- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 25 Oct '23

25 Oct '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1569357: (OVERRUN) /bgpd/bgp_packet.c: 3310 in bgp_dynamic_capability_fqdn() /bgpd/bgp_packet.c: 3343 in bgp_dynamic_capability_fqdn() ________________________________________________________________________________________________________ *** CID 1569357: (OVERRUN) /bgpd/bgp_packet.c: 3310 in bgp_dynamic_capability_fqdn() 3304 memcpy(&str, data, len); 3305 str[len] = '\0'; 3306 } 3307 data += len; 3308 3309 if (len) { >>> CID 1569357: (OVERRUN) >>> Overrunning array "str" of 65 bytes at byte offset 65 using index "len" (which evaluates to 65). 3310 str[len] = '\0'; 3311 3312 XFREE(MTYPE_BGP_PEER_HOST, peer->hostname); 3313 XFREE(MTYPE_BGP_PEER_HOST, peer->domainname); 3314 3315 peer->hostname = XSTRDUP(MTYPE_BGP_PEER_HOST, str); /bgpd/bgp_packet.c: 3343 in bgp_dynamic_capability_fqdn() 3337 memcpy(&str, data, len); 3338 str[len] = '\0'; 3339 } 3340 data += len; 3341 3342 if (len) { >>> CID 1569357: (OVERRUN) >>> Overrunning array "str" of 65 bytes at byte offset 65 using index "len" (which evaluates to 65). 3343 str[len] = '\0'; 3344 3345 XFREE(MTYPE_BGP_PEER_HOST, peer->domainname); 3346 3347 peer->domainname = XSTRDUP(MTYPE_BGP_PEER_HOST, str); 3348 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

First notice for nominations for candidates for the FRR 2023 TSC elections.
by Alistair Woodman 17 Oct '23

17 Oct '23

All, This is the first request for nominations for candidates for the 2023 TSC elections. Please contact me with nominations or questions. 1) Self-nominations are welcome. 2) All nominees must be active FRR maintainers in order to stand. 3) Present TSC members must opt-out of being auto-nominated. 4) If you plan to nominate someone else, please get their approval first. /a (your friendly FRR community elections officer)

