January 2024 - dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 30 Jan '24

30 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 12 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 12 of 12 defect(s) ** CID 1576456: Error handling issues (CHECKED_RETURN) /zebra/zebra_cli.c: 446 in link_params_admin_grp_magic() ________________________________________________________________________________________________________ *** CID 1576456: Error handling issues (CHECKED_RETURN) /zebra/zebra_cli.c: 446 in link_params_admin_grp_magic() 440 if (bitpattern[0] != '0' || bitpattern[1] != 'x' || 441 strlen(bitpattern) > 10) { 442 vty_out(vty, "Invalid bitpattern value\n"); 443 return CMD_WARNING_CONFIG_FAILED; 444 } 445 >>> CID 1576456: Error handling issues (CHECKED_RETURN) >>> Calling "sscanf" without checking return value (as is done elsewhere 46 out of 47 times). 446 sscanf(bitpattern, "%x", &value); 447 snprintf(value_str, sizeof(value_str), "%u", value); 448 449 nb_cli_enqueue_change(vty, "./legacy-admin-group", NB_OP_MODIFY, 450 value_str); 451 } else { ** CID 1576455: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1576455: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_cli_clippy.c: 941 in link_params_res_bw() 935 #if 0 /* anything that can fail? */ 936 if (_failcnt) 937 return CMD_WARNING; 938 #endif 939 #endif 940 >>> CID 1576455: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bandwidth" to "link_params_res_bw_magic", which dereferences it. 941 return link_params_res_bw_magic(self, vty, argc, argv, no, bandwidth); 942 } 943 944 /* link_params_ava_bw => "[no] ava-bw ![BANDWIDTH]" */ 945 DEFUN_CMD_FUNC_DECL(link_params_ava_bw) 946 #define funcdecl_link_params_ava_bw static int link_params_ava_bw_magic(\ ** CID 1576454: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1576454: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_cli_clippy.c: 1039 in link_params_use_bw() 1033 #if 0 /* anything that can fail? */ 1034 if (_failcnt) 1035 return CMD_WARNING; 1036 #endif 1037 #endif 1038 >>> CID 1576454: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bandwidth" to "link_params_use_bw_magic", which dereferences it. 1039 return link_params_use_bw_magic(self, vty, argc, argv, no, bandwidth); 1040 } 1041 1042 /* link_params_affinity => "[no] affinity NAME..." */ 1043 DEFUN_CMD_FUNC_DECL(link_params_affinity) 1044 #define funcdecl_link_params_affinity static int link_params_affinity_magic(\ ** CID 1576453: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1576453: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_cli_clippy.c: 990 in link_params_ava_bw() 984 #if 0 /* anything that can fail? */ 985 if (_failcnt) 986 return CMD_WARNING; 987 #endif 988 #endif 989 >>> CID 1576453: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bandwidth" to "link_params_ava_bw_magic", which dereferences it. 990 return link_params_ava_bw_magic(self, vty, argc, argv, no, bandwidth); 991 } 992 993 /* link_params_use_bw => "[no] use-bw ![BANDWIDTH]" */ 994 DEFUN_CMD_FUNC_DECL(link_params_use_bw) 995 #define funcdecl_link_params_use_bw static int link_params_use_bw_magic(\ ** CID 1576452: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1576452: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_cli_clippy.c: 653 in link_params_admin_grp() 647 #if 0 /* anything that can fail? */ 648 if (_failcnt) 649 return CMD_WARNING; 650 #endif 651 #endif 652 >>> CID 1576452: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bitpattern" to "link_params_admin_grp_magic", which dereferences it. 653 return link_params_admin_grp_magic(self, vty, argc, argv, no, bitpattern); 654 } 655 656 /* link_params_inter_as => "[no] neighbor ![A.B.C.D$ip as (1-4294967295)$as]" */ 657 DEFUN_CMD_FUNC_DECL(link_params_inter_as) 658 #define funcdecl_link_params_inter_as static int link_params_inter_as_magic(\ ** CID 1576451: Error handling issues (CHECKED_RETURN) /zebra/zebra_nb_config.c: 2223 in evpn_mh_dnode_to_esi() ________________________________________________________________________________________________________ *** CID 1576451: Error handling issues (CHECKED_RETURN) /zebra/zebra_nb_config.c: 2223 in evpn_mh_dnode_to_esi() 2217 return NB_OK; 2218 } 2219 2220 static bool evpn_mh_dnode_to_esi(const struct lyd_node *dnode, esi_t *esi) 2221 { 2222 if (yang_dnode_exists(dnode, "type-0/esi")) { >>> CID 1576451: Error handling issues (CHECKED_RETURN) >>> Calling "str_to_esi" without checking return value (as is done elsewhere 8 out of 10 times). 2223 str_to_esi(yang_dnode_get_string(dnode, "type-0/esi"), esi); 2224 } else if (yang_dnode_exists(dnode, "type-3/system-mac") && 2225 yang_dnode_exists(dnode, "type-3/local-discriminator")) { 2226 struct ethaddr mac; 2227 uint32_t lid; 2228 ** CID 1576450: Error handling issues (CHECKED_RETURN) /zebra/zebra_nb_config.c: 2304 in lib_interface_zebra_evpn_mh_type_0_esi_modify() ________________________________________________________________________________________________________ *** CID 1576450: Error handling issues (CHECKED_RETURN) /zebra/zebra_nb_config.c: 2304 in lib_interface_zebra_evpn_mh_type_0_esi_modify() 2298 break; 2299 case NB_EV_PREPARE: 2300 case NB_EV_ABORT: 2301 break; 2302 case NB_EV_APPLY: 2303 ifp = nb_running_get_entry(args->dnode, NULL, true); >>> CID 1576450: Error handling issues (CHECKED_RETURN) >>> Calling "str_to_esi" without checking return value (as is done elsewhere 8 out of 10 times). 