August 2022 - dev - lists.frrouting.org

First request for nominations of candidates for the 2022 TSC election.
by Alistair Woodman 27 Sep '22

27 Sep '22

All, This is the first request for nominations for candidates for the 2022 TSC elections. Please contact me with nominations or questions. 1) Self-nominations are welcome. 2) All nominees must be active FRR maintainers in order to stand. 3) Present TSC members must opt-out of being auto-nominated. 4) If you plan to nominate someone else, please get their approval first. /a (your friendly FRR community elections officer)

2 1

Building Images. Missing Architectures
by Michael Nehring 18 Aug '22

18 Aug '22

Dear frrouting devs, your frrounting/frr images gets buildet for multiple architectures, which is very good thank you <3 But is there a reason why the latest tag is only builded in amd64? It would be nice if the latest tag has also the different architectures. Best Regards Michael Nehring

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 16 Aug '22

16 Aug '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1519903: Uninitialized variables (UNINIT) ________________________________________________________________________________________________________ *** CID 1519903: Uninitialized variables (UNINIT) /zebra/tc_netlink.c: 317 in netlink_tclass_msg_encode() 311 sizeof(ceil)); 312 } 313 314 nl_attr_put(&req->n, datalen, TCA_HTB_PARMS, &htb_opt, sizeof(htb_opt)); 315 316 nl_attr_put(&req->n, datalen, TCA_HTB_RTAB, rtab, sizeof(rtab)); >>> CID 1519903: Uninitialized variables (UNINIT) >>> Using uninitialized element of array "ctab" when calling "nl_attr_put". 317 nl_attr_put(&req->n, datalen, TCA_HTB_CTAB, ctab, sizeof(ctab)); 318 nl_attr_nest_end(&req->n, nest); 319 320 return NLMSG_ALIGN(req->n.nlmsg_len); 321 } 322 ** CID 1519902: Possible Control flow issues (DEADCODE) /zebra/zebra_dplane.c: 2785 in dplane_ctx_tc_init() ________________________________________________________________________________________________________ *** CID 1519902: Possible Control flow issues (DEADCODE) /zebra/zebra_dplane.c: 2785 in dplane_ctx_tc_init() 2779 struct zebra_ns *zns = NULL; 2780 2781 ctx->zd_op = op; 2782 ctx->zd_status = ZEBRA_DPLANE_REQUEST_SUCCESS; 2783 2784 /* TODO: init traffic control qdisc */ >>> CID 1519902: Possible Control flow issues (DEADCODE) >>> Execution cannot reach the expression "zvrf->zns" inside this statement: "zns = (zvrf ? zvrf->zns : z...". 2785 zns = zvrf ? zvrf->zns : zebra_ns_lookup(NS_DEFAULT); 2786 2787 dplane_ctx_ns_init(ctx, zns, true); 2788 2789 ret = AOK; 2790 ** CID 1519901: Code maintainability issues (UNUSED_VALUE) /zebra/zebra_dplane.c: 3516 in dplane_tc_update_internal() ________________________________________________________________________________________________________ *** CID 1519901: Code maintainability issues (UNUSED_VALUE) /zebra/zebra_dplane.c: 3516 in dplane_tc_update_internal() 3510 return result; 3511 } 3512 3513 static enum zebra_dplane_result dplane_tc_update_internal(enum dplane_op_e op) 3514 { 3515 enum zebra_dplane_result result = ZEBRA_DPLANE_REQUEST_FAILURE; >>> CID 1519901: Code maintainability issues (UNUSED_VALUE) >>> Assigning value "22" to "ret" here, but that stored value is overwritten before it can be used. 3516 int ret = EINVAL; 3517 struct zebra_dplane_ctx *ctx = NULL; 3518 3519 /* Obtain context block */ 3520 ctx = dplane_ctx_alloc(); 3521 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 15 Aug '22