1 2

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 28 Sep '23

28 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 6 of 6 defect(s) ** CID 1568381: Insecure data handling (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 1408 in bgp_linkstate_tlv_opaque_display() ________________________________________________________________________________________________________ *** CID 1568381: Insecure data handling (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 1408 in bgp_linkstate_tlv_opaque_display() 1402 1403 if (pnt + sub_length > lim) { 1404 vty_out(vty, "Bad length received: %u\n", sub_length); 1405 break; 1406 } 1407 >>> CID 1568381: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "sub_length" as a loop boundary. 1408 for (i = 0; i < sub_length; i++) { 1409 if (i != 0 && i % 8 == 0) 1410 vty_out(vty, " "); 1411 vty_out(vty, "%02x", *pnt); 1412 } 1413 } ** CID 1568380: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568380: Insecure data handling (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 692 in bgp_linkstate_nlri_prefix_json() 686 length = pnt_decode16(&pnt); 687 688 if (pnt + length > lim) 689 /* bad length */ 690 return; 691 >>> CID 1568380: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_nlri_value_display", which uses it as an offset. 692 ret = bgp_linkstate_nlri_value_display(NULL, 0, pnt, nlri_type, 693 type, length, false, 694 json_nlri); 695 696 if (!ret) 697 /* bad length */ ** CID 1568379: Control flow issues (DEADCODE) /bgpd/bgp_attr.c: 784 in link_state_hash_cmp() ________________________________________________________________________________________________________ *** CID 1568379: Control flow issues (DEADCODE) /bgpd/bgp_attr.c: 784 in link_state_hash_cmp() 778 const struct bgp_attr_ls *link_state1 = p1; 779 const struct bgp_attr_ls *link_state2 = p2; 780 781 if (!link_state1 && link_state2) 782 return false; 783 if (!link_state1 && link_state2) >>> CID 1568379: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return false;". 784 return false; 785 if (!link_state1 && !link_state2) 786 return true; 787 788 if (link_state1->length != link_state2->length) 789 return false; ** CID 1568378: (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568378: (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as a loop boundary. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as a loop boundary. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as an offset. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as a loop boundary. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as an offset. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as an offset. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } ** CID 1568377: (OVERRUN) /bgpd/bgp_linkstate_tlv.c: 156 in bgp_ls_tlv_check_size() /bgpd/bgp_linkstate_tlv.c: 165 in bgp_ls_tlv_check_size() /bgpd/bgp_linkstate_tlv.c: 161 in bgp_ls_tlv_check_size() /bgpd/bgp_linkstate_tlv.c: 163 in bgp_ls_tlv_check_size() ________________________________________________________________________________________________________ *** CID 1568377: (OVERRUN) /bgpd/bgp_linkstate_tlv.c: 156 in bgp_ls_tlv_check_size() 150 }; 151 /* clang-format on */ 152 153 /* Return the TLV length is valid for the TLV type */ 154 static bool bgp_ls_tlv_check_size(enum bgp_linkstate_tlv type, size_t length) 155 { >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 156 if (type > BGP_LS_TLV_MAX || 157 bgp_linkstate_tlv_infos[type].descr == NULL) 158 /* TLV type is not defined. Cannot check size */ 159 return false; 160 161 if (bgp_linkstate_tlv_infos[type].min_size > length) /bgpd/bgp_linkstate_tlv.c: 165 in bgp_ls_tlv_check_size() 159 return false; 160 161 if (bgp_linkstate_tlv_infos[type].min_size > length) 162 return false; 163 if (bgp_linkstate_tlv_infos[type].max_size < length) 164 return false; >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 165 if (length % bgp_linkstate_tlv_infos[type].multiple != 0) 166 return false; 167 168 return true; 169 } 170 /bgpd/bgp_linkstate_tlv.c: 161 in bgp_ls_tlv_check_size() 155 { 156 if (type > BGP_LS_TLV_MAX || 157 bgp_linkstate_tlv_infos[type].descr == NULL) 158 /* TLV type is not defined. Cannot check size */ 159 return false; 160 >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 161 if (bgp_linkstate_tlv_infos[type].min_size > length) 162 return false; 163 if (bgp_linkstate_tlv_infos[type].max_size < length) 164 return false; 165 if (length % bgp_linkstate_tlv_infos[type].multiple != 0) 166 return false; /bgpd/bgp_linkstate_tlv.c: 163 in bgp_ls_tlv_check_size() 157 bgp_linkstate_tlv_infos[type].descr == NULL) 158 /* TLV type is not defined. Cannot check size */ 159 return false; 160 161 if (bgp_linkstate_tlv_infos[type].min_size > length) 162 return false; >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 163 if (bgp_linkstate_tlv_infos[type].max_size < length) 164 return false; 165 if (length % bgp_linkstate_tlv_infos[type].multiple != 0) 166 return false; 167 168 return true; ** CID 1568376: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_attr.c: 4985 in bgp_packet_attribute() ________________________________________________________________________________________________________ *** CID 1568376: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_attr.c: 4985 in bgp_packet_attribute() 4979 /* VNC attribute */ 4980 bgp_packet_mpattr_tea(bgp, peer, s, attr, BGP_ATTR_VNC); 4981 #endif 4982 } 4983 4984 /* BGP Link-State */ >>> CID 1568376: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "attr" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 4985 if (attr && attr->link_state) { 4986 stream_putc(s, BGP_ATTR_FLAG_OPTIONAL); 4987 stream_putc(s, BGP_ATTR_LINK_STATE); 4988 stream_putc(s, attr->link_state->length); 4989 stream_put(s, attr->link_state->data, attr->link_state->length); 4990 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 22 Sep '23

