- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 08 Oct '21

08 Oct '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1482152: (TAINTED_SCALAR) /bfdd/control.c: 465 in control_read() /bfdd/control.c: 469 in control_read() ________________________________________________________________________________________________________ *** CID 1482152: (TAINTED_SCALAR) /bfdd/control.c: 453 in control_read() 447 /* Prepare the buffer to load the message. */ 448 bcs->bcs_version = bcm.bcm_ver; 449 bcs->bcs_type = bcm.bcm_type; 450 451 bcb->bcb_pos = sizeof(bcm); 452 bcb->bcb_left = plen; >>> CID 1482152: (TAINTED_SCALAR) >>> Passing tainted variable "8UL + bcb->bcb_left + 1UL" to a tainted sink. 453 bcb->bcb_buf = XMALLOC(MTYPE_BFDD_NOTIFICATION, 454 sizeof(bcm) + bcb->bcb_left + 1); 455 if (bcb->bcb_buf == NULL) { 456 zlog_warn("%s: not enough memory for message size: %zu", 457 __func__, bcb->bcb_left); 458 control_free(bcs); /bfdd/control.c: 465 in control_read() 459 return 0; 460 } 461 462 memcpy(bcb->bcb_buf, &bcm, sizeof(bcm)); 463 464 /* Terminate data string with NULL for later processing. */ >>> CID 1482152: (TAINTED_SCALAR) >>> Using tainted variable "8UL + bcb->bcb_left" as an index to pointer "(*bcb).bcb_buf". 465 bcb->bcb_buf[sizeof(bcm) + bcb->bcb_left] = 0; 466 467 skip_header: 468 /* Download the remaining data of the message and process it. */ 469 bread = read(sd, &bcb->bcb_buf[bcb->bcb_pos], bcb->bcb_left); 470 if (bread == 0) { /bfdd/control.c: 469 in control_read() 463 464 /* Terminate data string with NULL for later processing. */ 465 bcb->bcb_buf[sizeof(bcm) + bcb->bcb_left] = 0; 466 467 skip_header: 468 /* Download the remaining data of the message and process it. */ >>> CID 1482152: (TAINTED_SCALAR) >>> Passing tainted variable "bcb->bcb_left" to a tainted sink. 469 bread = read(sd, &bcb->bcb_buf[bcb->bcb_pos], bcb->bcb_left); 470 if (bread == 0) { 471 control_free(bcs); 472 return 0; 473 } 474 if (bread < 0) { ** CID 1472627: Memory - illegal accesses (USE_AFTER_FREE) /bfdd/control.c: 300 in control_queue_dequeue() ________________________________________________________________________________________________________ *** CID 1472627: Memory - illegal accesses (USE_AFTER_FREE) /bfdd/control.c: 300 in control_queue_dequeue() 294 control_queue_free(bcs, bcq); 295 296 /* Get the next buffer to send. */ 297 if (TAILQ_EMPTY(&bcs->bcs_bcqueue)) 298 goto empty_list; 299 >>> CID 1472627: Memory - illegal accesses (USE_AFTER_FREE) >>> Using freed pointer "bcs->bcs_bcqueue.tqh_first". 300 bcq = TAILQ_FIRST(&bcs->bcs_bcqueue); 301 bcs->bcs_bout = &bcq->bcq_bcb; 302 303 bcs->bcs_outev = NULL; 304 thread_add_write(master, control_write, bcs, bcs->bcs_sd, 305 &bcs->bcs_outev); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Certificate error deb.frrouting.org
by Eduard Margulescu 07 Oct '21