2304 str_to_esi(yang_dnode_get_string(args->dnode, NULL), &esi); 2305 zebra_evpn_es_type0_esi_update(ifp->info, &esi); 2306 break; 2307 } 2308 2309 return NB_OK; ** CID 1576449: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 889 in ip_address_peer_magic() ________________________________________________________________________________________________________ *** CID 1576449: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 889 in ip_address_peer_magic() 883 #endif 884 } 885 886 strlcpy(peer_ip, peer_str, sizeof(peer_ip)); 887 888 peer_mask = strchr(peer_ip, '/'); >>> CID 1576449: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "peer_mask", which is known to be "NULL". 889 *peer_mask = 0; 890 peer_mask++; 891 892 return nb_cli_apply_changes( 893 vty, 894 "./frr-zebra:zebra/ipv4-p2p-addrs[ip='%s'][peer-ip='%s'][peer-prefix-length='%s']", ** CID 1576448: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 937 in ipv6_address_magic() ________________________________________________________________________________________________________ *** CID 1576448: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 937 in ipv6_address_magic() 931 else 932 nb_cli_enqueue_change(vty, ".", NB_OP_CREATE, NULL); 933 934 strlcpy(ip, address_str, sizeof(ip)); 935 936 mask = strchr(ip, '/'); >>> CID 1576448: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "mask", which is known to be "NULL". 937 *mask = 0; 938 mask++; 939 940 return nb_cli_apply_changes(vty, 941 "./frr-zebra:zebra/ipv6-addrs[ip='%s'][prefix-length='%s']", 942 ip, mask); ** CID 1576447: Uninitialized variables (UNINIT) ________________________________________________________________________________________________________ *** CID 1576447: Uninitialized variables (UNINIT) /zebra/zebra_nb_config.c: 3049 in lib_interface_zebra_ipv6_router_advertisements_rdnss_rdnss_address_create() 3043 rdnss.lifetime = yang_dnode_get_uint32(args->dnode, "lifetime"); 3044 rdnss.lifetime_set = 1; 3045 } else { 3046 rdnss.lifetime_set = 0; 3047 } 3048 >>> CID 1576447: Uninitialized variables (UNINIT) >>> Using uninitialized value "rdnss". Field "rdnss.lifetime" is uninitialized when calling "rtadv_rdnss_set". 3049 p = rtadv_rdnss_set(ifp->info, &rdnss); 3050 nb_running_set_entry(args->dnode, p); 3051 3052 return NB_OK; 3053 } 3054 ** CID 1576446: Uninitialized variables (UNINIT) ________________________________________________________________________________________________________ *** CID 1576446: Uninitialized variables (UNINIT) /zebra/zebra_nb_config.c: 3140 in lib_interface_zebra_ipv6_router_advertisements_dnssl_dnssl_domain_create() 3134 dnssl.lifetime = yang_dnode_get_uint32(args->dnode, "lifetime"); 3135 dnssl.lifetime_set = 1; 3136 } else { 3137 dnssl.lifetime_set = 0; 3138 } 3139 >>> CID 1576446: Uninitialized variables (UNINIT) >>> Using uninitialized value "dnssl". Field "dnssl.encoded_len" is uninitialized when calling "rtadv_dnssl_set". 3140 p = rtadv_dnssl_set(ifp->info, &dnssl); 3141 nb_running_set_entry(args->dnode, p); 3142 3143 return NB_OK; 3144 } 3145 ** CID 1576445: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 820 in ip_address_magic() ________________________________________________________________________________________________________ *** CID 1576445: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_cli.c: 820 in ip_address_magic() 814 #endif 815 } 816 817 strlcpy(ip, address_str, sizeof(ip)); 818 819 mask = strchr(ip, '/'); >>> CID 1576445: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "mask", which is known to be "NULL". 820 *mask = 0; 821 mask++; 822 823 return nb_cli_apply_changes(vty, 824 "./frr-zebra:zebra/ipv4-addrs[ip='%s'][prefix-length='%s']", 825 ip, mask); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 25 Jan '24

25 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1576137: (UNUSED_VALUE) /pceplib/test/pcep_msg_tlvs_test.c: 202 in test_pcep_tlv_create_path_setup_type_capability() /pceplib/test/pcep_msg_tlvs_test.c: 184 in test_pcep_tlv_create_path_setup_type_capability() /pceplib/test/pcep_msg_tlvs_test.c: 193 in test_pcep_tlv_create_path_setup_type_capability() ________________________________________________________________________________________________________ *** CID 1576137: (UNUSED_VALUE) /pceplib/test/pcep_msg_tlvs_test.c: 202 in test_pcep_tlv_create_path_setup_type_capability() 196 /* Should still return NULL if pst_list is empty */ 197 tlv = pcep_tlv_create_path_setup_type_capability(pst_list, 198 sub_tlv_list); 199 CU_ASSERT_PTR_NULL(tlv); 200 if (tlv != NULL) { 201 pcep_obj_free_tlv(&tlv->header); >>> CID 1576137: (UNUSED_VALUE) >>> Assigning value "NULL" to "tlv" here, but that stored value is overwritten before it can be used. 202 tlv = NULL; 203 } 204 205 /* Test only populating the pst list */ 206 uint8_t *pst1 = pceplib_malloc(PCEPLIB_MESSAGES, 1); 207 uint8_t *pst2 = pceplib_malloc(PCEPLIB_MESSAGES, 1); /pceplib/test/pcep_msg_tlvs_test.c: 184 in test_pcep_tlv_create_path_setup_type_capability() 178 /* Should return NULL if pst_list is empty */ 179 double_linked_list *pst_list = dll_initialize(); 