15 Aug '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 8 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 29 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 8 of 8 defect(s) ** CID 1519848: Null pointer dereferences (FORWARD_NULL) /pimd/pim6_mld.c: 2253 in gm_ifp_update() ________________________________________________________________________________________________________ *** CID 1519848: Null pointer dereferences (FORWARD_NULL) /pimd/pim6_mld.c: 2253 in gm_ifp_update() 2247 } 2248 2249 if (!pim_ifp->mld) 2250 gm_start(ifp); 2251 2252 gm_ifp = pim_ifp->mld; >>> CID 1519848: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "&gm_ifp->cur_ll_lowest" to "memcmp", which dereferences it. 2253 if (IPV6_ADDR_CMP(&pim_ifp->ll_lowest, &gm_ifp->cur_ll_lowest)) 2254 gm_update_ll(ifp); 2255 2256 unsigned int cfg_query_intv = pim_ifp->gm_default_query_interval * 1000; 2257 2258 if (gm_ifp->cur_query_intv != cfg_query_intv) { ** CID 1519847: Insecure data handling (TAINTED_SCALAR) /pimd/pim6_mld.c: 844 in gm_handle_v2_report() ________________________________________________________________________________________________________ *** CID 1519847: Insecure data handling (TAINTED_SCALAR) /pimd/pim6_mld.c: 844 in gm_handle_v2_report() 838 pkt->iface = gm_ifp; 839 pkt->subscriber = gm_subscriber_findref(gm_ifp, pkt_src->sin6_addr); 840 841 n_records = ntohs(hdr->n_records); 842 843 /* validate & remove state in v2_pass1() */ >>> CID 1519847: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "n_records" as a loop boundary. 844 for (i = 0; i < n_records; i++) { 845 struct mld_v2_rec_hdr *rechdr; 846 size_t n_src, record_size; 847 848 if (len < sizeof(*rechdr)) { 849 zlog_warn(log_pkt_src( ** CID 1519846: (TAINTED_SCALAR) /pimd/pim6_mld.c: 688 in gm_handle_v2_pass1() ________________________________________________________________________________________________________ *** CID 1519846: (TAINTED_SCALAR) /pimd/pim6_mld.c: 682 in gm_handle_v2_pass1() 676 * of blocked sources from full group state records 677 */ 678 return; 679 } 680 681 if (subscriber) >>> CID 1519846: (TAINTED_SCALAR) >>> Passing tainted expression "n_src" to "gm_packet_sg_remove_sources", which uses it as a loop boundary. 682 gm_packet_sg_remove_sources(pkt->iface, subscriber, 683 rechdr->grp, rechdr->srcs, 684 n_src, GM_SUB_POS); 685 return; 686 } 687 /pimd/pim6_mld.c: 688 in gm_handle_v2_pass1() 682 gm_packet_sg_remove_sources(pkt->iface, subscriber, 683 rechdr->grp, rechdr->srcs, 684 n_src, GM_SUB_POS); 685 return; 686 } 687 >>> CID 1519846: (TAINTED_SCALAR) >>> Using tainted variable "n_src" as a loop boundary. 688 for (j = 0; j < n_src; j++) { 689 struct gm_sg *sg; 690 691 sg = gm_sg_find(pkt->iface, rechdr->grp, rechdr->srcs[j]); 692 if (!sg) 693 sg = gm_sg_make(pkt->iface, rechdr->grp, /pimd/pim6_mld.c: 661 in gm_handle_v2_pass1() 655 } 656 break; 657 658 case MLD_RECTYPE_ALLOW_NEW_SOURCES: 659 if (old_grp) { 660 /* remove S,Gs from EXCLUDE, and then we're done */ >>> CID 1519846: (TAINTED_SCALAR) >>> Passing tainted expression "n_src" to "gm_packet_sg_remove_sources", which uses it as a loop boundary. 661 gm_packet_sg_remove_sources(pkt->iface, subscriber, 662 rechdr->grp, rechdr->srcs, 663 n_src, GM_SUB_NEG); 664 return; 665 } 666 /* in INCLUDE mode => ALLOW_NEW_SOURCES is functionally ** CID 1519845: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 188 in gm_gsq_pends_add() ________________________________________________________________________________________________________ *** CID 1519845: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 188 in gm_gsq_pends_add() 182 { 183 uint32_t seed = a->s_bit ? 