- dev - lists.frrouting.org

LDPD crashes when hold time configured 65535
by Girish Patoliya 18 Jul '22

18 Jul '22

Hi I am running FRR from stable 8.1 HEAD. LDPD crashes when hold time is configured to 65535: (gdb) bt #0 0x00007f8c3fc224bb in raise () from /lib64/libpthread.so.0 #1 0x00007f8c4138a3dd in core_handler () from /lib64/libfrr.so.0 #2 <signal handler called> #3 0x00007f8c3fc1ccc0 in pthread_mutex_lock () from /lib64/libpthread.so.0 #4 0x00007f8c4139914b in thread_timer_remain_msec () from /lib64/libfrr.so.0 #5 0x00007f8c41399209 in thread_timer_remain_second () from /lib64/libfrr.so.0 #6 0x000000000040eb19 in adj_to_ctl () #7 0x0000000000427b38 in ldpe_nbr_ctl () #8 0x000000000042fd68 in control_dispatch_imsg () #9 0x00007f8c4139a628 in thread_call () from /lib64/libfrr.so.0 #10 0x00000000004265fc in ldpe () #11 0x000000000040a68f in main () I tried to compile on latest to check if this issue is fixed, but unfortunately my compilation is failing on master HEAD due to env dependencies. Is anyone aware if this issue is fixed after 8.1 ? Can someone share details on how to enable gdb option to get full bt, I tried --enable-dev-build but I am getting same bt without local info. Regards, Girish ________________________________ This e-mail message may contain confidential or proprietary information of Mavenir Systems, Inc. or its affiliates and is intended solely for the use of the intended recipient(s). If you are not the intended recipient of this message, you are hereby notified that any review, use or distribution of this information is absolutely prohibited and we request that you delete all copies in your control and contact us by e-mailing to security(a)mavenir.com. This message contains the views of its author and may not necessarily reflect the views of Mavenir Systems, Inc. or its affiliates, who employ systems to monitor email messages, but make no representation that such messages are authorized, secure, uncompromised, or free from computer viruses, malware, or other defects. Thank You

