September 2021 - dev - lists.frrouting.org

2 week development freeze begins today
by Quentin Young 21 Sep '21

21 Sep '21

Hi all, FRR is trying out a new release procedure starting with the next release. The plan is this: - 6 weeks prior to release, we'll freeze the `master` branch from allowing new feature PRs to be merged. Bugfix PRs will still be permitted during that time. - 2 weeks after the freeze, we'll pull a release branch and also tag that branch as RC1. `master` will be unfrozen at that time. - 2 weeks after that, we will tag RC2. - 2 weeks after that we'll do the full release. Consistent with this plan we're freezing master for features starting today. It will reopen for feature work in 2 weeks. Quentin

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 20 Sep '21

20 Sep '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 39 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 39 defect(s) ** CID 1506514: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 1238 in ospf6_grace_lsa_show_info() ________________________________________________________________________________________________________ *** CID 1506514: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 1238 in ospf6_grace_lsa_show_info() 1232 if (!use_json) 1233 vty_out(vty, "TLV info:\n"); 1234 } else { 1235 zlog_debug(" TLV info:"); 1236 } 1237 >>> CID 1506514: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 1238 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 1239 tlvh = TLV_HDR_NEXT(tlvh)) { 1240 switch (ntohs(tlvh->type)) { 1241 case GRACE_PERIOD_TYPE: 1242 gracePeriod = (struct grace_tlv_graceperiod *)tlvh; 1243 sum += TLV_SIZE(tlvh); ** CID 1506513: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 160 in ospf6_extract_grace_lsa_fields() ________________________________________________________________________________________________________ *** CID 1506513: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 160 in ospf6_extract_grace_lsa_fields() 154 int sum = 0; 155 156 lsah = (struct ospf6_lsa_header *)lsa->header; 157 158 length = ntohs(lsah->length) - OSPF6_LSA_HEADER_SIZE; 159 >>> CID 1506513: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 160 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 161 tlvh = TLV_HDR_NEXT(tlvh)) { 162 switch (ntohs(tlvh->type)) { 163 case GRACE_PERIOD_TYPE: 164 gracePeriod = (struct grace_tlv_graceperiod *)tlvh; 165 *interval = ntohl(gracePeriod->interval); ** CID 1506512: (USE_AFTER_FREE) /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() ________________________________________________________________________________________________________ *** CID 1506512: (USE_AFTER_FREE) /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() 226 for (ALL_LSDB(nbr->retrans_list, lsa, lsanext)) { 227 struct ospf6_lsa *lsa_in_db = NULL; 228 229 /* Fetching the same copy of LSA form LSDB to validate the 230 * topochange. 231 */ >>> CID 1506512: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 232 lsa_in_db = 233 ospf6_lsdb_lookup(lsa->header->type, lsa->header->id, 234 lsa->header->adv_router, lsa->lsdb); 235 236 if (lsa_in_db && lsa_in_db->tobe_acknowledged) { 237 ospf6_lsa_unlock(lsa); /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() 226 for (ALL_LSDB(nbr->retrans_list, lsa, lsanext)) { 227 struct ospf6_lsa *lsa_in_db = NULL; 228 229 /* Fetching the same copy of LSA form LSDB to validate the 230 * topochange. 