180 tlv = pcep_tlv_create_path_setup_type_capability(pst_list, NULL); 181 CU_ASSERT_PTR_NULL(tlv); 182 if (tlv != NULL) { 183 pcep_obj_free_tlv(&tlv->header); >>> CID 1576137: (UNUSED_VALUE) >>> Assigning value "NULL" to "tlv" here, but that stored value is overwritten before it can be used. 184 tlv = NULL; 185 } 186 187 /* Should still return NULL if pst_list is NULL */ 188 double_linked_list *sub_tlv_list = dll_initialize(); 189 tlv = pcep_tlv_create_path_setup_type_capability(NULL, sub_tlv_list); /pceplib/test/pcep_msg_tlvs_test.c: 193 in test_pcep_tlv_create_path_setup_type_capability() 187 /* Should still return NULL if pst_list is NULL */ 188 double_linked_list *sub_tlv_list = dll_initialize(); 189 tlv = pcep_tlv_create_path_setup_type_capability(NULL, sub_tlv_list); 190 CU_ASSERT_PTR_NULL(tlv); 191 if (tlv != NULL) { 192 pcep_obj_free_tlv(&tlv->header); >>> CID 1576137: (UNUSED_VALUE) >>> Assigning value "NULL" to "tlv" here, but that stored value is overwritten before it can be used. 193 tlv = NULL; 194 } 195 196 /* Should still return NULL if pst_list is empty */ 197 tlv = pcep_tlv_create_path_setup_type_capability(pst_list, 198 sub_tlv_list); ** CID 1576136: Code maintainability issues (UNUSED_VALUE) /pceplib/test/pcep_msg_tlvs_test.c: 110 in test_pcep_tlv_create_speaker_entity_id() ________________________________________________________________________________________________________ *** CID 1576136: Code maintainability issues (UNUSED_VALUE) /pceplib/test/pcep_msg_tlvs_test.c: 110 in test_pcep_tlv_create_speaker_entity_id() 104 105 double_linked_list *list = dll_initialize(); 106 tlv = pcep_tlv_create_speaker_entity_id(list); 107 CU_ASSERT_PTR_NULL(tlv); 108 if (tlv != NULL) { 109 pceplib_free(PCEPLIB_INFRA, tlv); >>> CID 1576136: Code maintainability issues (UNUSED_VALUE) >>> Assigning value "NULL" to "tlv" here, but that stored value is overwritten before it can be used. 110 tlv = NULL; 111 } 112 113 uint32_t *speaker_entity = 114 pceplib_malloc(PCEPLIB_MESSAGES, sizeof(uint32_t)); 115 *speaker_entity = 42; ** CID 1576135: (UNUSED_VALUE) /pceplib/test/pcep_msg_messages_test.c: 403 in test_pcep_msg_create_update() /pceplib/test/pcep_msg_messages_test.c: 422 in test_pcep_msg_create_update() ________________________________________________________________________________________________________ *** CID 1576135: (UNUSED_VALUE) /pceplib/test/pcep_msg_messages_test.c: 403 in test_pcep_msg_create_update() 397 398 /* Should return NULL if obj_list is empty */ 399 message = pcep_msg_create_update(obj_list); 400 CU_ASSERT_PTR_NULL(message); 401 if (message != NULL) { 402 pcep_msg_free_message(message); >>> CID 1576135: (UNUSED_VALUE) >>> Assigning value "NULL" to "message" here, but that stored value is overwritten before it can be used. 403 message = NULL; 404 } 405 406 struct pcep_object_srp *srp = pcep_obj_create_srp(false, 100, NULL); 407 struct pcep_object_lsp *lsp = 408 pcep_obj_create_lsp(100, PCEP_LSP_OPERATIONAL_UP, true, true, /pceplib/test/pcep_msg_messages_test.c: 422 in test_pcep_msg_create_update() 416 message = pcep_msg_create_update(obj_list); 417 CU_ASSERT_PTR_NULL(message); 418 419 dll_append(obj_list, ero); 420 if (message != NULL) { 421 pcep_msg_free_message(message); >>> CID 1576135: (UNUSED_VALUE) >>> Assigning value "NULL" to "message" here, but that stored value is overwritten before it can be used. 422 message = NULL; 423 } 424 message = pcep_msg_create_update(obj_list); 425 CU_ASSERT_PTR_NOT_NULL(message); 426 pcep_encode_message(message, versioning); 427 assert(message != NULL); ** CID 1576134: (UNUSED_VALUE) /pceplib/test/pcep_msg_messages_test.c: 471 in test_pcep_msg_create_initiate() /pceplib/test/pcep_msg_messages_test.c: 455 in test_pcep_msg_create_initiate() ________________________________________________________________________________________________________ *** CID 1576134: (UNUSED_VALUE) /pceplib/test/pcep_msg_messages_test.c: 471 in test_pcep_msg_create_initiate() 465 /* Should return NULL if obj_list does not have 2 entries */ 466 dll_append(obj_list, srp); 467 message = pcep_msg_create_initiate(obj_list); 468 CU_ASSERT_PTR_NULL(message); 469 if (message != NULL) { 470 pcep_msg_free_message(message); >>> CID 1576134: (UNUSED_VALUE) >>> Assigning value "NULL" to "message" here, but that stored value is overwritten before it can be used. 471 message = NULL; 472 } 473 474 dll_append(obj_list, lsp); 475 dll_append(obj_list, ero); 476 message = pcep_msg_create_initiate(obj_list); /pceplib/test/pcep_msg_messages_test.c: 455 in test_pcep_msg_create_initiate() 449 450 /* Should return NULL if obj_list is empty */ 451 struct pcep_message *message = pcep_msg_create_initiate(NULL); 452 CU_ASSERT_PTR_NULL(message); 453 if (message != NULL) { 454 pcep_msg_free_message(message); >>> CID 1576134: (UNUSED_VALUE) >>> Assigning value "NULL" to "message" here, but that stored value is overwritten before it can be used. 455 message = NULL; 456 } 457 458 struct pcep_object_srp *srp = pcep_obj_create_srp(false, 100, NULL); 459 struct pcep_object_lsp *lsp = 460 pcep_obj_create_lsp(100, PCEP_LSP_OPERATIONAL_UP, true, true, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 23 Jan '24