0x68f0eb5e : 0x156b7f19; 184 185 return jhash(&a->grp, sizeof(a->grp), seed); 186 } 187 >>> CID 1519845: Integer handling issues (BAD_SHIFT) >>> In expression "hval >> 33 - h->hh.tabshift", right shifting by more than 31 bits has undefined behavior. The shift amount, "33 - h->hh.tabshift", is 33. 188 DECLARE_HASH(gm_gsq_pends, struct gm_gsq_pending, itm, gm_gsq_pending_cmp, 189 gm_gsq_pending_hash); 190 191 /* 192 * interface -> (S,G) 193 */ ** CID 1519844: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1519844: Insecure data handling (TAINTED_SCALAR) /pimd/pim6_mld.c: 1505 in gm_handle_query() 1499 gm_handle_q_general(gm_ifp, &timers); 1500 gm_ifp->stats.rx_query_new_general++; 1501 } else if (!ntohs(hdr->n_src)) { 1502 gm_handle_q_group(gm_ifp, &timers, hdr->grp); 1503 gm_ifp->stats.rx_query_new_group++; 1504 } else { >>> CID 1519844: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "ntohs(hdr->n_src)" to "gm_handle_q_groupsrc", which uses it as a loop boundary. 1505 gm_handle_q_groupsrc(gm_ifp, &timers, hdr->grp, hdr->srcs, 1506 ntohs(hdr->n_src)); 1507 gm_ifp->stats.rx_query_new_groupsrc++; 1508 } 1509 } 1510 ** CID 1519843: (UNINIT) ________________________________________________________________________________________________________ *** CID 1519843: (UNINIT) /pimd/pim6_mld.c: 1715 in gm_t_recv() 1709 if (pktlen < sizeof(struct icmp6_plain_hdr)) { 1710 zlog_warn(log_pkt_src("truncated packet")); 1711 gm_ifp->stats.rx_drop_malformed++; 1712 goto out_free; 1713 } 1714 >>> CID 1519843: (UNINIT) >>> Using uninitialized value "pkt_src->sin6_addr" when calling "gm_rx_process". 1715 gm_rx_process(gm_ifp, pkt_src, &pktinfo->ipi6_addr, iov->iov_base, 1716 pktlen); 1717 1718 out_free: 1719 if (iov->iov_base != rxbuf) 1720 XFREE(MTYPE_GM_PACKET, iov->iov_base); /pimd/pim6_mld.c: 1647 in gm_t_recv() 1641 pim->gm_rx_drop_sys++; 1642 goto out_free; 1643 } 1644 1645 struct interface *ifp; 1646 >>> CID 1519843: (UNINIT) >>> Using uninitialized value "pkt_src->sin6_scope_id" when calling "if_lookup_by_index". 1647 ifp = if_lookup_by_index(pkt_src->sin6_scope_id, pim->vrf->vrf_id); 1648 if (!ifp || !ifp->info) 1649 goto out_free; 1650 1651 struct pim_interface *pim_ifp = ifp->info; 1652 struct gm_if *gm_ifp = pim_ifp->mld; ** CID 1519842: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 261 in gm_subscribers_add() ________________________________________________________________________________________________________ *** CID 1519842: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 261 in gm_subscribers_add() 255 256 static uint32_t gm_subscriber_hash(const struct gm_subscriber *a) 257 { 258 return jhash(&a->addr, sizeof(a->addr), 0xd0e94ad4); 259 } 260 >>> CID 1519842: Integer handling issues (BAD_SHIFT) >>> In expression "hval >> 33 - h->hh.tabshift", right shifting by more than 31 bits has undefined behavior. The shift amount, "33 - h->hh.tabshift", is 33. 261 DECLARE_HASH(gm_subscribers, struct gm_subscriber, itm, gm_subscriber_cmp, 262 gm_subscriber_hash); 263 264 static struct gm_subscriber *gm_subscriber_findref(struct gm_if *gm_ifp, 265 pim_addr addr) 266 { ** CID 1519841: Error handling issues (CHECKED_RETURN) /vrrpd/vrrp.c: 1248 in vrrp_socket() ________________________________________________________________________________________________________ *** CID 1519841: Error handling issues (CHECKED_RETURN) /vrrpd/vrrp.c: 1248 in vrrp_socket() 1242 r->vr->vrid, family2str(r->family)); 1243 failed = true; 1244 goto done; 1245 } 1246 1247 /* Turn off multicast loop on Tx */ >>> CID 1519841: Error handling issues (CHECKED_RETURN) >>> Calling "setsockopt_ipv6_multicast_loop" without checking return value (as is done elsewhere 4 out of 5 times). 1248 setsockopt_ipv6_multicast_loop(r->sock_tx, 0); 1249 1250 /* Bind Rx socket to exact interface */ 1251 frr_with_privs(&vrrp_privs) { 1252 ret = setsockopt(r->sock_rx, SOL_SOCKET, 1253 SO_BINDTODEVICE, r->vr->ifp->name, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 15 Aug '22