231 */ >>> CID 1506512: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 232 lsa_in_db = 233 ospf6_lsdb_lookup(lsa->header->type, lsa->header->id, 234 lsa->header->adv_router, lsa->lsdb); 235 236 if (lsa_in_db && lsa_in_db->tobe_acknowledged) { 237 ospf6_lsa_unlock(lsa); ** CID 1505419: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2459 in ospf6_make_lsupdate_list() /ospf6d/ospf6_message.c: 2459 in ospf6_make_lsupdate_list() ________________________________________________________________________________________________________ *** CID 1505419: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2458 in ospf6_make_lsupdate_list() 2452 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2453 struct ospf6_lsa *lsa, *lsanext; 2454 2455 /* skip over fixed header */ 2456 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2457 >>> CID 1505419: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2458 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { 2459 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2460 + OSPF6_HEADER_SIZE) 2461 > ospf6_packet_max(on->ospf6_if)) { 2462 ospf6_fill_header(on->ospf6_if, (*op)->s, 2463 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2459 in ospf6_make_lsupdate_list() 2453 struct ospf6_lsa *lsa, *lsanext; 2454 2455 /* skip over fixed header */ 2456 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2457 2458 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { >>> CID 1505419: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2459 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2460 + OSPF6_HEADER_SIZE) 2461 > ospf6_packet_max(on->ospf6_if)) { 2462 ospf6_fill_header(on->ospf6_if, (*op)->s, 2463 length + OSPF6_HEADER_SIZE); 2464 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2458 in ospf6_make_lsupdate_list() 2452 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2453 struct ospf6_lsa *lsa, *lsanext; 2454 2455 /* skip over fixed header */ 2456 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2457 >>> CID 1505419: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2458 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { 2459 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2460 + OSPF6_HEADER_SIZE) 2461 > ospf6_packet_max(on->ospf6_if)) { 2462 ospf6_fill_header(on->ospf6_if, (*op)->s, 2463 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2459 in ospf6_make_lsupdate_list() 2453 struct ospf6_lsa *lsa, *lsanext; 2454 2455 /* skip over fixed header */ 2456 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2457 2458 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { >>> CID 1505419: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2459 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2460 + OSPF6_HEADER_SIZE) 2461 > ospf6_packet_max(on->ospf6_if)) { 2462 ospf6_fill_header(on->ospf6_if, (*op)->s, 2463 length + OSPF6_HEADER_SIZE); 2464 (*op)->length = length + OSPF6_HEADER_SIZE; ** CID 1505418: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2288 in ospf6_make_lsreq() /ospf6d/ospf6_message.c: 2288 in ospf6_make_lsreq() ________________________________________________________________________________________________________ *** CID 1505418: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2282 in ospf6_make_lsreq() 2276 uint16_t length = 0; 2277 struct ospf6_lsa *lsa, *lsanext, *last_req = NULL; 2278 2279 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 2280 if ((length + OSPF6_HEADER_SIZE) 2281 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1505418: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2282 ospf6_lsa_unlock(lsa); 2283 if (lsanext) 2284 ospf6_lsa_unlock(lsanext); 2285 break; 2286 } 2287 stream_putw(s, 0); /* reserved */ /ospf6d/ospf6_message.c: 2282 in ospf6_make_lsreq() 2276 uint16_t length = 0; 2277 struct ospf6_lsa *lsa, *lsanext, *last_req = NULL; 2278 2279 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 2280 if ((length + OSPF6_HEADER_SIZE) 2281 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1505418: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2282 ospf6_lsa_unlock(lsa); 2283 if (lsanext) 2284 ospf6_lsa_unlock(lsanext); 2285 break; 2286 } 2287 stream_putw(s, 0); /* reserved */ /ospf6d/ospf6_message.c: 2288 in ospf6_make_lsreq() 2282 ospf6_lsa_unlock(lsa); 2283 if (lsanext) 2284 ospf6_lsa_unlock(lsanext); 2285 break; 2286 } 2287 stream_putw(s, 0); /* reserved */ >>> CID 1505418: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2288 stream_putw(s, ntohs(lsa->header->type)); 2289 stream_putl(s, ntohl(lsa->header->id)); 