23 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1576001: Incorrect expression (PW.ASSIGN_WHERE_COMPARE_MEANT) /sharpd/sharp_zebra.c: 1020 in () ________________________________________________________________________________________________________ *** CID 1576001: Incorrect expression (PW.ASSIGN_WHERE_COMPARE_MEANT) /sharpd/sharp_zebra.c: 1020 in () 1014 if (!ifp) { 1015 zlog_debug("Failed to lookup interface for neighbor entry: %u for %u", 1016 api.index, vrf_id); 1017 return 0; 1018 } 1019 >>> CID 1576001: Incorrect expression (PW.ASSIGN_WHERE_COMPARE_MEANT) >>> use of "=" where "==" may have been intended 1020 zlog_debug("Received: %s %pSU dev %s lladr %pSU", 1021 (cmd = ZEBRA_NEIGH_ADDED) ? "NEW" : "DEL", &addr, ifp->name, 1022 &lladdr); 1023 1024 return 0; 1025 } ** CID 1576000: Parse warnings (PW.PARAM_SET_BUT_NOT_USED) /sharpd/sharp_zebra.c: 992 in () ________________________________________________________________________________________________________ *** CID 1576000: Parse warnings (PW.PARAM_SET_BUT_NOT_USED) /sharpd/sharp_zebra.c: 992 in () 986 } 987 988 zlog_err("%s: can't get locator_chunk!!", __func__); 989 return 0; 990 } 991 >>> CID 1576000: Parse warnings (PW.PARAM_SET_BUT_NOT_USED) >>> parameter "cmd" was set but never used 992 static int sharp_zebra_process_neigh(ZAPI_CALLBACK_ARGS) 993 { 994 union sockunion addr = {}, lladdr = {}; 995 struct zapi_neigh_ip api = {}; 996 struct interface *ifp; 997 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 23 Jan '24

23 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 16 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 16 of 16 defect(s) ** CID 1575926: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1772 in rpki_expire_interval_magic() /bgpd/bgp_rpki.c: 1772 in rpki_expire_interval_magic() ________________________________________________________________________________________________________ *** CID 1575926: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1772 in rpki_expire_interval_magic() 1766 1767 if (vty->node == RPKI_VRF_NODE) 1768 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1769 else 1770 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1771 >>> CID 1575926: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1772 if ((unsigned int)tmp >= rpki_vrf->polling_period) { 1773 rpki_vrf->expire_interval = tmp; 1774 return CMD_SUCCESS; 1775 } 1776 1777 vty_out(vty, "%% Expiry interval must be polling period or larger\n"); /bgpd/bgp_rpki.c: 1772 in rpki_expire_interval_magic() 1766 1767 if (vty->node == RPKI_VRF_NODE) 1768 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1769 else 1770 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1771 >>> CID 1575926: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1772 if ((unsigned int)tmp >= rpki_vrf->polling_period) { 1773 rpki_vrf->expire_interval = tmp; 1774 return CMD_SUCCESS; 1775 } 1776 1777 vty_out(vty, "%% Expiry interval must be polling period or larger\n"); ** CID 1575925: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1833 in no_rpki_retry_interval() /bgpd/bgp_rpki.c: 1833 in no_rpki_retry_interval() ________________________________________________________________________________________________________ *** CID 1575925: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1833 in no_rpki_retry_interval() 1827 1828 if (vty->node == RPKI_VRF_NODE) 1829 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1830 else 1831 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1832 >>> CID 1575925: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1833 rpki_vrf->retry_interval = RETRY_INTERVAL_DEFAULT; 1834 return CMD_SUCCESS; 1835 } 1836 1837 DEFPY(rpki_cache, rpki_cache_cmd, 1838 "rpki cache <A.B.C.D|WORD> <TCPPORT|(1-65535)$sshport SSH_UNAME SSH_PRIVKEY [SERVER_PUBKEY]> [source <A.B.C.D>$bindaddr] preference (1-255)", /bgpd/bgp_rpki.c: 1833 in no_rpki_retry_interval() 1827 1828 if (vty->node == RPKI_VRF_NODE) 1829 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1830 else 1831 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1832 >>> CID 1575925: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1833 rpki_vrf->retry_interval = RETRY_INTERVAL_DEFAULT; 1834 return CMD_SUCCESS; 1835 } 1836 1837 DEFPY(rpki_cache, rpki_cache_cmd, 1838 "rpki cache <A.B.C.D|WORD> <TCPPORT|(1-65535)$sshport SSH_UNAME SSH_PRIVKEY [SERVER_PUBKEY]> [source <A.B.C.D>$bindaddr] preference (1-255)", ** CID 1575924: (CHECKED_RETURN) /bgpd/bgp_rpki.c: 1348 in rpki_create_socket() /bgpd/bgp_rpki.c: 1349 in rpki_create_socket() ________________________________________________________________________________________________________ *** CID 1575924: (CHECKED_RETURN) /bgpd/bgp_rpki.c: 1348 in rpki_create_socket() 1342 1343 pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &cancel_state); 1344 timeout.tv_sec = 30; 1345 timeout.tv_usec = 0; 1346 1347 optlen = sizeof(prev_rcv_tmout); >>> CID 1575924: (CHECKED_RETURN) >>> Calling "getsockopt(socket, 1, 20, &prev_rcv_tmout, &optlen)" without checking return value. This library function may fail and return an error code. 1348 getsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, &optlen); 1349 getsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, &optlen); 1350 1351 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)); 1352 