15 Aug '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 102 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 24 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 102 defect(s) ** CID 1519830: (NULL_RETURNS) /bgpd/bgp_evpn_vty.c: 4059 in no_bgp_evpn_advertise_type5() /bgpd/bgp_evpn_vty.c: 4074 in no_bgp_evpn_advertise_type5() ________________________________________________________________________________________________________ *** CID 1519830: (NULL_RETURNS) /bgpd/bgp_evpn_vty.c: 4059 in no_bgp_evpn_advertise_type5() 4053 4054 if (afi == AFI_IP) { 4055 4056 /* if we are not advertising ipv4 prefix as type-5 4057 * nothing to do 4058 */ >>> CID 1519830: (NULL_RETURNS) >>> Dereferencing "bgp_vrf", which is known to be "NULL". 4059 if ((CHECK_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], 4060 BGP_L2VPN_EVPN_ADV_IPV4_UNICAST)) || 4061 (CHECK_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], 4062 BGP_L2VPN_EVPN_ADV_IPV4_UNICAST_GW_IP))) { 4063 bgp_evpn_withdraw_type5_routes(bgp_vrf, afi, safi); 4064 UNSET_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], /bgpd/bgp_evpn_vty.c: 4074 in no_bgp_evpn_advertise_type5() 4068 } 4069 } else { 4070 4071 /* if we are not advertising ipv6 prefix as type-5 4072 * nothing to do 4073 */ >>> CID 1519830: (NULL_RETURNS) >>> Dereferencing "bgp_vrf", which is known to be "NULL". 4074 if ((CHECK_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], 4075 BGP_L2VPN_EVPN_ADV_IPV6_UNICAST)) || 4076 (CHECK_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], 4077 BGP_L2VPN_EVPN_ADV_IPV6_UNICAST_GW_IP))){ 4078 bgp_evpn_withdraw_type5_routes(bgp_vrf, afi, safi); 4079 UNSET_FLAG(bgp_vrf->af_flags[AFI_L2VPN][SAFI_EVPN], ** CID 1519829: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 151 in plspid_map_add() ________________________________________________________________________________________________________ *** CID 1519829: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 151 in plspid_map_add() 145 static uint32_t nbkey_map_hash(const struct nbkey_map_data *e); 146 static int req_map_cmp(const struct req_map_data *a, 147 const struct req_map_data *b); 148 static uint32_t req_map_hash(const struct req_map_data *e); 149 150 /* Data Structure Declarations */ >>> CID 1519829: Integer handling issues (BAD_SHIFT) >>> In expression "hval >> 33 - h->hh.tabshift", right shifting by more than 31 bits has undefined behavior. The shift amount, "33 - h->hh.tabshift", is 33. 151 DECLARE_HASH(plspid_map, struct plspid_map_data, mi, plspid_map_cmp, 152 plspid_map_hash); 153 DECLARE_HASH(nbkey_map, struct nbkey_map_data, mi, nbkey_map_cmp, 154 nbkey_map_hash); 155 DECLARE_HASH(req_map, struct req_map_data, mi, req_map_cmp, req_map_hash); 156 ** CID 1519828: High impact quality (Y2K38_SAFETY) /pimd/mtracebis_netlink.c: 95 in rtnl_open_byproto() ________________________________________________________________________________________________________ *** CID 1519828: High impact quality (Y2K38_SAFETY) /pimd/mtracebis_netlink.c: 95 in rtnl_open_byproto() 89 } 90 if (rth->local.nl_family != AF_NETLINK) { 91 fprintf(stderr, "Wrong address family %d\n", 92 rth->local.nl_family); 93 return -1; 94 } >>> CID 1519828: High impact quality (Y2K38_SAFETY) >>> A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "time(NULL)" is cast to "__u32". 