07 Oct '21

Hello team, I want to install FRR on an Ubuntu 18.04 server and I receive this error when I try to use this procedure (https://deb.frrouting.org/) : # add GPG key curl -s https://deb.frrouting.org/frr/keys.asc | sudo apt-key add - # possible values for FRRVER: frr-6 frr-7 frr-8 frr-stable # frr-stable will be the latest official stable release FRRVER="frr-stable" echo deb https://deb.frrouting.org/frr $(lsb_release -s -c) $FRRVER | sudo tee -a /etc/apt/sources.list.d/frr.list # update and install FRR sudo apt update && sudo apt install frr frr-pythontools root@ukr1:~# curl -s https://deb.frrouting.org/frr/keys.asc | sudo apt-key add - OK root@ukr1:~# FRRVER="frr-stable" root@ukr1:~# echo deb https://deb.frrouting.org/frr $(lsb_release -s -c) $FRRVER | sudo tee -a /etc/apt/sources.list.d/frr.list deb https://deb.frrouting.org/frr bionic frr-stable root@ukr1:~# sudo apt update && sudo apt install frr frr-pythontools Get:1 http://security.ubuntu.com/ubuntu bionic-security InRelease [88.7 kB] Hit:2 http://us.archive.ubuntu.com/ubuntu bionic InRelease Ign:3 https://deb.frrouting.org/frr bionic InRelease Get:4 http://us.archive.ubuntu.com/ubuntu bionic-updates InRelease [88.7 kB] Err:5 https://deb.frrouting.org/frr bionic Release Certificate verification failed: The certificate is NOT trusted. The certificate chain uses expired certificate. Could not handshake: Error in the certificate verification. [IP: 194.147.138.41 443] Get:6 http://us.archive.ubuntu.com/ubuntu bionic-backports InRelease [74.6 kB] Reading package lists... Done E: The repository 'https://deb.frrouting.org/frr bionic Release' does not have a Release file. N: Updating from such a repository can't be done securely, and is therefore disabled by default. N: See apt-secure(8) manpage for repository creation and user configuration details. Is there something you can fix ? Thanks, Eduard

3 4

Penultimate request for nominations of candidates for the annual TSC election.
by Alistair Woodman 05 Oct '21

05 Oct '21

All, This will be the penultimate request for nominations for candidates for the TSC elections. Please contact me with nominations or questions. 1) Self-nominations are welcome. 2) All nominees must be active FRR maintainers in order to stand. 3) Present TSC members must opt-out of being auto-nominated. 4) If you plan to nominate someone else, please get their approval first. I will send a final reminder in few days and then start the voting next Monday.. /a (your friendly FRR community elections officer)

1 0

2 week development freeze begins today
by Quentin Young 21 Sep '21

21 Sep '21

Hi all, FRR is trying out a new release procedure starting with the next release. The plan is this: - 6 weeks prior to release, we'll freeze the `master` branch from allowing new feature PRs to be merged. Bugfix PRs will still be permitted during that time. - 2 weeks after the freeze, we'll pull a release branch and also tag that branch as RC1. `master` will be unfrozen at that time. - 2 weeks after that, we will tag RC2. - 2 weeks after that we'll do the full release. Consistent with this plan we're freezing master for features starting today. It will reopen for feature work in 2 weeks. Quentin