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)); 1353 /bgpd/bgp_rpki.c: 1349 in rpki_create_socket() 1343 pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &cancel_state); 1344 timeout.tv_sec = 30; 1345 timeout.tv_usec = 0; 1346 1347 optlen = sizeof(prev_rcv_tmout); 1348 getsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, &optlen); >>> CID 1575924: (CHECKED_RETURN) >>> Calling "getsockopt(socket, 1, 21, &prev_snd_tmout, &optlen)" without checking return value. This library function may fail and return an error code. 1349 getsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, &optlen); 1350 1351 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)); 1352 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)); 1353 1354 if (connect(socket, res->ai_addr, res->ai_addrlen) == -1) { ** CID 1575923: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1735 in rpki_polling_period_magic() /bgpd/bgp_rpki.c: 1735 in rpki_polling_period_magic() ________________________________________________________________________________________________________ *** CID 1575923: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1735 in rpki_polling_period_magic() 1729 1730 if (vty->node == RPKI_VRF_NODE) 1731 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1732 else 1733 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1734 >>> CID 1575923: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1735 rpki_vrf->polling_period = pp; 1736 return CMD_SUCCESS; 1737 } 1738 1739 DEFUN (no_rpki_polling_period, 1740 no_rpki_polling_period_cmd, /bgpd/bgp_rpki.c: 1735 in rpki_polling_period_magic() 1729 1730 if (vty->node == RPKI_VRF_NODE) 1731 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1732 else 1733 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1734 >>> CID 1575923: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1735 rpki_vrf->polling_period = pp; 1736 return CMD_SUCCESS; 1737 } 1738 1739 DEFUN (no_rpki_polling_period, 1740 no_rpki_polling_period_cmd, ** CID 1575922: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1754 in no_rpki_polling_period() /bgpd/bgp_rpki.c: 1754 in no_rpki_polling_period() ________________________________________________________________________________________________________ *** CID 1575922: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1754 in no_rpki_polling_period() 1748 1749 if (vty->node == RPKI_VRF_NODE) 1750 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1751 else 1752 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1753 >>> CID 1575922: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1754 rpki_vrf->polling_period = POLLING_PERIOD_DEFAULT; 1755 return CMD_SUCCESS; 1756 } 1757 1758 DEFPY (rpki_expire_interval, 1759 rpki_expire_interval_cmd, /bgpd/bgp_rpki.c: 1754 in no_rpki_polling_period() 1748 1749 if (vty->node == RPKI_VRF_NODE) 1750 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1751 else 1752 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1753 >>> CID 1575922: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1754 rpki_vrf->polling_period = POLLING_PERIOD_DEFAULT; 1755 return CMD_SUCCESS; 1756 } 1757 1758 DEFPY (rpki_expire_interval, 1759 rpki_expire_interval_cmd, ** CID 1575921: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1796 in no_rpki_expire_interval() /bgpd/bgp_rpki.c: 1796 in no_rpki_expire_interval() ________________________________________________________________________________________________________ *** CID 1575921: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1796 in no_rpki_expire_interval() 1790 1791 if (vty->node == RPKI_VRF_NODE) 1792 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1793 else 1794 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1795 >>> CID 1575921: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1796 rpki_vrf->expire_interval = rpki_vrf->polling_period * 2; 1797 return CMD_SUCCESS; 1798 } 1799 1800 DEFPY (rpki_retry_interval, 1801 rpki_retry_interval_cmd, /bgpd/bgp_rpki.c: 1796 in no_rpki_expire_interval() 1790 1791 if (vty->node == RPKI_VRF_NODE) 1792 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1793 else 1794 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1795 >>> CID 1575921: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1796 rpki_vrf->expire_interval = rpki_vrf->polling_period * 2; 1797 return CMD_SUCCESS; 1798 } 1799 1800 DEFPY (rpki_retry_interval, 1801 rpki_retry_interval_cmd, ** CID 1575920: (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1575920: (NULL_RETURNS) /bgpd/bgp_rpki.c: 2425 in config_on_exit() 2419 struct rpki_vrf *rpki_vrf; 2420 2421 if (vty->node == RPKI_VRF_NODE) 2422 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 2423 else 2424 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); >>> CID 1575920: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "rpki_vrf" when calling "reset". 2425 reset(false, rpki_vrf); 2426 return 1; 2427 } 2428 2429 DEFPY(rpki_reset, 2430 rpki_reset_cmd, /bgpd/bgp_rpki.c: 2425 in config_on_exit() 2419 struct rpki_vrf *rpki_vrf; 2420 2421 if (vty->node == RPKI_VRF_NODE) 2422 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 2423 else 2424 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); >>> CID 1575920: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "rpki_vrf" when calling "reset". 