22 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 105 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1568249: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1568249: Null pointer dereferences (FORWARD_NULL) /isisd/isis_route.c: 966 in isis_route_switchover_nexthop() 960 continue; 961 962 srcdest_rnode_prefixes(rnode, (const struct prefix **)&prefix, 963 (const struct prefix **)&src_p); 964 965 /* Switchover route. */ >>> CID 1568249: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "area" to "isis_route_remove_previous_sid", which dereferences it. 966 isis_route_remove_previous_sid(area, prefix, rinfo); 967 UNSET_FLAG(rinfo->flag, ISIS_ROUTE_FLAG_ZEBRA_SYNCED); 968 isis_route_update(area, prefix, src_p, rinfo->backup); 969 970 isis_route_info_delete(rinfo); 971 972 rnode->info = NULL; 973 route_unlock_node(rnode); 974 } ** CID 1568248: API usage errors (USE_AFTER_FREE) /pimd/pim_ssmpingd.c: 188 in ssmpingd_socket() ________________________________________________________________________________________________________ *** CID 1568248: API usage errors (USE_AFTER_FREE) /pimd/pim_ssmpingd.c: 188 in ssmpingd_socket() 182 set_nonblocking(fd); 183 sockopt_reuseaddr(fd); 184 185 ret = ssmpingd_setsockopt(fd, addr, mttl); 186 if (ret) { 187 zlog_warn("ssmpingd_setsockopt failed"); >>> CID 1568248: API usage errors (USE_AFTER_FREE) >>> Calling "close(int)" closes handle "fd" which has already been closed. 188 close(fd); 189 return -1; 190 } 191 192 return fd; 193 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 21 Sep '23

21 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 13 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1568217: Memory - illegal accesses (RETURN_LOCAL) /bgpd/bgpd.h: 2604 in timestamp_string() ________________________________________________________________________________________________________ *** CID 1568217: Memory - illegal accesses (RETURN_LOCAL) /bgpd/bgpd.h: 2604 in timestamp_string() 2598 static inline char *timestamp_string(time_t ts) 2599 { 2600 time_t tbuf; 2601 char timebuf[32]; 2602 2603 tbuf = time(NULL) - (monotime(NULL) - ts); >>> CID 1568217: Memory - illegal accesses (RETURN_LOCAL) >>> Returning result of calling "ctime_r". 2604 return ctime_r(&tbuf, timebuf); 2605 } 2606 2607 static inline bool peer_established(struct peer_connection *connection) 2608 { 2609 return connection->status == Established; ** CID 1568216: Integer handling issues (NEGATIVE_RETURNS) ________________________________________________________________________________________________________ *** CID 1568216: Integer handling issues (NEGATIVE_RETURNS) /lib/vty.c: 2416 in vtysh_read() 2410 2411 /* warning: watchfrr hardcodes this result write 2412 */ 2413 header[3] = ret; 2414 buffer_put(vty->obuf, header, 4); 2415 >>> CID 1568216: Integer handling issues (NEGATIVE_RETURNS) >>> "vty->pass_fd" is passed to a parameter that cannot be negative. 2416 if (!vty->t_write && (vtysh_flush(vty) < 0)) 2417 /* Try to flush results; exit if a write 2418 * error occurs. */ 2419 return; 2420 } 2421 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 19 Sep '23