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 20 Sep '21

20 Sep '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 39 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 39 defect(s) ** CID 1506514: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 1238 in ospf6_grace_lsa_show_info() ________________________________________________________________________________________________________ *** CID 1506514: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 1238 in ospf6_grace_lsa_show_info() 1232 if (!use_json) 1233 vty_out(vty, "TLV info:\n"); 1234 } else { 1235 zlog_debug(" TLV info:"); 1236 } 1237 >>> CID 1506514: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 1238 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 1239 tlvh = TLV_HDR_NEXT(tlvh)) { 1240 switch (ntohs(tlvh->type)) { 1241 case GRACE_PERIOD_TYPE: 1242 gracePeriod = (struct grace_tlv_graceperiod *)tlvh; 1243 sum += TLV_SIZE(tlvh); ** CID 1506513: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 160 in ospf6_extract_grace_lsa_fields() ________________________________________________________________________________________________________ *** CID 1506513: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 160 in ospf6_extract_grace_lsa_fields() 154 int sum = 0; 155 156 lsah = (struct ospf6_lsa_header *)lsa->header; 157 158 length = ntohs(lsah->length) - OSPF6_LSA_HEADER_SIZE; 159 >>> CID 1506513: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 160 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 161 tlvh = TLV_HDR_NEXT(tlvh)) { 162 switch (ntohs(tlvh->type)) { 163 case GRACE_PERIOD_TYPE: 164 gracePeriod = (struct grace_tlv_graceperiod *)tlvh; 165 *interval = ntohl(gracePeriod->interval); ** CID 1506512: (USE_AFTER_FREE) /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() ________________________________________________________________________________________________________ *** CID 1506512: (USE_AFTER_FREE) /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() 226 for (ALL_LSDB(nbr->retrans_list, lsa, lsanext)) { 227 struct ospf6_lsa *lsa_in_db = NULL; 228 229 /* Fetching the same copy of LSA form LSDB to validate the 230 * topochange. 231 */ >>> CID 1506512: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 232 lsa_in_db = 233 ospf6_lsdb_lookup(lsa->header->type, lsa->header->id, 234 lsa->header->adv_router, lsa->lsdb); 235 236 if (lsa_in_db && lsa_in_db->tobe_acknowledged) { 237 ospf6_lsa_unlock(lsa); /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() 226 for (ALL_LSDB(nbr->retrans_list, lsa, lsanext)) { 227 struct ospf6_lsa *lsa_in_db = NULL; 228 229 /* Fetching the same copy of LSA form LSDB to validate the 230 * topochange. 231 */ >>> CID 1506512: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 232 lsa_in_db = 233 ospf6_lsdb_lookup(lsa->header->type, lsa->header->id, 234 lsa->header->adv_router, lsa->lsdb); 235 236 if (lsa_in_db && lsa_in_db->tobe_acknowledged) { 237 ospf6_lsa_unlock(lsa); ** CID 1505419: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2459 in ospf6_make_lsupdate_list() /ospf6d/ospf6_message.c: 2459 in ospf6_make_lsupdate_list() ________________________________________________________________________________________________________ *** CID 1505419: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2458 in ospf6_make_lsupdate_list() 2452 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2453 struct ospf6_lsa *lsa, *lsanext; 2454 2455 /* skip over fixed header */ 2456 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2457 >>> CID 1505419: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2458 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { 2459 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2460 + OSPF6_HEADER_SIZE) 2461 > ospf6_packet_max(on->ospf6_if)) { 2462 ospf6_fill_header(on->ospf6_if, (*op)->s, 2463 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2459 in ospf6_make_lsupdate_list() 2453 struct ospf6_lsa *lsa, *lsanext; 2454 2455 /* skip over fixed header */ 2456 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2457 2458 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { >>> CID 1505419: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2459 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2460 + OSPF6_HEADER_SIZE) 2461 > ospf6_packet_max(on->ospf6_if)) { 2462 ospf6_fill_header(on->ospf6_if, (*op)->s, 2463 length + OSPF6_HEADER_SIZE); 2464 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2458 in ospf6_make_lsupdate_list() 2452 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2453 struct ospf6_lsa *lsa, *lsanext; 2454 2455 /* skip over fixed header */ 2456 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2457 >>> CID 1505419: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2458 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { 2459 