2425 reset(false, rpki_vrf); 2426 return 1; 2427 } 2428 2429 DEFPY(rpki_reset, 2430 rpki_reset_cmd, ** CID 1575919: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1933 in no_rpki_cache_magic() /bgpd/bgp_rpki.c: 1933 in no_rpki_cache_magic() ________________________________________________________________________________________________________ *** CID 1575919: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1933 in no_rpki_cache_magic() 1927 1928 if (vty->node == RPKI_VRF_NODE) 1929 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1930 else 1931 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1932 >>> CID 1575919: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1933 cache_list = rpki_vrf->cache_list; 1934 cache_p = find_cache(preference, cache_list); 1935 if (!rpki_vrf || !cache_p) { 1936 vty_out(vty, "Could not find cache with preference %ld\n", 1937 preference); 1938 return CMD_WARNING; /bgpd/bgp_rpki.c: 1933 in no_rpki_cache_magic() 1927 1928 if (vty->node == RPKI_VRF_NODE) 1929 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1930 else 1931 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1932 >>> CID 1575919: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1933 cache_list = rpki_vrf->cache_list; 1934 cache_p = find_cache(preference, cache_list); 1935 if (!rpki_vrf || !cache_p) { 1936 vty_out(vty, "Could not find cache with preference %ld\n", 1937 preference); 1938 return CMD_WARNING; ** CID 1575918: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_rpki.c: 1294 in rpki_create_socket() ________________________________________________________________________________________________________ *** CID 1575918: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_rpki.c: 1294 in rpki_create_socket() 1288 int ret; 1289 #if defined(FOUND_SSH) 1290 struct tr_ssh_config *ssh_config; 1291 char s_port[10]; 1292 #endif 1293 >>> CID 1575918: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "cache" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1294 if (!cache) 1295 return -1; 1296 1297 if (rpki_vrf->vrfname == NULL) 1298 vrf = vrf_lookup_by_id(VRF_DEFAULT); 1299 else ** CID 1575917: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_rpki.c: 1631 in rpki() ________________________________________________________________________________________________________ *** CID 1575917: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_rpki.c: 1631 in rpki() 1625 if (vty->node == CONFIG_NODE) 1626 vty->node = RPKI_NODE; 1627 else { 1628 struct vrf *vrf = VTY_GET_CONTEXT(vrf); 1629 1630 vty->node = RPKI_VRF_NODE; >>> CID 1575917: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "vrf", which is known to be "NULL". 1631 if (vrf->vrf_id != VRF_DEFAULT) 1632 vrfname = vrf->name; 1633 } 1634 1635 rpki_vrf = find_rpki_vrf(vrfname); 1636 if (!rpki_vrf) { ** CID 1575916: (CHECKED_RETURN) /bgpd/bgp_rpki.c: 1352 in rpki_create_socket() /bgpd/bgp_rpki.c: 1366 in rpki_create_socket() /bgpd/bgp_rpki.c: 1351 in rpki_create_socket() /bgpd/bgp_rpki.c: 1368 in rpki_create_socket() ________________________________________________________________________________________________________ *** CID 1575916: (CHECKED_RETURN) /bgpd/bgp_rpki.c: 1352 in rpki_create_socket() 1346 1347 optlen = sizeof(prev_rcv_tmout); 1348 getsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, &optlen); 1349 getsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, &optlen); 1350 1351 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)); >>> CID 1575916: (CHECKED_RETURN) >>> Calling "setsockopt(socket, 1, 21, &timeout, 16U)" without checking return value. This library function may fail and return an error code. 1352 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)); 1353 1354 if (connect(socket, res->ai_addr, res->ai_addrlen) == -1) { 1355 if (res) 1356 freeaddrinfo(res); 1357 close(socket); /bgpd/bgp_rpki.c: 1366 in rpki_create_socket() 1360 } 1361 1362 if (res) 1363 freeaddrinfo(res); 1364 pthread_setcancelstate(cancel_state, NULL); 1365 >>> CID 1575916: (CHECKED_RETURN) >>> Calling "setsockopt(socket, 1, 20, &prev_rcv_tmout, 16U)" without checking return value. This library function may fail and return an error code. 1366 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, 1367 sizeof(prev_rcv_tmout)); 1368 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, 1369 sizeof(prev_snd_tmout)); 1370 1371 return socket; /bgpd/bgp_rpki.c: 1351 in rpki_create_socket() 1345 timeout.tv_usec = 0; 1346 1347 optlen = sizeof(prev_rcv_tmout); 1348 getsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, &optlen); 1349 getsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, &optlen); 1350 >>> CID 1575916: (CHECKED_RETURN) >>> Calling "setsockopt(socket, 1, 20, &timeout, 16U)" without checking return value. This library function may fail and return an error code. 1351 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)); 1352 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)); 1353 1354 if (connect(socket, res->ai_addr, res->ai_addrlen) == -1) { 1355 if (res) 1356 freeaddrinfo(res); /bgpd/bgp_rpki.c: 1368 in rpki_create_socket() 1362 if (res) 1363 freeaddrinfo(res); 1364 pthread_setcancelstate(cancel_state, NULL); 1365 1366 