(bcs); /bfdd/control.c: 465 in control_read() 459 return 0; 460 } 461 462 memcpy(bcb->bcb_buf, &bcm, sizeof(bcm)); 463 464 /* Terminate data string with NULL for later processing. */ >>> CID 1482152: (TAINTED_SCALAR) >>> Using tainted variable "8UL + bcb->bcb_left" as an index to pointer "(*bcb).bcb_buf". 465 bcb->bcb_buf[sizeof(bcm) + bcb->bcb_left] = 0; 466 467 skip_header: 468 /* Download the remaining data of the message and process it. */ 469 bread = read(sd, &bcb->bcb_buf[bcb->bcb_pos], bcb->bcb_left); 470 if (bread == 0) { /bfdd/control.c: 469 in control_read() 463 464 /* Terminate data string with NULL for later processing. */ 465 bcb->bcb_buf[sizeof(bcm) + bcb->bcb_left] = 0; 466 467 skip_header: 468 /* Download the remaining data of the message and process it. */ >>> CID 1482152: (TAINTED_SCALAR) >>> Passing tainted variable "bcb->bcb_left" to a tainted sink. 469 bread = read(sd, &bcb->bcb_buf[bcb->bcb_pos], bcb->bcb_left); 470 if (bread == 0) { 471 control_free(bcs); 472 return 0; 473 } 474 if (bread < 0) { ** CID 1480233: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1480233: Memory - corruptions (OVERRUN) /vrrpd/vrrp_ndisc.c: 144 in vrrp_ndisc_una_build() 138 ph.dst = ip6h->ip6_dst; 139 ph.ulpl = htonl(len); 140 ph.next_hdr = IPPROTO_ICMPV6; 141 142 /* Suppress static analysis warnings about accessing icmp6 oob */ 143 void *offset = icmp6h; >>> CID 1480233: Memory - corruptions (OVERRUN) >>> Overrunning struct type icmp6_hdr of 8 bytes by passing it to a function which accesses it at byte offset 31 using argument "len" (which evaluates to 32). 144 icmp6h->icmp6_cksum = in_cksum_with_ph6(&ph, offset, len); 145 146 return 0; 147 } 148 149 int vrrp_ndisc_una_send(struct vrrp_router *r, struct ipaddr *ip) ** CID 1472627: Memory - illegal accesses (USE_AFTER_FREE) /bfdd/control.c: 300 in control_queue_dequeue() ________________________________________________________________________________________________________ *** CID 1472627: Memory - illegal accesses (USE_AFTER_FREE) /bfdd/control.c: 300 in control_queue_dequeue() 294 control_queue_free(bcs, bcq); 295 296 /* Get the next buffer to send. */ 297 if (TAILQ_EMPTY(&bcs->bcs_bcqueue)) 298 goto empty_list; 299 >>> CID 1472627: Memory - illegal accesses (USE_AFTER_FREE) >>> Using freed pointer "bcs->bcs_bcqueue.tqh_first". 300 bcq = TAILQ_FIRST(&bcs->bcs_bcqueue); 301 bcs->bcs_bout = &bcq->bcq_bcb; 302 303 bcs->bcs_outev = NULL; 304 thread_add_write(master, control_write, bcs, bcs->bcs_sd, 305 &bcs->bcs_outev); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Problem in FRR with ldpd
by shruti mathure 12 Oct '21

12 Oct '21

Respected Sir, I am Shruti Mathure. I am working on one of the projects related to FRR. I am trying to implement MPLS LDP with FRR in Core emulator. The FRR seems to run but I am having issue with ldpd, It is not running also the staticcd does not seems to run which should automatically start with FRR. I am not able to find the correct solution for it. can you let me know any solution for this if there is any changes or latest updated bugs you have fix. I am not able to find any solution on github. I am using ubuntu 18.04. Thank you, Regards, Shruti Mathure

1 0

Results of the 2021 FRR TSC Elections
by Alistair Woodman 11 Oct '21

11 Oct '21

All, The 2021 TSC Elections are hereby over: There were only 6 nominees for the election and since the TSC is 6 in number, all nominees are duly confirmed unopposed. (in alphabetical order - these was obviously no ranking) . Lou Berger . Donald Sharp . Sri Mohana Singamsetty . Russ White . Martin Winter . Quentin Young Your elections officer. /a

1 0

Final request for nominations of candidates for the annual TSC election.
by Alistair Woodman 08 Oct '21

08 Oct '21

All, This is the final request for nominations for candidates for the TSC elections. I will close the nomination window by 12:00 PT tomorrow, Saturday. Please contact me with nominations or questions. 1) Self-nominations are welcome. 2) All nominees must be active FRR maintainers in order to stand. 3) Present TSC members must opt-out of being auto-nominated. 4) If you plan to nominate someone else, please get their approval first. /a (your friendly FRR community elections officer)