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2460 + OSPF6_HEADER_SIZE) 2461 > ospf6_packet_max(on->ospf6_if)) { 2462 ospf6_fill_header(on->ospf6_if, (*op)->s, 2463 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2459 in ospf6_make_lsupdate_list() 2453 struct ospf6_lsa *lsa, *lsanext; 2454 2455 /* skip over fixed header */ 2456 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2457 2458 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { >>> CID 1505419: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2459 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2460 + OSPF6_HEADER_SIZE) 2461 > ospf6_packet_max(on->ospf6_if)) { 2462 ospf6_fill_header(on->ospf6_if, (*op)->s, 2463 length + OSPF6_HEADER_SIZE); 2464 (*op)->length = length + OSPF6_HEADER_SIZE; ** CID 1505418: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2288 in ospf6_make_lsreq() /ospf6d/ospf6_message.c: 2288 in ospf6_make_lsreq() ________________________________________________________________________________________________________ *** CID 1505418: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2282 in ospf6_make_lsreq() 2276 uint16_t length = 0; 2277 struct ospf6_lsa *lsa, *lsanext, *last_req = NULL; 2278 2279 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 2280 if ((length + OSPF6_HEADER_SIZE) 2281 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1505418: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2282 ospf6_lsa_unlock(lsa); 2283 if (lsanext) 2284 ospf6_lsa_unlock(lsanext); 2285 break; 2286 } 2287 stream_putw(s, 0); /* reserved */ /ospf6d/ospf6_message.c: 2282 in ospf6_make_lsreq() 2276 uint16_t length = 0; 2277 struct ospf6_lsa *lsa, *lsanext, *last_req = NULL; 2278 2279 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 2280 if ((length + OSPF6_HEADER_SIZE) 2281 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1505418: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2282 ospf6_lsa_unlock(lsa); 2283 if (lsanext) 2284 ospf6_lsa_unlock(lsanext); 2285 break; 2286 } 2287 stream_putw(s, 0); /* reserved */ /ospf6d/ospf6_message.c: 2288 in ospf6_make_lsreq() 2282 ospf6_lsa_unlock(lsa); 2283 if (lsanext) 2284 ospf6_lsa_unlock(lsanext); 2285 break; 2286 } 2287 stream_putw(s, 0); /* reserved */ >>> CID 1505418: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2288 stream_putw(s, ntohs(lsa->header->type)); 2289 stream_putl(s, ntohl(lsa->header->id)); 2290 stream_putl(s, ntohl(lsa->header->adv_router)); 2291 length += sizeof(struct ospf6_lsreq_entry); 2292 last_req = lsa; 2293 } /ospf6d/ospf6_message.c: 2288 in ospf6_make_lsreq() 2282 ospf6_lsa_unlock(lsa); 2283 if (lsanext) 2284 ospf6_lsa_unlock(lsanext); 2285 break; 2286 } 2287 stream_putw(s, 0); /* reserved */ >>> CID 1505418: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2288 stream_putw(s, ntohs(lsa->header->type)); 2289 stream_putl(s, ntohl(lsa->header->id)); 2290 stream_putl(s, ntohl(lsa->header->adv_router)); 2291 length += sizeof(struct ospf6_lsreq_entry); 2292 last_req = lsa; 2293 } ** CID 1505417: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2497 in ospf6_make_ls_retrans_list() /ospf6d/ospf6_message.c: 2497 in ospf6_make_ls_retrans_list() ________________________________________________________________________________________________________ *** CID 1505417: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2497 in ospf6_make_ls_retrans_list() 2491 struct ospf6_lsa *lsa, *lsanext; 2492 2493 /* skip over fixed header */ 2494 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2495 2496 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { >>> CID 1505417: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2497 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2498 + OSPF6_HEADER_SIZE) 2499 > ospf6_packet_max(on->ospf6_if)) { 2500 ospf6_fill_header(on->ospf6_if, (*op)->s, 2501 length + OSPF6_HEADER_SIZE); 2502 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2497 in ospf6_make_ls_retrans_list() 2491 struct ospf6_lsa *lsa, *lsanext; 2492 2493 /* skip over fixed header */ 2494 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2495 2496 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { >>> CID 1505417: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2497 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2498 + OSPF6_HEADER_SIZE) 2499 > ospf6_packet_max(on->ospf6_if)) { 2500 ospf6_fill_header(on->ospf6_if, (*op)->s, 2501 length + OSPF6_HEADER_SIZE); 2502 (*op)->length = length + OSPF6_HEADER_SIZE; ** CID 1505415: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505415: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2299 in ospf6_make_lsreq() 2293 } 2294 2295 if (last_req != NULL) { 2296 if (on->last_ls_req != NULL) 2297 on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); 2298 >>> CID 1505415: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 