2290 stream_putl(s, ntohl(lsa->header->adv_router)); 2291 length += sizeof(struct ospf6_lsreq_entry); 2292 last_req = lsa; 2293 } /ospf6d/ospf6_message.c: 2288 in ospf6_make_lsreq() 2282 ospf6_lsa_unlock(lsa); 2283 if (lsanext) 2284 ospf6_lsa_unlock(lsanext); 2285 break; 2286 } 2287 stream_putw(s, 0); /* reserved */ >>> CID 1505418: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2288 stream_putw(s, ntohs(lsa->header->type)); 2289 stream_putl(s, ntohl(lsa->header->id)); 2290 stream_putl(s, ntohl(lsa->header->adv_router)); 2291 length += sizeof(struct ospf6_lsreq_entry); 2292 last_req = lsa; 2293 } ** CID 1505417: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2497 in ospf6_make_ls_retrans_list() /ospf6d/ospf6_message.c: 2497 in ospf6_make_ls_retrans_list() ________________________________________________________________________________________________________ *** CID 1505417: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2497 in ospf6_make_ls_retrans_list() 2491 struct ospf6_lsa *lsa, *lsanext; 2492 2493 /* skip over fixed header */ 2494 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2495 2496 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { >>> CID 1505417: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2497 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2498 + OSPF6_HEADER_SIZE) 2499 > ospf6_packet_max(on->ospf6_if)) { 2500 ospf6_fill_header(on->ospf6_if, (*op)->s, 2501 length + OSPF6_HEADER_SIZE); 2502 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2497 in ospf6_make_ls_retrans_list() 2491 struct ospf6_lsa *lsa, *lsanext; 2492 2493 /* skip over fixed header */ 2494 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2495 2496 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { >>> CID 1505417: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2497 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2498 + OSPF6_HEADER_SIZE) 2499 > ospf6_packet_max(on->ospf6_if)) { 2500 ospf6_fill_header(on->ospf6_if, (*op)->s, 2501 length + OSPF6_HEADER_SIZE); 2502 (*op)->length = length + OSPF6_HEADER_SIZE; ** CID 1505415: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505415: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2299 in ospf6_make_lsreq() 2293 } 2294 2295 if (last_req != NULL) { 2296 if (on->last_ls_req != NULL) 2297 on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); 2298 >>> CID 1505415: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 2299 ospf6_lsa_lock(last_req); 2300 on->last_ls_req = last_req; 2301 } 2302 2303 return length; 2304 } /ospf6d/ospf6_message.c: 2299 in ospf6_make_lsreq() 2293 } 2294 2295 if (last_req != NULL) { 2296 if (on->last_ls_req != NULL) 2297 on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); 2298 >>> CID 1505415: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 2299 ospf6_lsa_lock(last_req); 2300 on->last_ls_req = last_req; 2301 } 2302 2303 return length; 2304 } ** CID 1505414: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505414: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2162 in ospf6_make_dbdesc() 2156 stream_putc(s, on->dbdesc_bits); 2157 stream_putl(s, on->dbdesc_seqnum); 2158 2159 /* if this is not initial one, set LSA headers in dbdesc */ 2160 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 2161 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1505414: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2162 ospf6_lsa_age_update_to_send(lsa, 2163 on->ospf6_if->transdelay); 2164 2165 /* MTU check */ 2166 if ((length + sizeof(struct ospf6_lsa_header) 2167 + OSPF6_HEADER_SIZE) /ospf6d/ospf6_message.c: 2162 in ospf6_make_dbdesc() 2156 stream_putc(s, on->dbdesc_bits); 2157 stream_putl(s, on->dbdesc_seqnum); 2158 2159 /* if this is not initial one, set LSA headers in dbdesc */ 2160 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 2161 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1505414: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2162 ospf6_lsa_age_update_to_send(lsa, 