19 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 38 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 26 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 38 defect(s) ** CID 1568213: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568213: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_auth.c: 203 in ospf_auth_check_md5_digest() 197 EVP_DigestUpdate(ctx, auth_key, OSPF_AUTH_MD5_SIZE); 198 EVP_DigestFinal(ctx, digest, &md5_size); 199 EVP_MD_CTX_free(ctx); 200 #elif CRYPTO_INTERNAL 201 memset(&ctx, 0, sizeof(ctx)); 202 MD5Init(&ctx); >>> CID 1568213: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "length" to "md5_loop", which uses it as a loop boundary. 203 MD5Update(&ctx, ospfh, length); 204 MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE); 205 MD5Final(digest, &ctx); 206 #endif 207 208 /* compare the two */ ** CID 1568212: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568212: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_auth.c: 254 in ospf_auth_make_md5_digest() 248 EVP_DigestUpdate(ctx, auth_key, OSPF_AUTH_MD5_SIZE); 249 EVP_DigestFinal(ctx, digest, &md5_size); 250 EVP_MD_CTX_free(ctx); 251 #elif CRYPTO_INTERNAL 252 memset(&ctx, 0, sizeof(ctx)); 253 MD5Init(&ctx); >>> CID 1568212: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "length" to "md5_loop", which uses it as a loop boundary. 254 MD5Update(&ctx, ospfh, length); 255 MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE); 256 MD5Final(digest, &ctx); 257 #endif 258 259 stream_put(op->s, digest, OSPF_AUTH_MD5_SIZE); ** CID 1568211: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_del() ________________________________________________________________________________________________________ *** CID 1568211: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_del() 172 { 173 uint32_t seed = a->s_bit ? 0x68f0eb5e : 0x156b7f19; 174 175 return jhash(&a->grp, sizeof(a->grp), seed); 176 } 177 >>> CID 1568211: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 178 DECLARE_HASH(gm_gsq_pends, struct gm_gsq_pending, itm, gm_gsq_pending_cmp, 179 gm_gsq_pending_hash); 180 181 /* 182 * interface -> (S,G) 183 */ ** CID 1568210: Integer handling issues (BAD_SHIFT) /vtysh/vtysh_config.c: 88 in config_master_hash_del() ________________________________________________________________________________________________________ *** CID 1568210: Integer handling issues (BAD_SHIFT) /vtysh/vtysh_config.c: 88 in config_master_hash_del() 82 static uint32_t config_hash(const struct config *c) 83 { 84 return string_hash_make(c->name); 85 } 86 87 DECLARE_LIST(config_master, struct config, rbt_item); >>> CID 1568210: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 88 DECLARE_HASH(config_master_hash, struct config, hash_item, config_cmp, 89 config_hash); 90 91 /* 92 * The config_master_head is a list for order of receipt 93 * The hash is for quick lookup under this NODE ** CID 1568209: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_const_next() ________________________________________________________________________________________________________ *** CID 1568209: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_const_next() 99 static int cpu_record_hash_cmp(const struct cpu_event_history *a, 100 const struct cpu_event_history *b) 101 { 102 return numcmp((uintptr_t)a->func, (uintptr_t)b->func); 103 } 104 >>> CID 1568209: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 105 DECLARE_HASH(cpu_records, struct cpu_event_history, item, cpu_record_hash_cmp, 106 cpu_record_hash_key); 107 108 static struct cpu_event_history *cpu_records_get(struct event_loop *loop, 109 void (*func)(struct event *e), 110 const char *funcname) ** CID 1568208: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_const_next() ________________________________________________________________________________________________________ *** CID 1568208: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_const_next() 48 49 /* Registration helper prototypes */ 50 static uint32_t registration_hash(const struct opq_msg_reg *reg); 51 static int registration_compare(const struct opq_msg_reg *reg1, 52 const struct opq_msg_reg *reg2); 53 >>> CID 1568208: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 54 DECLARE_HASH(opq_regh, struct opq_msg_reg, item, registration_compare, 55 registration_hash); 56 57 static struct opq_regh_head opq_reg_hash; 58 59 /* ** CID 1568207: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 139 in nbkey_map_del() ________________________________________________________________________________________________________ *** CID 1568207: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 139 in nbkey_map_del() 133 const struct req_map_data *b); 134 static uint32_t req_map_hash(const struct req_map_data *e); 135 136 /* Data