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 08 Oct '21

08 Oct '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1482152: (TAINTED_SCALAR) /bfdd/control.c: 465 in control_read() /bfdd/control.c: 469 in control_read() ________________________________________________________________________________________________________ *** CID 1482152: (TAINTED_SCALAR) /bfdd/control.c: 453 in control_read() 447 /* Prepare the buffer to load the message. */ 448 bcs->bcs_version = bcm.bcm_ver; 449 bcs->bcs_type = bcm.bcm_type; 450 451 bcb->bcb_pos = sizeof(bcm); 452 bcb->bcb_left = plen; >>> CID 1482152: (TAINTED_SCALAR) >>> Passing tainted variable "8UL + bcb->bcb_left + 1UL" to a tainted sink. 453 bcb->bcb_buf = XMALLOC(MTYPE_BFDD_NOTIFICATION, 454 sizeof(bcm) + bcb->bcb_left + 1); 455 if (bcb->bcb_buf == NULL) { 456 zlog_warn("%s: not enough memory for message size: %zu", 457 __func__, bcb->bcb_left); 458 control_free(bcs); /bfdd/control.c: 465 in control_read() 459 return 0; 460 } 461 462 memcpy(bcb->bcb_buf, &bcm, sizeof(bcm)); 463 464 /* Terminate data string with NULL for later processing. */ >>> CID 1482152: (TAINTED_SCALAR) >>> Using tainted variable "8UL + bcb->bcb_left" as an index to pointer "(*bcb).bcb_buf". 465 bcb->bcb_buf[sizeof(bcm) + bcb->bcb_left] = 0; 466 467 skip_header: 468 /* Download the remaining data of the message and process it. */ 469 bread = read(sd, &bcb->bcb_buf[bcb->bcb_pos], bcb->bcb_left); 470 if (bread == 0) { /bfdd/control.c: 469 in control_read() 463 464 /* Terminate data string with NULL for later processing. */ 465 bcb->bcb_buf[sizeof(bcm) + bcb->bcb_left] = 0; 466 467 skip_header: 468 /* Download the remaining data of the message and process it. */ >>> CID 1482152: (TAINTED_SCALAR) >>> Passing tainted variable "bcb->bcb_left" to a tainted sink. 469 bread = read(sd, &bcb->bcb_buf[bcb->bcb_pos], bcb->bcb_left); 470 if (bread == 0) { 471 control_free(bcs); 472 return 0; 473 } 474 if (bread < 0) { ** CID 1472627: Memory - illegal accesses (USE_AFTER_FREE) /bfdd/control.c: 300 in control_queue_dequeue() ________________________________________________________________________________________________________ *** CID 1472627: Memory - illegal accesses (USE_AFTER_FREE) /bfdd/control.c: 300 in control_queue_dequeue() 294 control_queue_free(bcs, bcq); 295 296 /* Get the next buffer to send. */ 297 if (TAILQ_EMPTY(&bcs->bcs_bcqueue)) 298 goto empty_list; 299 >>> CID 1472627: Memory - illegal accesses (USE_AFTER_FREE) >>> Using freed pointer "bcs->bcs_bcqueue.tqh_first". 300 bcq = TAILQ_FIRST(&bcs->bcs_bcqueue); 301 bcs->bcs_bout = &bcq->bcq_bcb; 302 303 bcs->bcs_outev = NULL; 304 thread_add_write(master, control_write, bcs, bcs->bcs_sd, 305 &bcs->bcs_outev); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Certificate error deb.frrouting.org
by Eduard Margulescu 07 Oct '21

07 Oct '21

Hello team, I want to install FRR on an Ubuntu 18.04 server and I receive this error when I try to use this procedure (https://deb.frrouting.org/) : # add GPG key curl -s https://deb.frrouting.org/frr/keys.asc | sudo apt-key add - # possible values for FRRVER: frr-6 frr-7 frr-8 frr-stable # frr-stable will be the latest official stable release FRRVER="frr-stable" echo deb https://deb.frrouting.org/frr $(lsb_release -s -c) $FRRVER | sudo tee -a /etc/apt/sources.list.d/frr.list # update and install FRR sudo apt update && sudo apt install frr frr-pythontools root@ukr1:~# curl -s https://deb.frrouting.org/frr/keys.asc | sudo apt-key add - OK root@ukr1:~# FRRVER="frr-stable" root@ukr1:~# echo deb https://deb.frrouting.org/frr $(lsb_release -s -c) $FRRVER | sudo tee -a /etc/apt/sources.list.d/frr.list deb https://deb.frrouting.org/frr bionic frr-stable root@ukr1:~# sudo apt update && sudo apt install frr frr-pythontools Get:1 http://security.ubuntu.com/ubuntu bionic-security InRelease [88.7 kB] Hit:2 http://us.archive.ubuntu.com/ubuntu bionic InRelease Ign:3 https://deb.frrouting.org/frr bionic InRelease Get:4 http://us.archive.ubuntu.com/ubuntu bionic-updates InRelease [88.7 kB] Err:5 https://deb.frrouting.org/frr bionic Release Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate. Could not handshake: Error in the certificate verification. [IP: 194.147.138.41 443] Get:6 http://us.archive.ubuntu.com/ubuntu bionic-backports InRelease [74.6 kB] Reading package lists... Done E: The repository 'https://deb.frrouting.org/frr bionic Release' does not have a Release file. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details. Is there something you can fix ? Thanks, Eduard

3 4

Penultimate request for nominations of candidates for the annual TSC election.
by Alistair Woodman 04 Oct '21

04 Oct '21

All, This will be the penultimate request for nominations for candidates for the TSC elections. Please contact me with nominations or questions. 1) Self-nominations are welcome. 2) All nominees must be active FRR maintainers in order to stand. 3) Present TSC members must opt-out of being auto-nominated. 4) If you plan to nominate someone else, please get their approval first. I will send a final reminder in few days and then start the voting next Monday.. /a (your friendly FRR community elections officer)

1 0