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 06 Jul '22

06 Jul '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1518830: (RESOURCE_LEAK) /bfdd/bfd_packet.c: 1582 in bp_echo_socket() /bfdd/bfd_packet.c: 1572 in bp_echo_socket() ________________________________________________________________________________________________________ *** CID 1518830: (RESOURCE_LEAK) /bfdd/bfd_packet.c: 1582 in bp_echo_socket() 1576 sll.sll_family = AF_PACKET; 1577 sll.sll_protocol = htons(ETH_P_IP); 1578 sll.sll_ifindex = 0; 1579 if (bind(s, (struct sockaddr *)&sll, sizeof(sll)) < 0) { 1580 zlog_warn("Failed to bind echo socket: %s", 1581 safe_strerror(errno)); >>> CID 1518830: (RESOURCE_LEAK) >>> Handle variable "s" going out of scope leaks the handle. 1582 return -1; 1583 } 1584 1585 return s; 1586 } 1587 #else /bfdd/bfd_packet.c: 1572 in bp_echo_socket() 1566 pf.filter = my_filterudp; 1567 pf.len = MY_FILTER_LENGTH; 1568 if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER, &pf, sizeof(pf)) == 1569 -1) { 1570 zlog_warn("%s: setsockopt(SO_ATTACH_FILTER): %s", __func__, 1571 strerror(errno)); >>> CID 1518830: (RESOURCE_LEAK) >>> Handle variable "s" going out of scope leaks the handle. 1572 return -1; 1573 } 1574 1575 1576 sll.sll_family = AF_PACKET; 1577 sll.sll_protocol = htons(ETH_P_IP); ** CID 1518829: Memory - corruptions (BUFFER_SIZE) /bfdd/bfd_packet.c: 222 in ptm_bfd_echo_fp_snd() ________________________________________________________________________________________________________ *** CID 1518829: Memory - corruptions (BUFFER_SIZE) /bfdd/bfd_packet.c: 222 in ptm_bfd_echo_fp_snd() 216 SET_FLAG(bfd->flags, BFD_SESS_FLAG_ECHO_ACTIVE); 217 218 memset(sendbuff, 0, sizeof(sendbuff)); 219 220 /* add eth hdr */ 221 eth = (struct ethhdr *)(sendbuff); >>> CID 1518829: Memory - corruptions (BUFFER_SIZE) >>> You might overrun the 6 byte destination string "eth->h_source" by writing the maximum 20 bytes from "bfd->ifp->hw_addr". 222 memcpy(eth->h_source, bfd->ifp->hw_addr, sizeof(bfd->ifp->hw_addr)); 223 memcpy(eth->h_dest, bfd->peer_hw_addr, sizeof(bfd->peer_hw_addr)); 224 225 total_len += sizeof(struct ethhdr); 226 227 sd = bvrf->bg_echo; ** CID 1518828: Memory - corruptions (OVERRUN) /bfdd/bfd_packet.c: 222 in ptm_bfd_echo_fp_snd() ________________________________________________________________________________________________________ *** CID 1518828: Memory - corruptions (OVERRUN) /bfdd/bfd_packet.c: 222 in ptm_bfd_echo_fp_snd() 216 SET_FLAG(bfd->flags, BFD_SESS_FLAG_ECHO_ACTIVE); 217 218 memset(sendbuff, 0, sizeof(sendbuff)); 219 220 /* add eth hdr */ 221 eth = (struct ethhdr *)(sendbuff); >>> CID 1518828: Memory - corruptions (OVERRUN) >>> Overrunning array "eth->h_source" of 6 bytes by passing it to a function which accesses it at byte offset 19 using argument "20UL". 222 memcpy(eth->h_source, bfd->ifp->hw_addr, sizeof(bfd->ifp->hw_addr)); 223 memcpy(eth->h_dest, bfd->peer_hw_addr, sizeof(bfd->peer_hw_addr)); 224 225 total_len += sizeof(struct ethhdr); 226 227 sd = bvrf->bg_echo; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Error when running frr from source code
by hieunt562＠viettel.com.vn 30 Jun '22