2163 on->ospf6_if->transdelay); 2164 2165 /* MTU check */ 2166 if ((length + sizeof(struct ospf6_lsa_header) 2167 + OSPF6_HEADER_SIZE) ** CID 1505412: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505412: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2765 in ospf6_make_lsack_interface() 2759 static uint16_t ospf6_make_lsack_interface(struct ospf6_interface *oi, 2760 struct ospf6_packet *op) 2761 { 2762 uint16_t length = 0; 2763 struct ospf6_lsa *lsa, *lsanext; 2764 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2765 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) { 2766 if ((length + sizeof(struct ospf6_lsa_header) 2767 + OSPF6_HEADER_SIZE) 2768 > ospf6_packet_max(oi)) { 2769 /* if we run out of packet size/space here, 2770 better to try again soon. */ /ospf6d/ospf6_message.c: 2775 in ospf6_make_lsack_interface() 2769 /* if we run out of packet size/space here, 2770 better to try again soon. */ 2771 THREAD_OFF(oi->thread_send_lsack); 2772 thread_add_event(master, ospf6_lsack_send_interface, oi, 2773 0, &oi->thread_send_lsack); 2774 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2775 ospf6_lsa_unlock(lsa); 2776 if (lsanext) 2777 ospf6_lsa_unlock(lsanext); 2778 break; 2779 } 2780 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); /ospf6d/ospf6_message.c: 2780 in ospf6_make_lsack_interface() 2774 2775 ospf6_lsa_unlock(lsa); 2776 if (lsanext) 2777 ospf6_lsa_unlock(lsanext); 2778 break; 2779 } >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2780 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2781 stream_put(op->s, lsa->header, sizeof(struct ospf6_lsa_header)); 2782 length += sizeof(struct ospf6_lsa_header); 2783 2784 assert(lsa->lock == 2); 2785 ospf6_lsdb_remove(lsa, oi->lsack_list); /ospf6d/ospf6_message.c: 2780 in ospf6_make_lsack_interface() 2774 2775 ospf6_lsa_unlock(lsa); 2776 if (lsanext) 2777 ospf6_lsa_unlock(lsanext); 2778 break; 2779 } >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2780 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2781 stream_put(op->s, lsa->header, sizeof(struct ospf6_lsa_header)); 2782 length += sizeof(struct ospf6_lsa_header); 2783 2784 assert(lsa->lock == 2); 2785 ospf6_lsdb_remove(lsa, oi->lsack_list); /ospf6d/ospf6_message.c: 2765 in ospf6_make_lsack_interface() 2759 static uint16_t ospf6_make_lsack_interface(struct ospf6_interface *oi, 2760 struct ospf6_packet *op) 2761 { 2762 uint16_t length = 0; 2763 struct ospf6_lsa *lsa, *lsanext; 2764 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2765 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) { 2766 if ((length + sizeof(struct ospf6_lsa_header) 2767 + OSPF6_HEADER_SIZE) 2768 > ospf6_packet_max(oi)) { 2769 /* if we run out of packet size/space here, 2770 better to try again soon. */ ** CID 1505410: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2638 in ospf6_make_lsupdate_interface() /ospf6d/ospf6_message.c: 2638 in ospf6_make_lsupdate_interface() ________________________________________________________________________________________________________ *** CID 1505410: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2637 in ospf6_make_lsupdate_interface() 2631 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2632 struct ospf6_lsa *lsa, *lsanext; 2633 2634 /* skip over fixed header */ 2635 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2636 >>> CID 1505410: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2637 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { 2638 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2639 + OSPF6_HEADER_SIZE 2640 > ospf6_packet_max(oi)) { 2641 ospf6_fill_header(oi, (*op)->s, 2642 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2637 in ospf6_make_lsupdate_interface() 2631 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2632 struct ospf6_lsa *lsa, *lsanext; 2633 2634 /* skip over fixed header */ 2635 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2636 >>> CID 