95 rth->seq = time(NULL); 96 return 0; 97 } 98 99 int rtnl_open(struct rtnl_handle *rth, unsigned subscriptions) 100 { ** CID 1519827: Security best practices violations (DC.WEAK_CRYPTO) /nhrpd/nhrp_peer.c: 337 in nhrp_peer_check() ________________________________________________________________________________________________________ *** CID 1519827: Security best practices violations (DC.WEAK_CRYPTO) /nhrpd/nhrp_peer.c: 337 in nhrp_peer_check() 331 thread_add_timer( 332 master, nhrp_peer_request_timeout, p, 333 (nifp->ipsec_fallback_profile && !p->prio) ? 15 : 30, 334 &p->t_fallback); 335 } else { 336 /* Maximum timeout is 1 second */ >>> CID 1519827: Security best practices violations (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 337 int r_time_ms = rand() % 1000; 338 339 debugf(NHRP_DEBUG_COMMON, 340 "Initiating IPsec connection request to %pSU after %d ms:", 341 &vc->remote.nbma, r_time_ms); 342 thread_add_timer_msec(master, nhrp_peer_defer_vici_request, ** CID 1519826: Integer handling issues (BAD_SHIFT) /lib/qobj.c: 45 in qobj_nodes_add() ________________________________________________________________________________________________________ *** CID 1519826: Integer handling issues (BAD_SHIFT) /lib/qobj.c: 45 in qobj_nodes_add() 39 return -1; 40 if (na->nid > nb->nid) 41 return 1; 42 return 0; 43 } 44 >>> CID 1519826: Integer handling issues (BAD_SHIFT) >>> In expression "hval >> 33 - h->hh.tabshift", right shifting by more than 31 bits has undefined behavior. The shift amount, "33 - h->hh.tabshift", is 33. 45 DECLARE_HASH(qobj_nodes, struct qobj_node, nodehash, 46 qobj_cmp, qobj_hash); 47 48 static pthread_rwlock_t nodes_lock; 49 static struct qobj_nodes_head nodes = { }; 50 ** CID 1519825: Null pointer dereferences (NULL_RETURNS) /ospfd/ospf_ti_lfa.c: 123 in ospf_ti_lfa_find_q_node() ________________________________________________________________________________________________________ *** CID 1519825: Null pointer dereferences (NULL_RETURNS) /ospfd/ospf_ti_lfa.c: 123 in ospf_ti_lfa_find_q_node() 117 { 118 struct listnode *curr_node, *next_node; 119 struct vertex *p_node, *q_node, *q_space_parent = NULL, *pc_node_parent; 120 struct vertex_parent *pc_vertex_parent; 121 122 curr_node = listnode_lookup(q_space->pc_path, pc_node); >>> CID 1519825: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "curr_node", which is known to be "NULL". 123 next_node = curr_node->next; 124 pc_node_parent = listgetdata(next_node); 125 pc_vertex_parent = 126 ospf_spf_vertex_parent_find(pc_node_parent->id, pc_node); 127 128 p_node = ospf_spf_vertex_find(pc_node->id, p_space->vertex_list); ** CID 1519824: Null pointer dereferences (REVERSE_INULL) /pimd/pim_ifchannel.c: 640 in ifjoin_to_noinfo() ________________________________________________________________________________________________________ *** CID 1519824: Null pointer dereferences (REVERSE_INULL) /pimd/pim_ifchannel.c: 640 in ifjoin_to_noinfo() 634 635 static void ifjoin_to_noinfo(struct pim_ifchannel *ch) 636 { 637 pim_ifchannel_ifjoin_switch(__func__, ch, PIM_IFJOIN_NOINFO); 638 pim_forward_stop(ch); 639 >>> CID 1519824: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "ch->upstream" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 640 if (ch->upstream) 641 PIM_UPSTREAM_FLAG_UNSET_SRC_PIM(ch->upstream->flags); 642 643 PIM_IF_FLAG_UNSET_PROTO_PIM(ch->flags); 644 645 delete_on_noinfo(ch); ** CID 1519823: Insecure data handling (TAINTED_SCALAR) /nhrpd/nhrp_peer.c: 1097 in nhrp_packet_debug() ________________________________________________________________________________________________________ *** CID 1519823: Insecure data handling (TAINTED_SCALAR) /nhrpd/nhrp_peer.c: 1097 in nhrp_packet_debug() 1091 if (likely(!