30 Jun '22

Hi all. I want to install FRR 8.2.2 release from source code for ospfd running on CenOS 7. So, I followed the guide line from http://docs.frrouting.org/projects/dev-guide/en/latest/building-frr-for-cent os7.html. - First, when I run: ./configure --bindir=/usr/bin --sbindir=/usr/lib/frr --sysconfdir=/etc/frr --libdir=/usr/lib/frr --libexecdir=/usr/lib/frr --localstatedir=/var/run/frr --with-moduledir=/usr/lib/frr/modules --enable-snmp=agentx --enable-multipath=64 --enable-user=frr --enable-group=frr --enable-vty-group=frrvty --disable-ldpd --enable-fpm --with-pkg-git-version --with-pkg-extra-version=-MyOwnFRRVersion SPHINXBUILD=/usr/bin/sphinx-build I got two warnings: configure: WARNING: sphinx is missing but required to build documentation configure: WARNING: pytest is missing, unit tests cannot be performed - After compile source and install I run sudo systemctl start frr I got error message like below: [root@localhost frr]# sudo systemctl start frr Job for frr.service failed. See "systemctl status frr.service" and "journalctl -xe" for details. [root@localhost frr]# systemctl status frr.service ● frr.service - FRRouting Loaded: loaded (/etc/systemd/system/frr.service; enabled; vendor preset: disabled) Active: activating (start) since Wed 2022-06-22 23:10:24 EDT; 16s ago Docs: <https://frrouting.readthedocs.io/en/latest/setup.html> https://frrouting.readthedocs.io/en/latest/setup.html Control: 10242 (frrinit.sh) Status: "restarting all" Tasks: 3 CGroup: /system.slice/frr.service ├─10242 /bin/bash /usr/lib/frr/frrinit.sh start ├─10246 /usr/lib/frr/watchfrr -d -F traditional zebra ospfd staticd └─10247 /usr/lib/frr/watchfrr -d -F traditional zebra ospfd staticd Jun 22 23:10:24 localhost.localdomain systemd[1]: Starting FRRouting... Jun 22 23:10:24 localhost.localdomain watchfrr[10247]: [T83RR-8SM5G] watchfrr 8.2.2-MyOwnFRRVersion starting: vty@0 Jun 22 23:10:24 localhost.localdomain watchfrr[10247]: [ZCJ3S-SPH5S] zebra state -> down : initial connection attempt failed Jun 22 23:10:24 localhost.localdomain watchfrr[10247]: [ZCJ3S-SPH5S] ospfd state -> down : initial connection attempt failed Jun 22 23:10:24 localhost.localdomain watchfrr[10247]: [ZCJ3S-SPH5S] staticd state -> down : initial connection attempt failed Jun 22 23:10:24 localhost.localdomain watchfrr[10247]: [YFT0P-5Q5YX] Forked background command [pid 10248]: /usr/lib/frr/watchfrr.sh restart all [root@localhost frr]# journalctl -xe -- Subject: Unit frr.service has finished shutting down -- Defined-By: systemd -- Support: <http://lists.freedesktop.org/mailman/listinfo/systemd-devel> http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- Unit frr.service has finished shutting down. Jun 22 23:10:24 localhost.localdomain systemd[1]: Starting FRRouting... -- Subject: Unit frr.service has begun start-up -- Defined-By: systemd -- Support: <http://lists.freedesktop.org/mailman/listinfo/systemd-devel> http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- Unit frr.service has begun starting up. Jun 22 23:10:24 localhost.localdomain watchfrr[10247]: [T83RR-8SM5G] watchfrr 8.2.2-MyOwnFRRVersion starting: vty@0 Jun 22 23:10:24 localhost.localdomain watchfrr[10247]: [ZCJ3S-SPH5S] zebra state -> down : initial connection attempt failed Jun 22 23:10:24 localhost.localdomain watchfrr[10247]: [ZCJ3S-SPH5S] ospfd state -> down : initial connection attempt failed Jun 22 23:10:24 localhost.localdomain watchfrr[10247]: [ZCJ3S-SPH5S] staticd state -> down : initial connection attempt failed Jun 22 23:10:24 localhost.localdomain watchfrr[10247]: [YFT0P-5Q5YX] Forked background command [pid 10248]: /usr/lib/frr/watchfrr.sh restart all Jun 22 23:10:24 localhost.localdomain watchfrr.sh[10260]: Cannot stop zebra: pid file not found Jun 22 23:10:24 localhost.localdomain watchfrr.sh[10256]: Cannot stop staticd: pid file not found Jun 22 23:10:24 localhost.localdomain watchfrr.sh[10259]: Cannot stop ospfd: pid file not found Jun 22 23:10:24 localhost.localdomain watchfrr.sh[10263]: Failed to start zebra! Jun 22 23:10:24 localhost.localdomain watchfrr.sh[10266]: Failed to start ospfd! Jun 22 23:10:24 localhost.localdomain watchfrr.sh[10269]: Failed to start staticd! Do you know why I got these errors, please help me to fix them. Thanks and best regards! HieuNT