1505410: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2637 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { 2638 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2639 + OSPF6_HEADER_SIZE 2640 > ospf6_packet_max(oi)) { 2641 ospf6_fill_header(oi, (*op)->s, 2642 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2638 in ospf6_make_lsupdate_interface() 2632 struct ospf6_lsa *lsa, *lsanext; 2633 2634 /* skip over fixed header */ 2635 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2636 2637 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { >>> CID 1505410: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2638 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2639 + OSPF6_HEADER_SIZE 2640 > ospf6_packet_max(oi)) { 2641 ospf6_fill_header(oi, (*op)->s, 2642 length + OSPF6_HEADER_SIZE); 2643 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2638 in ospf6_make_lsupdate_interface() 2632 struct ospf6_lsa *lsa, *lsanext; 2633 2634 /* skip over fixed header */ 2635 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2636 2637 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { >>> CID 1505410: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2638 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2639 + OSPF6_HEADER_SIZE 2640 > ospf6_packet_max(oi)) { 2641 ospf6_fill_header(oi, (*op)->s, 2642 length + OSPF6_HEADER_SIZE); 2643 (*op)->length = length + OSPF6_HEADER_SIZE; ** CID 1505407: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505407: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2313 in ospf6_make_lsack_neighbor() 2307 struct ospf6_packet **op) 2308 { 2309 uint16_t length = 0; 2310 struct ospf6_lsa *lsa, *lsanext; 2311 int lsa_cnt = 0; 2312 >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2313 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) { 2314 if ((length + sizeof(struct ospf6_lsa_header) 2315 + OSPF6_HEADER_SIZE) 2316 > ospf6_packet_max(on->ospf6_if)) { 2317 /* if we run out of packet size/space here, 2318 better to try again soon. */ /ospf6d/ospf6_message.c: 2313 in ospf6_make_lsack_neighbor() 2307 struct ospf6_packet **op) 2308 { 2309 uint16_t length = 0; 2310 struct ospf6_lsa *lsa, *lsanext; 2311 int lsa_cnt = 0; 2312 >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2313 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) { 2314 if ((length + sizeof(struct ospf6_lsa_header) 2315 + OSPF6_HEADER_SIZE) 2316 > ospf6_packet_max(on->ospf6_if)) { 2317 /* if we run out of packet size/space here, 2318 better to try again soon. */ /ospf6d/ospf6_message.c: 2335 in ospf6_make_lsack_neighbor() 2329 ospf6_make_header(OSPF6_MESSAGE_TYPE_LSACK, 2330 on->ospf6_if, (*op)->s); 2331 length = 0; 2332 lsa_cnt = 0; 2333 } 2334 } >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2335 ospf6_lsa_age_update_to_send(lsa, on->ospf6_if->transdelay); 2336 stream_put((*op)->s, lsa->header, 2337 sizeof(struct ospf6_lsa_header)); 2338 length += sizeof(struct ospf6_lsa_header); 2339 2340 assert(lsa->lock == 2); /ospf6d/ospf6_message.c: 2335 in ospf6_make_lsack_neighbor() 2329 ospf6_make_header(OSPF6_MESSAGE_TYPE_LSACK, 2330 on->ospf6_if, (*op)->s); 2331 length = 0; 2332 lsa_cnt = 0; 2333 } 2334 } >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2335 ospf6_lsa_age_update_to_send(lsa, on->ospf6_if->transdelay); 2336 stream_put((*op)->s, lsa->header, 2337 sizeof(struct ospf6_lsa_header)); 2338 length += sizeof(struct ospf6_lsa_header); 2339 2340 assert(lsa->lock == 2); ** CID 1504898: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1504898: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_dump.c: 585 in ospf_packet_dump() 579 ospf_packet_hello_dump(s, ntohs(ospfh->length)); 580 break; 581 case OSPF_MSG_DB_DESC: 582 ospf_packet_db_desc_dump(s, ntohs(ospfh->length)); 583 break; 584 case OSPF_MSG_LS_REQ: >>> CID 1504898: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(ospfh->length)" to a tainted sink. 585 ospf_packet_ls_req_dump(s, ntohs(ospfh->length)); 586 break; 587 case