(debug_flags & NHRP_DEBUG_COMMON))) 1092 return; 1093 1094 zbuf_init(&zhdr, zb->buf, zb->tail - zb->buf, zb->tail - zb->buf); 1095 hdr = nhrp_packet_pull(&zhdr, &src_nbma, &src_proto, &dst_proto); 1096 >>> CID 1519823: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "hdr->type" as an index into an array "packet_types". 1097 reply = packet_types[hdr->type].type == PACKET_REPLY; 1098 debugf(NHRP_DEBUG_COMMON, "%s %s(%d) %pSU -> %pSU", dir, 1099 (packet_types[hdr->type].name ? packet_types[hdr->type].name 1100 : "Unknown"), 1101 hdr->type, reply ? &dst_proto : &src_proto, 1102 reply ? &src_proto : &dst_proto); ** CID 1519822: High impact quality (Y2K38_SAFETY) /isisd/isis_lsp.c: 1414 in lsp_generate() ________________________________________________________________________________________________________ *** CID 1519822: High impact quality (Y2K38_SAFETY) /isisd/isis_lsp.c: 1414 in lsp_generate() 1408 "ISIS (%s): Built L%d LSP. Set triggered regenerate to non-pending.", 1409 area->area_tag, level); 1410 1411 #ifndef FABRICD 1412 /* send northbound notification */ 1413 isis_notif_lsp_gen(area, newlsp->hdr.lsp_id, newlsp->hdr.seqno, >>> CID 1519822: High impact quality (Y2K38_SAFETY) >>> A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "newlsp->last_generated" is cast to "uint32_t". 1414 newlsp->last_generated); 1415 #endif /* ifndef FABRICD */ 1416 1417 return ISIS_OK; 1418 } 1419 ** CID 1519821: Null pointer dereferences (REVERSE_INULL) /pimd/pim_cmd.c: 5532 in show_ip_msdp_mesh_group() ________________________________________________________________________________________________________ *** CID 1519821: Null pointer dereferences (REVERSE_INULL) /pimd/pim_cmd.c: 5532 in show_ip_msdp_mesh_group() 5526 int idx = 2; 5527 struct pim_msdp_mg *mg; 5528 struct vrf *vrf = pim_cmd_lookup_vrf(vty, argv, argc, &idx); 5529 struct pim_instance *pim = vrf->info; 5530 struct json_object *json = NULL; 5531 >>> CID 1519821: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "vrf" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 5532 if (!vrf) 5533 return CMD_WARNING; 5534 5535 /* Quick case: list is empty. */ 5536 if (SLIST_EMPTY(&pim->msdp.mglist)) { 5537 if (uj) ** CID 1519820: Memory - illegal accesses (USE_AFTER_FREE) /lib/link_state.c: 1805 in ls_msg2edge() ________________________________________________________________________________________________________ *** CID 1519820: Memory - illegal accesses (USE_AFTER_FREE) /lib/link_state.c: 1805 in ls_msg2edge() 1799 break; 1800 default: 1801 edge = NULL; 1802 break; 1803 } 1804 >>> CID 1519820: Memory - illegal accesses (USE_AFTER_FREE) >>> Using freed pointer "edge". 1805 return edge; 1806 } 1807 1808 struct ls_subnet *ls_msg2subnet(struct ls_ted *ted, struct ls_message *msg, 1809 bool delete) 1810 { ** CID 1519819: Memory - illegal accesses (USE_AFTER_FREE) /pathd/path_pcep_pcc.c: 1330 in handle_pcep_lsp_initiate() ________________________________________________________________________________________________________ *** CID 1519819: Memory - illegal accesses (USE_AFTER_FREE) /pathd/path_pcep_pcc.c: 1330 in handle_pcep_lsp_initiate() 1324 } else { 1325 /* FIXME: Monitor the amount of errors from the PCE and 1326 * possibly disconnect and blacklist */ 1327 flog_warn(EC_PATH_PCEP_UNSUPPORTED_PCEP_FEATURE, 1328 "Unsupported PCEP protocol feature: %s", err); 1329 pcep_free_path(path); >>> CID 1519819: Memory - illegal accesses (USE_AFTER_FREE) >>> Passing freed pointer "path" as an argument to "send_pcep_error". 