Structure Declarations */ 137 DECLARE_HASH(plspid_map, struct plspid_map_data, mi, plspid_map_cmp, 138 plspid_map_hash); >>> CID 1568207: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 139 DECLARE_HASH(nbkey_map, struct nbkey_map_data, mi, nbkey_map_cmp, 140 nbkey_map_hash); 141 DECLARE_HASH(req_map, struct req_map_data, mi, req_map_cmp, req_map_hash); 142 143 static inline int req_entry_compare(const struct req_entry *a, 144 const struct req_entry *b) ** CID 1568206: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_del() ________________________________________________________________________________________________________ *** CID 1568206: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_del() 99 static int cpu_record_hash_cmp(const struct cpu_event_history *a, 100 const struct cpu_event_history *b) 101 { 102 return numcmp((uintptr_t)a->func, (uintptr_t)b->func); 103 } 104 >>> CID 1568206: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 105 DECLARE_HASH(cpu_records, struct cpu_event_history, item, cpu_record_hash_cmp, 106 cpu_record_hash_key); 107 108 static struct cpu_event_history *cpu_records_get(struct event_loop *loop, 109 void (*func)(struct event *e), 110 const char *funcname) ** CID 1568205: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 197 in bmp_qhash_del() ________________________________________________________________________________________________________ *** CID 1568205: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 197 in bmp_qhash_del() 191 + PSIZE(e->rd.prefixlen), 192 key); 193 194 return key; 195 } 196 >>> CID 1568205: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 197 DECLARE_HASH(bmp_qhash, struct bmp_queue_entry, bhi, 198 bmp_qhash_cmp, bmp_qhash_hkey); 199 200 static int bmp_active_cmp(const struct bmp_active *a, 201 const struct bmp_active *b) 202 { ** CID 1568204: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 80 in bmp_bgph_const_next() ________________________________________________________________________________________________________ *** CID 1568204: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 80 in bmp_bgph_const_next() 74 75 static uint32_t bmp_bgp_hash(const struct bmp_bgp *e) 76 { 77 return jhash(&e->bgp, sizeof(e->bgp), 0x55aa5a5a); 78 } 79 >>> CID 1568204: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 80 DECLARE_HASH(bmp_bgph, struct bmp_bgp, bbi, bmp_bgp_cmp, bmp_bgp_hash); 81 82 struct bmp_bgph_head bmp_bgph; 83 84 static int bmp_bgp_peer_cmp(const struct bmp_bgp_peer *a, 85 const struct bmp_bgp_peer *b) ** CID 1568203: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_del() ________________________________________________________________________________________________________ *** CID 1568203: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_del() 48 49 /* Registration helper prototypes */ 50 static uint32_t registration_hash(const struct opq_msg_reg *reg); 51 static int registration_compare(const struct opq_msg_reg *reg1, 52 const struct opq_msg_reg *reg2); 53 >>> CID 1568203: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 54 DECLARE_HASH(opq_regh, struct opq_msg_reg, item, registration_compare, 55 registration_hash); 56 57 static struct opq_regh_head opq_reg_hash; 58 59 /* ** CID 1568202: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 137 in plspid_map_const_next() ________________________________________________________________________________________________________ *** CID 1568202: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 137 in plspid_map_const_next() 131 static uint32_t nbkey_map_hash(const struct nbkey_map_data *e); 132 static int req_map_cmp(const struct req_map_data *a, 133 const struct req_map_data *b); 134 static uint32_t req_map_hash(const struct req_map_data *e); 135 136 /* Data Structure Declarations */ >>> CID 1568202: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 137 DECLARE_HASH(plspid_map, struct plspid_map_data, mi, plspid_map_cmp, 138 plspid_map_hash); 139 DECLARE_HASH(nbkey_map, struct nbkey_map_data, mi, nbkey_map_cmp, 140 nbkey_map_hash); 141 DECLARE_HASH(req_map, struct req_map_data, mi, req_map_cmp, req_map_hash); 142 ** CID 1568201: Integer handling issues (BAD_SHIFT) /lib/qobj.c: 32 in qobj_nodes_del() ________________________________________________________________________________________________________ *** CID 1568201: Integer handling issues (BAD_SHIFT) /lib/qobj.c: 32 in qobj_nodes_del() 26 return -1; 27 if (na->nid > nb->nid) 28 return 1; 29 return 0; 30 } 31 >>> CID 1568201: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 32 DECLARE_HASH(qobj_nodes, struct qobj_node, nodehash, 33 qobj_cmp, qobj_hash); 34 35 static pthread_rwlock_t nodes_lock; 36 static struct qobj_nodes_head nodes = { }; 37 ** CID 1568200: Integer handling issues (BAD_SHIFT) /staticd/static_zebra.c: 69 in static_nht_hash_del() ________________________________________________________________________________________________________ *** CID 1568200: Integer handling issues (BAD_SHIFT) /staticd/static_zebra.c: 69 in static_nht_hash_del() 63 unsigned int key = 0; 64 65 key = prefix_hash_key(&nhtd->nh); 66 return jhash_2words(nhtd->nh_vrf_id, nhtd->safi, key); 67 } 68 >>> CID 1568200: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 69 DECLARE_HASH(static_nht_hash, struct static_nht_data, itm, static_nht_data_cmp, 70 static_nht_data_hash); 71 72 static struct static_nht_hash_head static_nht_hash[1]; 73 74 /* Zebra structure to hold current status. */ ** CID 1568199: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 249 in gm_subscribers_const_next() ________________________________________________________________________________________________________ *** CID 1568199: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 249 in gm_subscribers_const_next() 243 244 static uint32_t gm_subscriber_hash(const struct gm_subscriber *a) 245 { 246 return jhash(&a->addr, sizeof(a->addr), 0xd0e94ad4); 247 } 248 >>> CID 1568199: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 249 DECLARE_HASH(gm_subscribers, struct gm_subscriber, itm, gm_subscriber_cmp, 250 gm_subscriber_hash); 251 252 static struct gm_subscriber *gm_subscriber_findref(struct gm_if *gm_ifp, 253 pim_addr addr) 254 { ** CID 1568198: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_const_next() ________________________________________________________________________________________________________ *** CID 1568198: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_const_next() 93 94 static uint32_t bmp_bgp_peer_hash(const struct bmp_bgp_peer *e) 95 { 96 return e->peerid; 97 } 98 >>> CID 1568198: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 99 DECLARE_HASH(bmp_peerh, struct bmp_bgp_peer, bpi, 100 bmp_bgp_peer_cmp, bmp_bgp_peer_hash); 101 102 struct bmp_peerh_head bmp_peerh; 103 104 DECLARE_LIST(bmp_mirrorq, struct bmp_mirrorq, bmi); ** CID 1568197: Integer handling issues (BAD_SHIFT) /lib/table.c: 28 in rn_hash_node_del() ________________________________________________________________________________________________________ *** CID 1568197: Integer handling issues (BAD_SHIFT) /lib/table.c: 28 in rn_hash_node_del() 22 static int route_table_hash_cmp(const struct route_node *a, 23 const struct route_node *b) 24 { 25 return prefix_cmp(&a->p, &b->p); 26 } 27 >>> CID 1568197: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 28 DECLARE_HASH(rn_hash_node, struct route_node, nodehash, route_table_hash_cmp, 29 prefix_hash_key); 30 /* 31 * route_table_init_with_delegate 32 */ 33 struct route_table * ** CID 1568196: Integer handling issues (BAD_SHIFT) /lib/routemap.c: 49 in rmap_cmd_name_const_next() ________________________________________________________________________________________________________ *** CID 1568196: Integer handling issues (BAD_SHIFT) /lib/routemap.c: 49 in rmap_cmd_name_const_next() 43 44 static uint32_t rmap_cmd_name_hash(const struct route_map_rule_cmd_proxy *item) 45 { 46 return jhash(item->cmd->str, strlen(item->cmd->str), 0xbfd69320); 47 } 48 >>> CID 1568196: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 49 DECLARE_HASH(rmap_cmd_name, struct route_map_rule_cmd_proxy, itm, 50 rmap_cmd_name_cmp, rmap_cmd_name_hash); 51 52 static struct rmap_cmd_name_head rmap_match_cmds[1] = { 53 INIT_HASH(rmap_match_cmds[0]), 54 }; ** CID 1568195: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_del() ________________________________________________________________________________________________________ *** CID 1568195: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_del() 93 94 static uint32_t bmp_bgp_peer_hash(const struct bmp_bgp_peer *e) 95 { 96 return e->peerid; 97 } 98 >>> CID 1568195: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 99 DECLARE_HASH(bmp_peerh, struct bmp_bgp_peer, bpi, 100 bmp_bgp_peer_cmp, bmp_bgp_peer_hash); 101 102 struct bmp_peerh_head bmp_peerh; 103 104 DECLARE_LIST(bmp_mirrorq, struct bmp_mirrorq, bmi); ** CID 1568194: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_const_next() ________________________________________________________________________________________________________ *** CID 1568194: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_const_next() 172 { 173 uint32_t seed = a->s_bit ? 0x68f0eb5e : 0x156b7f19; 174 175 return jhash(&a->grp, sizeof(a->grp), seed); 176 } 177 >>> CID 1568194: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 178 DECLARE_HASH(gm_gsq_pends, struct gm_gsq_pending, itm, gm_gsq_pending_cmp, 179 gm_gsq_pending_hash); 180 181 /* 182 * interface -> (S,G) 183 */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 13 Sep '23