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, 1367 sizeof(prev_rcv_tmout)); >>> CID 1575916: (CHECKED_RETURN) >>> Calling "setsockopt(socket, 1, 21, &prev_snd_tmout, 16U)" without checking return value. This library function may fail and return an error code. 1368 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, 1369 sizeof(prev_snd_tmout)); 1370 1371 return socket; 1372 } 1373 ** CID 1575915: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1814 in rpki_retry_interval_magic() /bgpd/bgp_rpki.c: 1814 in rpki_retry_interval_magic() ________________________________________________________________________________________________________ *** CID 1575915: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1814 in rpki_retry_interval_magic() 1808 1809 if (vty->node == RPKI_VRF_NODE) 1810 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1811 else 1812 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1813 >>> CID 1575915: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1814 rpki_vrf->retry_interval = tmp; 1815 return CMD_SUCCESS; 1816 } 1817 1818 DEFUN (no_rpki_retry_interval, 1819 no_rpki_retry_interval_cmd, /bgpd/bgp_rpki.c: 1814 in rpki_retry_interval_magic() 1808 1809 if (vty->node == RPKI_VRF_NODE) 1810 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1811 else 1812 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1813 >>> CID 1575915: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1814 rpki_vrf->retry_interval = tmp; 1815 return CMD_SUCCESS; 1816 } 1817 1818 DEFUN (no_rpki_retry_interval, 1819 no_rpki_retry_interval_cmd, ** CID 1575914: Resource leaks (RESOURCE_LEAK) /bgpd/bgp_rpki.c: 1341 in rpki_create_socket() ________________________________________________________________________________________________________ *** CID 1575914: Resource leaks (RESOURCE_LEAK) /bgpd/bgp_rpki.c: 1341 in rpki_create_socket() 1335 1336 frr_with_privs (&bgpd_privs) { 1337 socket = vrf_socket(res->ai_family, res->ai_socktype, 1338 res->ai_protocol, vrf->vrf_id, NULL); 1339 } 1340 if (socket < 0) >>> CID 1575914: Resource leaks (RESOURCE_LEAK) >>> Variable "res" going out of scope leaks the storage it points to. 1341 return -1; 1342 1343 pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &cancel_state); 1344 timeout.tv_sec = 30; 1345 timeout.tv_usec = 0; 1346 ** CID 1575913: (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1575913: (NULL_RETURNS) /bgpd/bgp_rpki.c: 2457 in rpki_reset_config_mode_magic() 2451 struct rpki_vrf *rpki_vrf; 2452 2453 if (vty->node == RPKI_VRF_NODE) 2454 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 2455 else 2456 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); >>> CID 1575913: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "rpki_vrf" when calling "reset". 2457 return reset(true, rpki_vrf) == SUCCESS ? CMD_SUCCESS : CMD_WARNING; 2458 } 2459 2460 DEFUN (debug_rpki, 2461 debug_rpki_cmd, 2462 "debug rpki", /bgpd/bgp_rpki.c: 2457 in rpki_reset_config_mode_magic() 2451 struct rpki_vrf *rpki_vrf; 2452 2453 if (vty->node == RPKI_VRF_NODE) 2454 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 2455 else 2456 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); >>> CID 1575913: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "rpki_vrf" when calling "reset". 2457 return reset(true, rpki_vrf) == SUCCESS ? CMD_SUCCESS : CMD_WARNING; 2458 } 2459 2460 DEFUN (debug_rpki, 2461 debug_rpki_cmd, 2462 "debug rpki", ** CID 1575912: (REVERSE_INULL) /bgpd/bgp_rpki.c: 1355 in rpki_create_socket() /bgpd/bgp_rpki.c: 1362 in rpki_create_socket() ________________________________________________________________________________________________________ *** CID 1575912: (REVERSE_INULL) /bgpd/bgp_rpki.c: 1355 in rpki_create_socket() 1349 getsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, &optlen); 1350 1351 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)); 1352 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)); 1353 1354 if (connect(socket, res->ai_addr, res->ai_addrlen) == -1) { >>> CID 1575912: (REVERSE_INULL) >>> Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1355 if (res) 1356 freeaddrinfo(res); 1357 close(socket); 1358 pthread_setcancelstate(cancel_state, NULL); 1359 return -1; 1360 } /bgpd/bgp_rpki.c: 1362 in rpki_create_socket() 1356 freeaddrinfo(res); 1357 close(socket); 1358 pthread_setcancelstate(cancel_state, NULL); 1359 return -1; 1360 } 1361 >>> CID 1575912: (REVERSE_INULL) >>> Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1362 if (res) 1363 freeaddrinfo(res); 1364 pthread_setcancelstate(cancel_state, NULL); 1365 1366 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, 1367 sizeof(prev_rcv_tmout)); ** CID 1575911: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_rpki.c: 1935 in no_rpki_cache_magic() ________________________________________________________________________________________________________ *** CID 1575911: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_rpki.c: 1935 in no_rpki_cache_magic() 1929 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1930 else 1931 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1932 1933 cache_list = rpki_vrf->cache_list; 1934 cache_p = find_cache(preference, cache_list); >>> CID 1575911: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "rpki_vrf" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1935 if (!rpki_vrf || !cache_p) { 1936 vty_out(vty, "Could not find cache with preference %ld\n", 1937 preference); 1938 return CMD_WARNING; 1939 } 1940 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 12 Jan '24