2 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 23 Jun '22

23 Jun '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1518664: (UNINIT) ________________________________________________________________________________________________________ *** CID 1518664: (UNINIT) /ospfd/ospf_vty.c: 4410 in show_ip_ospf_neighbour_brief() 4404 time_val); 4405 json_object_int_add(json_neighbor, "deadTimeMsecs", 4406 time_store); 4407 json_object_int_add(json_neighbor, 4408 "routerDeadIntervalTimerDueMsec", 4409 time_store); >>> CID 1518664: (UNINIT) >>> Using uninitialized value "res.tv_usec" when calling "ospf_timeval_dump". 4410 json_object_string_add( 4411 json_neighbor, "upTime", 4412 ospf_timeval_dump(&res, uptime, 4413 sizeof(uptime))); 4414 json_object_string_add( 4415 json_neighbor, "deadTime", /ospfd/ospf_vty.c: 4458 in show_ip_ospf_neighbour_brief() 4452 vty_out(vty, "%-15s %3d %-15s ", "-", nbr->priority, 4453 msgbuf); 4454 else 4455 vty_out(vty, "%-15pI4 %3d %-15s ", &nbr->router_id, 4456 nbr->priority, msgbuf); 4457 >>> CID 1518664: (UNINIT) >>> Using uninitialized value "res.tv_usec" when calling "ospf_timeval_dump". 4458 vty_out(vty, "%-15s ", 4459 ospf_timeval_dump(&res, uptime, sizeof(uptime))); 4460 4461 vty_out(vty, "%9s ", 4462 ospf_timer_dump(nbr->t_inactivity, timebuf, 4463 sizeof(timebuf))); ** CID 1518663: (CONSTANT_EXPRESSION_RESULT) /zebra/zapi_msg.c: 1650 in nexthop_from_zapi() /zebra/zapi_msg.c: 1616 in nexthop_from_zapi() ________________________________________________________________________________________________________ *** CID 1518663: (CONSTANT_EXPRESSION_RESULT) /zebra/zapi_msg.c: 1650 in nexthop_from_zapi() 1644 memset(&vtep_ip, 0, sizeof(vtep_ip)); 1645 vtep_ip.ipa_type = IPADDR_V6; 1646 memcpy(&vtep_ip.ipaddr_v6, &(api_nh->gate.ipv6), 1647 sizeof(struct in6_addr)); 1648 zebra_rib_queue_evpn_route_add( 1649 api_nh->vrf_id, &api_nh->rmac, &vtep_ip, p); >>> CID 1518663: (CONSTANT_EXPRESSION_RESULT) >>> In "nexthop->flags |= 256 /* 1 << 8 */", wider "256 /* 1 << 8 */" has high-order bits (0x100) that don't affect the narrower left-hand side. 1650 SET_FLAG(nexthop->flags, NEXTHOP_FLAG_EVPN); 1651 } 1652 break; 1653 case NEXTHOP_TYPE_BLACKHOLE: 1654 if (IS_ZEBRA_DEBUG_RECV) 1655 zlog_debug("%s: nh blackhole %d", /zebra/zapi_msg.c: 1616 in nexthop_from_zapi() 1610 memset(&vtep_ip, 0, sizeof(vtep_ip)); 1611 vtep_ip.ipa_type = IPADDR_V4; 1612 memcpy(&(vtep_ip.ipaddr_v4), &(api_nh->gate.ipv4), 1613 sizeof(struct in_addr)); 1614 zebra_rib_queue_evpn_route_add( 1615 api_nh->vrf_id, &api_nh->rmac, &vtep_ip, p); >>> CID 1518663: (CONSTANT_EXPRESSION_RESULT) >>> In "nexthop->flags |= 256 /* 1 << 8 */", wider "256 /* 1 << 8 */" has high-order bits (0x100) that don't affect the narrower left-hand side. 1616 SET_FLAG(nexthop->flags, NEXTHOP_FLAG_EVPN); 1617 } 1618 break; 1619 case NEXTHOP_TYPE_IPV6: 1620 if (IS_ZEBRA_DEBUG_RECV) { 1621 inet_ntop(AF_INET6, &api_nh->gate.ipv6, nhbuf, ** CID 1518662: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /zebra/zebra_fpm_netlink.c: 211 in netlink_route_info_add_nh() ________________________________________________________________________________________________________ *** CID 1518662: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /zebra/zebra_fpm_netlink.c: 211 in netlink_route_info_add_nh() 205 src = &nexthop->src; 206 } 207 208 if (!nhi.gateway && nhi.if_index == 0) 209 return 0; 210 >>> CID 1518662: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "nexthop->flags & (256 /* 1 << 8 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if". 211 if (CHECK_FLAG(nexthop->flags, NEXTHOP_FLAG_EVPN)) { 212 nhi.encap_info.encap_type = FPM_NH_ENCAP_VXLAN; 213 214 /* Extract VNI id for the nexthop SVI interface */ 215 zvrf = zebra_vrf_lookup_by_id(nexthop->vrf_id); 216 if (zvrf) { ** CID 1518661: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/zclient.c: 1833 in zapi_nexthop_from_nexthop() ________________________________________________________________________________________________________ *** CID 1518661: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/zclient.c: 1833 in zapi_nexthop_from_nexthop() 1827 znh->ifindex = nh->ifindex; 1828 znh->gate = nh->gate; 1829 1830 if (CHECK_FLAG(nh->flags, NEXTHOP_FLAG_ONLINK)) 1831 SET_FLAG(znh->flags, ZAPI_NEXTHOP_FLAG_ONLINK); 1832 >>> CID 1518661: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "nh->flags & (256 /* 1 << 8 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if". 1833 if (CHECK_FLAG(nh->flags, NEXTHOP_FLAG_EVPN)) 1834 SET_FLAG(znh->flags, ZAPI_NEXTHOP_FLAG_EVPN); 1835 1836 if (nh->nh_label && (nh->nh_label->num_labels > 0)) { 1837 1838 /* Validate */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Ubuntu 22 Question
by Fatih Ünlü 19 Jun '22