13 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 26 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 6 of 6 defect(s) ** CID 1568134: Null pointer dereferences (NULL_RETURNS) /isisd/isis_zebra.c: 1146 in isis_zebra_process_srv6_locator_chunk() ________________________________________________________________________________________________________ *** CID 1568134: Null pointer dereferences (NULL_RETURNS) /isisd/isis_zebra.c: 1146 in isis_zebra_process_srv6_locator_chunk() 1140 "prefix %pFX, block_len %u, node_len %u, func_len %u, arg_len %u", 1141 chunk->locator_name, &chunk->prefix, chunk->block_bits_length, 1142 chunk->node_bits_length, chunk->function_bits_length, 1143 chunk->argument_bits_length); 1144 1145 /* Walk through all areas of the ISIS instance */ >>> CID 1568134: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "isis", which is known to be "NULL". 1146 for (ALL_LIST_ELEMENTS_RO(isis->area_list, node, area)) { 1147 if (strncmp(area->srv6db.config.srv6_locator_name, 1148 chunk->locator_name, 1149 sizeof(area->srv6db.config.srv6_locator_name)) != 0) 1150 continue; 1151 ** CID 1568133: Null pointer dereferences (REVERSE_INULL) /isisd/isis_zebra.c: 1077 in isis_zebra_srv6_adj_sid_uninstall() ________________________________________________________________________________________________________ *** CID 1568133: Null pointer dereferences (REVERSE_INULL) /isisd/isis_zebra.c: 1077 in isis_zebra_srv6_adj_sid_uninstall() 1071 enum seg6local_action_t action = ZEBRA_SEG6_LOCAL_ACTION_UNSPEC; 1072 struct interface *ifp; 1073 uint16_t prefixlen = IPV6_MAX_BITLEN; 1074 struct isis_circuit *circuit = sra->adj->circuit; 1075 struct isis_area *area = circuit->area; 1076 >>> CID 1568133: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "sra" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1077 if (!sra) 1078 return; 1079 1080 switch (sra->behavior) { 1081 case SRV6_ENDPOINT_BEHAVIOR_END_X: 1082 prefixlen = IPV6_MAX_BITLEN; ** CID 1568132: Null pointer dereferences (REVERSE_INULL) /isisd/isis_zebra.c: 1023 in isis_zebra_srv6_adj_sid_install() ________________________________________________________________________________________________________ *** CID 1568132: Null pointer dereferences (REVERSE_INULL) /isisd/isis_zebra.c: 1023 in isis_zebra_srv6_adj_sid_install() 1017 struct seg6local_context ctx = {}; 1018 uint16_t prefixlen = IPV6_MAX_BITLEN; 1019 struct interface *ifp; 1020 struct isis_circuit *circuit = sra->adj->circuit; 1021 struct isis_area *area = circuit->area; 1022 >>> CID 1568132: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "sra" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1023 if (!sra) 1024 return; 1025 1026 sr_debug("ISIS-SRv6 (%s): setting adjacency SID %pI6", area->area_tag, 1027 &sra->sid); 1028 ** CID 1568131: Possible Control flow issues (DEADCODE) /bgpd/bgp_route.c: 1503 in bgp_evpn_path_info_cmp() ________________________________________________________________________________________________________ *** CID 1568131: Possible Control flow issues (DEADCODE) /bgpd/bgp_route.c: 1503 in bgp_evpn_path_info_cmp() 1497 { 1498 enum bgp_path_selection_reason reason; 1499 char pfx_buf[PREFIX2STR_BUFFER] = {}; 1500 bool debug = false; 1501 1502 if (debug) >>> CID 1568131: Possible Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "prefix2str(union prefixcons...". 