OSPF_MSG_LS_UPD: 588 ospf_packet_ls_upd_dump(s, ntohs(ospfh->length)); 589 break; 590 case OSPF_MSG_LS_ACK: ** CID 1504897: Memory - corruptions (OVERRUN) /ospfd/ospf_apiserver.c: 1175 in ospf_apiserver_handle_register_event() ________________________________________________________________________________________________________ *** CID 1504897: Memory - corruptions (OVERRUN) /ospfd/ospf_apiserver.c: 1175 in ospf_apiserver_handle_register_event() 1169 size = ntohs(msg->hdr.msglen); 1170 if (size < OSPF_MAX_LSA_SIZE) { 1171 1172 apiserv->filter = XMALLOC(MTYPE_OSPF_APISERVER_MSGFILTER, size); 1173 1174 /* copy it over. */ >>> CID 1504897: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_filter_type of 4 bytes by passing it to a function which accesses it at byte offset 1498 using argument "size" (which evaluates to 1499). 1175 memcpy(apiserv->filter, &rmsg->filter, size); 1176 rc = OSPF_API_OK; 1177 } else 1178 rc = OSPF_API_NOMEMORY; 1179 1180 /* Send a reply back to client with return code */ ** CID 1504585: Insecure data handling (TAINTED_SCALAR) /ospfclient/ospf_apiclient.c: 334 in ospf_apiclient_send_request() ________________________________________________________________________________________________________ *** CID 1504585: Insecure data handling (TAINTED_SCALAR) /ospfclient/ospf_apiclient.c: 334 in ospf_apiclient_send_request() 328 /* Wait for reply */ /* NB: New "msg" is allocated by "msg_read()". */ 329 msg = msg_read(oclient->fd_sync); 330 if (!msg) 331 return -1; 332 333 assert(msg->hdr.msgtype == MSG_REPLY); >>> CID 1504585: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "reqseq" as a loop boundary. 334 assert(ntohl(msg->hdr.msgseq) == reqseq); 335 336 msgreply = (struct msg_reply *)STREAM_DATA(msg->s); 337 rc = msgreply->errcode; 338 msg_free(msg); 339 ** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 623 in ospf_apiclient_handle_lsa_delete() ________________________________________________________________________________________________________ *** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 623 in ospf_apiclient_handle_lsa_delete() 617 __func__, lsalen, OSPF_MAX_LSA_SIZE); 618 return; 619 } 620 621 p = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 622 >>> CID 1497888: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 623 memcpy(p, &(cn->data), lsalen); 624 lsa = p; 625 626 /* Invoke registered update callback function */ 627 if (oclient->delete_notify) { 628 (oclient->delete_notify)(cn->ifaddr, cn->area_id, ** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 588 in ospf_apiclient_handle_lsa_update() ________________________________________________________________________________________________________ *** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 588 in ospf_apiclient_handle_lsa_update() 582 __func__, lsalen, OSPF_MAX_LSA_SIZE); 583 return; 584 } 585 586 p = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 587 >>> CID 1497886: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 588 memcpy(p, &(cn->data), lsalen); 589 lsa = p; 590 591 /* Invoke registered update callback function */ 592 if (oclient->update_notify) { 593 (oclient->update_notify)(cn->ifaddr, cn->area_id, ** CID 1485637: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb_allocator.h: 57 in qpb_alloc_ptr_array() ________________________________________________________________________________________________________ *** CID 1485637: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb_allocator.h: 57 in qpb_alloc_ptr_array() 51 * 52 * Allocate space for the specified number of pointers. 53 */ 54 static inline void *qpb_alloc_ptr_array(qpb_allocator_t *allocator, 55 size_t num_ptrs) 56 { >>> CID 1485637: Incorrect expression (SIZEOF_MISMATCH) >>> Passing argument "num_ptrs * 8UL /* sizeof (void *) */" to function "qpb_alloc" which returns a value of type "void *" is suspicious. 