12 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1575595: Null pointer dereferences (REVERSE_INULL) /lib/northbound_oper.c: 521 in nb_op_ys_init_node_infos() ________________________________________________________________________________________________________ *** CID 1575595: Null pointer dereferences (REVERSE_INULL) /lib/northbound_oper.c: 521 in nb_op_ys_init_node_infos() 515 516 /* Move up to the container if on a leaf currently. */ 517 if (node && 518 !CHECK_FLAG(node->schema->nodetype, LYS_CONTAINER | LYS_LIST)) 519 node = &node->parent->node; 520 assert(CHECK_FLAG(node->schema->nodetype, LYS_CONTAINER | LYS_LIST)); >>> CID 1575595: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "node" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 521 if (!node) 522 return NB_ERR_NOT_FOUND; 523 524 inner = node; 525 for (len = 1; inner->parent; len++) 526 inner = &inner->parent->node; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 11 Jan '24

11 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1575507: Null pointer dereferences (REVERSE_INULL) /lib/yang.c: 1146 in yang_lyd_trim_xpath() ________________________________________________________________________________________________________ *** CID 1575507: Null pointer dereferences (REVERSE_INULL) /lib/yang.c: 1146 in yang_lyd_trim_xpath() 1140 if (remove[i] == *root) 1141 *root = (*root)->next; 1142 lyd_free_tree(remove[i]); 1143 } 1144 darr_free(remove); 1145 >>> CID 1575507: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "set" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1146 if (set) 1147 ly_set_free(set, NULL); 1148 1149 return LY_SUCCESS; 1150 #endif 1151 } ** CID 1575506: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/yang.c: 279 in yang_resolve_snode_xpath() ________________________________________________________________________________________________________ *** CID 1575506: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/yang.c: 279 in yang_resolve_snode_xpath() 273 if (!set->count) { 274 ly_set_free(set, NULL); 275 return LY_ENOTFOUND; 276 } 277 278 *simple = false; >>> CID 1575506: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "(int)(set->count - 1) <= 2147483647" is always true regardless of the values of its operands. This occurs as the logical second operand of "&&". 279 darr_ensure_i(*snodes, set->count - 1); 280 memcpy(*snodes, set->snodes, set->count * sizeof(set->snodes[0])); 281 ly_set_free(set, NULL); 282 return LY_SUCCESS; 283 } 284 ** CID 1575505: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/northbound.c: 184 in nb_nodes_find() ________________________________________________________________________________________________________ *** CID 1575505: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/northbound.c: 184 in nb_nodes_find() 178 uint i; 179 180 err = yang_resolve_snode_xpath(ly_native_ctx, xpath, &snodes, &simple); 181 if (err) 182 return NULL; 183 >>> CID 1575505: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "(int)(((snodes == NULL) ? 0 : (ssize_t)((struct darr_metadata *)snodes - 1)->len) - 1) <= 2147483647" is always true regardless of the values of its operands. This occurs as the logical second operand of "&&". 184 darr_ensure_i(nb_nodes, darr_lasti(snodes)); 185 darr_foreach_i (snodes, i) 186 nb_nodes[i] = snodes[i]->priv; 187 darr_free(snodes); 188 return nb_nodes; 189 } ** CID 1575504: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1575504: Insecure data handling (TAINTED_SCALAR) /mgmtd/mgmt_fe_adapter.c: 1103 in fe_adapter_send_tree_data() 1097 1098 if (!tree) { 1099 empty = yang_dnode_new(ly_native_ctx, false); 1100 tree = empty; 1101 } 1102 >>> CID 1575504: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "*buf" to "yang_print_tree_append", which uses it as an offset. 1103 ret = yang_print_tree_append(&buf, tree, result_type, 1104 (LYD_PRINT_WD_EXPLICIT | 1105 LYD_PRINT_WITHSIBLINGS)); 1106 /* buf may have been reallocated and moved */ 1107 msg = (typeof(msg))buf; 1108 (void)msg; /* suppress clang-SA unused warning on safety code */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 03 Jan '24

03 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1575079: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_dplane.c: 5950 in dplane_srv6_encap_srcaddr_set() ________________________________________________________________________________________________________ *** CID 1575079: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_dplane.c: 5950 in dplane_srv6_encap_srcaddr_set() 5944 if (ret == AOK) 5945 result = ZEBRA_DPLANE_REQUEST_QUEUED; 5946 else { 5947 atomic_fetch_add_explicit(&zdplane_info 5948 .dg_srv6_encap_srcaddr_set_errors, 5949 1, memory_order_relaxed); >>> CID 1575079: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "ctx" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 5950 if (ctx) 5951 dplane_ctx_free(&ctx); 5952 } 5953 return result; 5954 } 5955 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0