1330 send_pcep_error(pcc_state, PCEP_ERRT_INVALID_OPERATION, 1331 PCEP_ERRV_LSP_NOT_PCE_INITIATED, path); 1332 } 1333 } 1334 1335 void handle_pcep_comp_reply(struct ctrl_state *ctrl_state, ** CID 1519818: Null pointer dereferences (NULL_RETURNS) /pbrd/pbr_vty.c: 173 in pbr_map_match_dst_magic() ________________________________________________________________________________________________________ *** CID 1519818: Null pointer dereferences (NULL_RETURNS) /pbrd/pbr_vty.c: 173 in pbr_map_match_dst_magic() 167 "Choose the dst ip or ipv6 prefix to use\n" 168 "v4 Prefix\n" 169 "v6 Prefix\n") 170 { 171 struct pbr_map_sequence *pbrms = VTY_GET_CONTEXT(pbr_map_sequence); 172 >>> CID 1519818: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "pbrms", which is known to be "NULL". 173 if (pbrms->src && pbrms->family && prefix->family != pbrms->family) { 174 vty_out(vty, "Cannot mismatch families within match src/dst\n"); 175 return CMD_WARNING_CONFIG_FAILED; 176 } 177 178 pbrms->family = prefix->family; ** CID 1519817: Code maintainability issues (UNUSED_VALUE) /zebra/zebra_dplane.c: 3425 in dplane_nexthop_update_internal() ________________________________________________________________________________________________________ *** CID 1519817: Code maintainability issues (UNUSED_VALUE) /zebra/zebra_dplane.c: 3425 in dplane_nexthop_update_internal() 3419 * Return: Result of the change 3420 */ 3421 static enum zebra_dplane_result 3422 dplane_nexthop_update_internal(struct nhg_hash_entry *nhe, enum dplane_op_e op) 3423 { 3424 enum zebra_dplane_result result = ZEBRA_DPLANE_REQUEST_FAILURE; >>> CID 1519817: Code maintainability issues (UNUSED_VALUE) >>> Assigning value "22" to "ret" here, but that stored value is overwritten before it can be used. 3425 int ret = EINVAL; 3426 struct zebra_dplane_ctx *ctx = NULL; 3427 3428 /* Obtain context block */ 3429 ctx = dplane_ctx_alloc(); 3430 if (!ctx) { ** CID 1519816: Error handling issues (CHECKED_RETURN) /pimd/pim_tib.c: 52 in tib_sg_oil_setup() ________________________________________________________________________________________________________ *** CID 1519816: Error handling issues (CHECKED_RETURN) /pimd/pim_tib.c: 52 in tib_sg_oil_setup() 46 pim_addr_to_prefix(&grp, sg.grp); 47 48 up = pim_upstream_find(pim, &sg); 49 if (up) { 50 memcpy(&nexthop, &up->rpf.source_nexthop, 51 sizeof(struct pim_nexthop)); >>> CID 1519816: Error handling issues (CHECKED_RETURN) >>> Calling "pim_ecmp_nexthop_lookup" without checking return value (as is done elsewhere 8 out of 9 times). 52 pim_ecmp_nexthop_lookup(pim, &nexthop, vif_source, &grp, 0); 53 if (nexthop.interface) 54 input_iface_vif_index = pim_if_find_vifindex_by_ifindex( 55 pim, nexthop.interface->ifindex); 56 } else 57 input_iface_vif_index = ** CID 1519815: (TAINTED_SCALAR) /nhrpd/nhrp_peer.c: 976 in nhrp_peer_forward() /nhrpd/nhrp_peer.c: 1003 in nhrp_peer_forward() ________________________________________________________________________________________________________ *** CID 1519815: (TAINTED_SCALAR) /nhrpd/nhrp_peer.c: 976 in nhrp_peer_forward() 970 goto err; 971 972 switch (type) { 973 case NHRP_EXTENSION_FORWARD_TRANSIT_NHS: 974 case NHRP_EXTENSION_REVERSE_TRANSIT_NHS: 975 zbuf_put(zb, extpl.head, len); >>> CID 1519815: (TAINTED_SCALAR) >>> Using tainted variable "hdr->type" as an index into an array "packet_types". 976 if ((type == NHRP_EXTENSION_REVERSE_TRANSIT_NHS) 977 == (packet_types[hdr->type].type == PACKET_REPLY)) { 978 /* Check NHS list for forwarding loop */ 979 while (nhrp_cie_pull(&extpl, pp->hdr, 980 &cie_nbma, 981 &cie_protocol) != NULL) { /nhrpd/nhrp_peer.c: 1003 in nhrp_peer_forward() 997 proto = NULL; 998 999 /* If NAT extension is empty then attempt to populate 1000 * it with cached NBMA information 1001 */ 1002 if (len == 0) { >>> CID 1519815: (TAINTED_SCALAR) >>> Using tainted variable "hdr->type" as an index into an array "packet_types". 