1503 prefix2str(bgp_dest_get_prefix(new->net), pfx_buf, 1504 sizeof(pfx_buf)); 1505 1506 return bgp_path_info_cmp(bgp, new, exist, paths_eq, NULL, debug, 1507 pfx_buf, AFI_L2VPN, SAFI_EVPN, &reason); 1508 } ** CID 1568130: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_add() ________________________________________________________________________________________________________ *** CID 1568130: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_add() 99 static int cpu_record_hash_cmp(const struct cpu_event_history *a, 100 const struct cpu_event_history *b) 101 { 102 return numcmp((uintptr_t)a->func, (uintptr_t)b->func); 103 } 104 >>> CID 1568130: Integer handling issues (BAD_SHIFT) >>> In expression "hval >> 33 - h->hh.tabshift", right shifting by more than 31 bits has undefined behavior. The shift amount, "33 - h->hh.tabshift", is 33. 105 DECLARE_HASH(cpu_records, struct cpu_event_history, item, cpu_record_hash_cmp, 106 cpu_record_hash_key); 107 108 static struct cpu_event_history *cpu_records_get(struct event_loop *loop, 109 void (*func)(struct event *e), 110 const char *funcname) ** CID 1568129: Null pointer dereferences (REVERSE_INULL) /isisd/isis_tlvs.c: 2813 in unpack_item_srv6_end_sid() ________________________________________________________________________________________________________ *** CID 1568129: Null pointer dereferences (REVERSE_INULL) /isisd/isis_tlvs.c: 2813 in unpack_item_srv6_end_sid() 2807 sid->subsubtlvs = NULL; 2808 } 2809 2810 append_item(&subtlvs->srv6_end_sids, (struct isis_item *)sid); 2811 return 0; 2812 out: >>> CID 1568129: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "sid" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 2813 if (sid) 2814 free_item_srv6_end_sid((struct isis_item *)sid); 2815 return 1; 2816 } 2817 2818 /* Functions related to TLVs 1 Area Addresses */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Re: [dev] Best Version And linux Platform For 40Gbps BW on Frr
by David Schweizer 11 Sep '23

11 Sep '23

Hello Ramin, Take a look at this blog article series: https://ipng.ch/s/articles/2021/08/12/vpp-1.html Kind regards, David On 9/10/23 22:10, Ramin Malekgahsemi via dev wrote: > _______________________________________________ > dev mailing list > dev(a)lists.frrouting.org > https://lists.frrouting.org/listinfo/dev

1 0

Best Version And linux Platform For 40Gbps BW on Frr
by Ramin Malekgahsemi 10 Sep '23

10 Sep '23

Hi Dears I want Forward 40G To up 100G bps BW On Frr Please Suggest To me stable linux version and frr Version Fo this Capacity Thanks

1 0

Re: [dev] FRR 9.0.1 and 8.5.3 Releases
by mike tancsa 08 Sep '23

08 Sep '23

Hi, I am guessing there is still no easy way to upgrade individual instances from 8.5.1 to 8.5.3 when ibgp is involved ? ie its a "do all at once" step ? https://lists.frrouting.org/pipermail/frog/2023-June/001283.html ---Mike On 9/8/2023 11:52 AM, Jafar Al-Gharaibeh via dev wrote: > _______________________________________________ > dev mailing list > dev(a)lists.frrouting.org > https://lists.frrouting.org/listinfo/dev

2 1