19 Jun '22

Hello Dear Dev Team, Thank you for great software. My cloud provider provides me arm based server only with Ubuntu 22. Frr on official repo is a bit outdated which is 8.1 Is there any plan from your side to support Ubuntu 22 on your repo? Thank you BR Fatih

1 0

Question about BGP NLRI structure
by johnjdunbar＠disroot.org 11 Jun '22

11 Jun '22

I'm trying to implement https://datatracker.ietf.org/doc/draft-ietf-idr-sdwan-edge-discovery/ into frr/bgpd. Looking through the code I have some questions for which I hope someone can help me RFC 4760 defines the mp_reach_nlri attributes as this +---------------------------------------------------------+ | Address Family Identifier (2 octets) | +---------------------------------------------------------+ | Subsequent Address Family Identifier (1 octet) | +---------------------------------------------------------+ | Length of Next Hop Network Address (1 octet) | +---------------------------------------------------------+ | Network Address of Next Hop (variable) | +---------------------------------------------------------+ | Reserved (1 octet) | +---------------------------------------------------------+ | Network Layer Reachability Information (variable) | +---------------------------------------------------------+ Is the following structure in /bgpd/bgpd.h representing the table above? struct bgp_nlri { /* AFI. */ uint16_t afi; /* iana_afi_t */ /* SAFI. */ uint8_t safi; /* iana_safi_t */ /* Pointer to NLRI byte stream. */ uint8_t *nlri; /* Length of whole NLRI. */ bgp_size_t length; }; If yes, does uint8_t *nlri map to [Network Layer Reachability Information (variable)]? does bgp_size_t length map to [Length of Next Hop Network Address (1 octet)]? If not, can someone please tell me what this structure maps to? I appreciate anyone who has insights to help me out. Thank you, John

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 08 Jun '22

08 Jun '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1518122: Memory - illegal accesses (OVERRUN) /ospfd/ospf_api.c: 676 in new_msg_reachable_change() ________________________________________________________________________________________________________ *** CID 1518122: Memory - illegal accesses (OVERRUN) /ospfd/ospf_api.c: 676 in new_msg_reachable_change() 670 if (nremove > (nmax - nadd)) 671 nremove = (nmax - nadd); 672 673 if (nadd) 674 memcpy(nmsg->router_ids, add, nadd * insz); 675 if (nremove) >>> CID 1518122: Memory - illegal accesses (OVERRUN) >>> Overrunning array of 1536 bytes at byte offset 1536 by dereferencing pointer "&nmsg->router_ids[nadd]". 676 memcpy(&nmsg->router_ids[nadd], remove, nremove * insz); 677 678 nmsg->nadd = htons(nadd); 679 nmsg->nremove = htons(nremove); 680 len = sizeof(*nmsg) + insz * (nadd + nremove); 681 682 return msg_new(MSG_REACHABLE_CHANGE, nmsg, seqnum, len); 683 } 684 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 20 May '22