1003 if (packet_types[hdr->type].type 1004 == PACKET_REQUEST) { 1005 debugf(NHRP_DEBUG_COMMON, 1006 "Processing NHRP_EXTENSION_NAT_ADDRESS while forwarding the request packet"); 1007 proto = &pp->src_proto; 1008 } else if (packet_types[hdr->type].type ** CID 1519814: Null pointer dereferences (NULL_RETURNS) /pbrd/pbr_vty.c: 627 in pbr_map_nexthop_magic() ________________________________________________________________________________________________________ *** CID 1519814: Null pointer dereferences (NULL_RETURNS) /pbrd/pbr_vty.c: 627 in pbr_map_nexthop_magic() 621 nhop.type = NEXTHOP_TYPE_IPV6; 622 } 623 } 624 } else 625 nhop.type = NEXTHOP_TYPE_IFINDEX; 626 >>> CID 1519814: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "pbrms", which is known to be "NULL". 627 if (pbrms->nhg) 628 nh = nexthop_exists(pbrms->nhg, &nhop); 629 630 if (nh) /* Same config re-entered */ 631 goto done; 632 ** CID 1519813: (NULL_RETURNS) /pbrd/pbr_vty.c: 254 in pbr_map_match_dst_port_magic() /pbrd/pbr_vty.c: 259 in pbr_map_match_dst_port_magic() ________________________________________________________________________________________________________ *** CID 1519813: (NULL_RETURNS) /pbrd/pbr_vty.c: 254 in pbr_map_match_dst_port_magic() 248 "Choose the destination port to use\n" 249 "The Destination Port\n") 250 { 251 struct pbr_map_sequence *pbrms = VTY_GET_CONTEXT(pbr_map_sequence); 252 253 if (!no) { >>> CID 1519813: (NULL_RETURNS) >>> Dereferencing "pbrms", which is known to be "NULL". 254 if (pbrms->dst_prt == port) 255 return CMD_SUCCESS; 256 else 257 pbrms->dst_prt = port; 258 } else 259 pbrms->dst_prt = 0; /pbrd/pbr_vty.c: 259 in pbr_map_match_dst_port_magic() 253 if (!no) { 254 if (pbrms->dst_prt == port) 255 return CMD_SUCCESS; 256 else 257 pbrms->dst_prt = port; 258 } else >>> CID 1519813: (NULL_RETURNS) >>> Dereferencing "pbrms", which is known to be "NULL". 259 pbrms->dst_prt = 0; 260 261 pbr_map_check(pbrms, true); 262 263 return CMD_SUCCESS; 264 } ** CID 1519812: High impact quality (Y2K38_SAFETY) /zebra/zebra_netns_id.c: 76 in initiate_nlh() ________________________________________________________________________________________________________ *** CID 1519812: High impact quality (Y2K38_SAFETY) /zebra/zebra_netns_id.c: 76 in initiate_nlh() 70 nlh->nlmsg_len = NETLINK_ALIGN(sizeof(struct nlmsghdr)); 71 72 nlh->nlmsg_type = type; 73 nlh->nlmsg_flags = NLM_F_REQUEST; 74 if (type == RTM_NEWNSID) 75 nlh->nlmsg_flags |= NLM_F_ACK; >>> CID 1519812: High impact quality (Y2K38_SAFETY) >>> A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "time(NULL)" is cast to "unsigned int". 76 nlh->nlmsg_seq = *seq = time(NULL); 77 return nlh; 78 } 79 80 static int send_receive(int sock, struct nlmsghdr *nlh, unsigned int seq, 81 char *buf) ** CID 1519811: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1519811: Null pointer dereferences (NULL_RETURNS) /pbrd/pbr_vty.c: 725 in no_pbr_map_vrf_magic() 719 "Specify the VRF for this map\n" 720 "The VRF Name\n" 721 "Use the interface's VRF for lookup\n") 722 { 723 struct pbr_map_sequence *pbrms = VTY_GET_CONTEXT(pbr_map_sequence); 724 >>> CID 1519811: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "pbrms" when calling "pbrms_clear_set_config". 725 pbrms_clear_set_config(pbrms); 726 727 return CMD_SUCCESS; 728 } 729 730 DEFPY (pbr_policy, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0