57 return qpb_alloc(allocator, num_ptrs * sizeof(void *)); 58 } 59 60 /* 61 * qpb_free 62 */ ** CID 1485635: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb.h: 124 in qpb__l3_prefix__get() ________________________________________________________________________________________________________ *** CID 1485635: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb.h: 124 in qpb__l3_prefix__get() 118 uint8_t family, struct prefix *prefix) 119 { 120 121 switch (family) { 122 123 case AF_INET: >>> CID 1485635: Incorrect expression (SIZEOF_MISMATCH) >>> Passing argument "prefix" of type "struct prefix *" and argument "16UL" ("sizeof (struct prefix_ipv4)") to function "memset" is suspicious because a multiple of "sizeof (struct prefix) /*48*/" is expected. 124 memset(prefix, 0, sizeof(struct prefix_ipv4)); 125 break; 126 127 case AF_INET6: 128 memset(prefix, 0, sizeof(struct prefix_ipv6)); 129 break; ** CID 1482217: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1482217: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_packet.c: 355 in ospf_check_md5_digest() 349 EVP_DigestUpdate(ctx, ck->auth_key, OSPF_AUTH_MD5_SIZE); 350 EVP_DigestFinal(ctx, digest, &md5_size); 351 EVP_MD_CTX_free(ctx); 352 #elif CRYPTO_INTERNAL 353 memset(&ctx, 0, sizeof(ctx)); 354 MD5Init(&ctx); >>> CID 1482217: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "length" to a tainted sink. 355 MD5Update(&ctx, ospfh, length); 356 MD5Update(&ctx, ck->auth_key, OSPF_AUTH_MD5_SIZE); 357 MD5Final(digest, &ctx); 358 #endif 359 360 /* compare the two */ ** CID 1482211: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1482211: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_packet.c: 430 in ospf_make_md5_digest() 424 EVP_DigestUpdate(ctx, auth_key, OSPF_AUTH_MD5_SIZE); 425 EVP_DigestFinal(ctx, digest, &md5_size); 426 EVP_MD_CTX_free(ctx); 427 #elif CRYPTO_INTERNAL 428 memset(&ctx, 0, sizeof(ctx)); 429 MD5Init(&ctx); >>> CID 1482211: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(ospfh->length)" to a tainted sink. 430 MD5Update(&ctx, ibuf, ntohs(ospfh->length)); 431 MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE); 432 MD5Final(digest, &ctx); 433 #endif 434 435 /* Append md5 digest to the end of the stream. */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 17 Sep '21

17 Sep '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 63 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1506902: Error handling issues (CHECKED_RETURN) /zebra/zebra_fpm.c: 2000 in zfpm_init() ________________________________________________________________________________________________________ *** CID 1506902: Error handling issues (CHECKED_RETURN) /zebra/zebra_fpm.c: 2000 in zfpm_init() 1994 1995 zfpm_stats_init(&zfpm_g->stats); 1996 zfpm_stats_init(&zfpm_g->last_ivl_stats); 1997 zfpm_stats_init(&zfpm_g->cumulative_stats); 1998 1999 memset(&ipv4ll_gateway, 0, sizeof(ipv4ll_gateway)); >>> CID 1506902: Error handling issues (CHECKED_RETURN) >>> Calling "inet_pton" without checking return value (as is done elsewhere 10 out of 11 times). 2000 inet_pton(AF_INET, ipv4_ll_buf, &ipv4ll_gateway.ipv4); 2001 2002 install_node(&zebra_node); 2003 install_element(ENABLE_NODE, &show_zebra_fpm_stats_cmd); 2004 install_element(ENABLE_NODE, &clear_zebra_fpm_stats_cmd); 2005 install_element(CONFIG_NODE, &fpm_remote_ip_cmd); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 15 Sep '21

15 Sep '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1506874: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1506874: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_updgrp_adv.c: 939 in subgroup_default_originate() 933 SET_FLAG(subgrp->sflags, 934 SUBGRP_STATUS_DEFAULT_ORIGINATE); 935 subgroup_default_update_packet(subgrp, new_attr, from); 936 } 937 } 938 >>> CID 1506874: Null pointer dereferences (FORWARD_NULL) >>> Passing "&attr.aspath" to "aspath_unintern", which dereferences null "attr.aspath". 939 aspath_unintern(&attr.aspath); 940 } 941 942 /* 943 * Announce the BGP table to a subgroup. 944 * ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0