20 May '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1517953: Error handling issues (CHECKED_RETURN) /zebra/kernel_netlink.c: 313 in netlink_socket() ________________________________________________________________________________________________________ *** CID 1517953: Error handling issues (CHECKED_RETURN) /zebra/kernel_netlink.c: 313 in netlink_socket() 307 memset(&snl, 0, sizeof(snl)); 308 snl.nl_family = AF_NETLINK; 309 snl.nl_groups = groups; 310 311 #if defined SOL_NETLINK 312 if (ext_groups) >>> CID 1517953: Error handling issues (CHECKED_RETURN) >>> Calling "setsockopt(sock, 270, 1, &ext_groups, 8U)" without checking return value. This library function may fail and return an error code. 313 setsockopt(sock, SOL_NETLINK, NETLINK_ADD_MEMBERSHIP, 314 &ext_groups, sizeof(ext_groups)); 315 #endif 316 317 /* Bind the socket to the netlink structure for anything. */ 318 ret = bind(sock, (struct sockaddr *)&snl, sizeof(snl)); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 13 May '22

13 May '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1517751: Uninitialized variables (UNINIT) ________________________________________________________________________________________________________ *** CID 1517751: Uninitialized variables (UNINIT) /bgpd/bgp_evpn_vty.c: 1648 in show_ip_bgp_l2vpn_evpn_rd_neighbor_routes() 1642 1643 1644 if (rd_all) 1645 return bgp_show_ethernet_vpn(vty, NULL, bgp_show_type_neighbor, 1646 peer, SHOW_DISPLAY_STANDARD, uj); 1647 else >>> CID 1517751: Uninitialized variables (UNINIT) >>> Using uninitialized element of array "prd.val" when calling "bgp_show_ethernet_vpn". 1648 return bgp_show_ethernet_vpn(vty, &prd, bgp_show_type_neighbor, 1649 peer, SHOW_DISPLAY_STANDARD, uj); 1650 } 1651 1652 DEFUN(show_ip_bgp_l2vpn_evpn_neighbor_advertised_routes, 1653 show_ip_bgp_l2vpn_evpn_neighbor_advertised_routes_cmd, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 29 Apr '22

29 Apr '22

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1517499: Memory - corruptions (OVERRUN) /bgpd/bgp_route.c: 5710 in bgp_nlri_parse_ip() ________________________________________________________________________________________________________ *** CID 1517499: Memory - corruptions (OVERRUN) /bgpd/bgp_route.c: 5710 in bgp_nlri_parse_ip() 5704 "%s [Error] Update packet error (prefix length %d too large for prefix storage %zu)", 5705 peer->host, p.prefixlen, sizeof(p.u)); 5706 return BGP_NLRI_PARSE_ERROR_PACKET_LENGTH; 5707 } 5708 5709 /* Fetch prefix from NLRI packet. */ >>> CID 1517499: Memory - corruptions (OVERRUN) >>> Overrunning array "p.u.val" of 16 bytes by passing it to a function which accesses it at byte offset 47 using argument "psize" (which evaluates to 48). 5710 memcpy(p.u.val, pnt, psize); 5711 5712 /* Check address. */ 5713 if (afi == AFI_IP && safi == SAFI_UNICAST) { 5714 if (IN_CLASSD(ntohl(p.u.prefix4.s_addr))) { 5715 /* From RFC4271 Section 6.3: ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0