2299 ospf6_lsa_lock(last_req); 2300 on->last_ls_req = last_req; 2301 } 2302 2303 return length; 2304 } /ospf6d/ospf6_message.c: 2299 in ospf6_make_lsreq() 2293 } 2294 2295 if (last_req != NULL) { 2296 if (on->last_ls_req != NULL) 2297 on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); 2298 >>> CID 1505415: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 2299 ospf6_lsa_lock(last_req); 2300 on->last_ls_req = last_req; 2301 } 2302 2303 return length; 2304 } ** CID 1505414: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505414: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2162 in ospf6_make_dbdesc() 2156 stream_putc(s, on->dbdesc_bits); 2157 stream_putl(s, on->dbdesc_seqnum); 2158 2159 /* if this is not initial one, set LSA headers in dbdesc */ 2160 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 2161 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1505414: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2162 ospf6_lsa_age_update_to_send(lsa, 2163 on->ospf6_if->transdelay); 2164 2165 /* MTU check */ 2166 if ((length + sizeof(struct ospf6_lsa_header) 2167 + OSPF6_HEADER_SIZE) /ospf6d/ospf6_message.c: 2162 in ospf6_make_dbdesc() 2156 stream_putc(s, on->dbdesc_bits); 2157 stream_putl(s, on->dbdesc_seqnum); 2158 2159 /* if this is not initial one, set LSA headers in dbdesc */ 2160 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 2161 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1505414: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2162 ospf6_lsa_age_update_to_send(lsa, 2163 on->ospf6_if->transdelay); 2164 2165 /* MTU check */ 2166 if ((length + sizeof(struct ospf6_lsa_header) 2167 + OSPF6_HEADER_SIZE) ** CID 1505412: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505412: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2765 in ospf6_make_lsack_interface() 2759 static uint16_t ospf6_make_lsack_interface(struct ospf6_interface *oi, 2760 struct ospf6_packet *op) 2761 { 2762 uint16_t length = 0; 2763 struct ospf6_lsa *lsa, *lsanext; 2764 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2765 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) { 2766 if ((length + sizeof(struct ospf6_lsa_header) 2767 + OSPF6_HEADER_SIZE) 2768 > ospf6_packet_max(oi)) { 2769 /* if we run out of packet size/space here, 2770 better to try again soon. */ /ospf6d/ospf6_message.c: 2775 in ospf6_make_lsack_interface() 2769 /* if we run out of packet size/space here, 2770 better to try again soon. */ 2771 THREAD_OFF(oi->thread_send_lsack); 2772 thread_add_event(master, ospf6_lsack_send_interface, oi, 2773 0, &oi->thread_send_lsack); 2774 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2775 ospf6_lsa_unlock(lsa); 2776 if (lsanext) 2777 ospf6_lsa_unlock(lsanext); 2778 break; 2779 } 2780 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); /ospf6d/ospf6_message.c: 2780 in ospf6_make_lsack_interface() 2774 2775 ospf6_lsa_unlock(lsa); 2776 if (lsanext) 2777 ospf6_lsa_unlock(lsanext); 2778 break; 2779 } >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2780 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2781 stream_put(op->s, lsa->header, sizeof(struct ospf6_lsa_header)); 2782 length += sizeof(struct ospf6_lsa_header); 2783 2784 assert(lsa->lock == 2); 2785 ospf6_lsdb_remove(lsa, oi->lsack_list); /ospf6d/ospf6_message.c: 2780 in ospf6_make_lsack_interface() 2774 2775 ospf6_lsa_unlock(lsa); 2776 if (lsanext) 2777 ospf6_lsa_unlock(lsanext); 2778 break; 2779 } >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2780 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2781 stream_put(op->s, lsa->header, sizeof(struct ospf6_lsa_header)); 2782 length += sizeof(struct ospf6_lsa_header); 2783 2784 assert(lsa->lock == 2); 2785 ospf6_lsdb_remove(lsa, oi->lsack_list); /ospf6d/ospf6_message.c: 2765 in ospf6_make_lsack_interface() 2759 static uint16_t ospf6_make_lsack_interface(struct ospf6_interface *oi, 2760 struct ospf6_packet *op) 2761 { 2762 uint16_t length = 0; 2763 struct ospf6_lsa *lsa, *lsanext; 2764 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2765 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) { 2766 if ((length + sizeof(struct ospf6_lsa_header) 2767 + OSPF6_HEADER_SIZE) 2768 > ospf6_packet_max(oi)) { 2769 /* if we run out of packet size/space here, 2770 better to try again soon. */ ** CID 1505410: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2638 in ospf6_make_lsupdate_interface() /ospf6d/ospf6_message.c: 2638 in ospf6_make_lsupdate_interface() ________________________________________________________________________________________________________ *** CID 1505410: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2637 in ospf6_make_lsupdate_interface() 2631 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2632 struct ospf6_lsa *lsa, *lsanext; 2633 2634 /* skip over fixed header */ 2635 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2636 >>> CID 1505410: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2637 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { 2638 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2639 + OSPF6_HEADER_SIZE 2640 > ospf6_packet_max(oi)) { 2641 ospf6_fill_header(oi, (*op)->s, 2642 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2637 in ospf6_make_lsupdate_interface() 2631 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2632 struct ospf6_lsa *lsa, *lsanext; 2633 2634 /* skip over fixed header */ 2635 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2636 >>> CID 1505410: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2637 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { 2638 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2639 + OSPF6_HEADER_SIZE 2640 > ospf6_packet_max(oi)) { 2641 ospf6_fill_header(oi, (*op)->s, 2642 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2638 in ospf6_make_lsupdate_interface() 2632 struct ospf6_lsa *lsa, *lsanext; 2633 2634 /* skip over fixed header */ 2635 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2636 2637 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { >>> CID 1505410: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2638 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2639 + OSPF6_HEADER_SIZE 2640 > ospf6_packet_max(oi)) { 2641 ospf6_fill_header(oi, (*op)->s, 2642 length + OSPF6_HEADER_SIZE); 2643 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2638 in ospf6_make_lsupdate_interface() 2632 struct ospf6_lsa *lsa, *lsanext; 2633 2634 /* skip over fixed header */ 2635 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2636 2637 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { >>> CID 1505410: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2638 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2639 + OSPF6_HEADER_SIZE 2640 > ospf6_packet_max(oi)) { 2641 ospf6_fill_header(oi, (*op)->s, 2642 length + OSPF6_HEADER_SIZE); 2643 (*op)->length = length + OSPF6_HEADER_SIZE; ** CID 1505407: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505407: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2313 in ospf6_make_lsack_neighbor() 2307 struct ospf6_packet **op) 2308 { 2309 uint16_t length = 0; 2310 struct ospf6_lsa *lsa, *lsanext; 2311 int lsa_cnt = 0; 2312 >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2313 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) { 2314 if ((length + sizeof(struct ospf6_lsa_header) 2315 + OSPF6_HEADER_SIZE) 2316 > ospf6_packet_max(on->ospf6_if)) { 2317 /* if we run out of packet size/space here, 2318 better to try again soon. */ /ospf6d/ospf6_message.c: 2313 in ospf6_make_lsack_neighbor() 2307 struct ospf6_packet **op) 2308 { 2309 uint16_t length = 0; 2310 struct ospf6_lsa *lsa, *lsanext; 2311 int lsa_cnt = 0; 2312 >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2313 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) { 2314 if ((length + sizeof(struct ospf6_lsa_header) 2315 + OSPF6_HEADER_SIZE) 2316 > ospf6_packet_max(on->ospf6_if)) { 2317 /* if we run out of packet size/space here, 2318 better to try again soon. */ /ospf6d/ospf6_message.c: 2335 in ospf6_make_lsack_neighbor() 2329 ospf6_make_header(OSPF6_MESSAGE_TYPE_LSACK, 2330 on->ospf6_if, (*op)->s); 2331 length = 0; 2332 lsa_cnt = 0; 2333 } 2334 } >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2335 ospf6_lsa_age_update_to_send(lsa, on->ospf6_if->transdelay); 2336 stream_put((*op)->s, lsa->header, 2337 sizeof(struct ospf6_lsa_header)); 2338 length += sizeof(struct ospf6_lsa_header); 2339 2340 assert(lsa->lock == 2); /ospf6d/ospf6_message.c: 2335 in ospf6_make_lsack_neighbor() 2329 ospf6_make_header(OSPF6_MESSAGE_TYPE_LSACK, 2330 on->ospf6_if, (*op)->s); 2331 length = 0; 2332 lsa_cnt = 0; 2333 } 2334 } >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2335 ospf6_lsa_age_update_to_send(lsa, on->ospf6_if->transdelay); 2336 stream_put((*op)->s, lsa->header, 2337 sizeof(struct ospf6_lsa_header)); 2338 length += sizeof(struct ospf6_lsa_header); 2339 2340 assert(lsa->lock == 2); ** CID 1504898: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1504898: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_dump.c: 585 in ospf_packet_dump() 579 ospf_packet_hello_dump(s, ntohs(ospfh->length)); 580 break; 581 case OSPF_MSG_DB_DESC: 582 ospf_packet_db_desc_dump(s, ntohs(ospfh->length)); 583 break; 584 case OSPF_MSG_LS_REQ: >>> CID 1504898: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(ospfh->length)" to a tainted sink. 585 ospf_packet_ls_req_dump(s, ntohs(ospfh->length)); 586 break; 587 case OSPF_MSG_LS_UPD: 588 ospf_packet_ls_upd_dump(s, ntohs(ospfh->length)); 589 break; 590 case OSPF_MSG_LS_ACK: ** CID 1504897: Memory - corruptions (OVERRUN) /ospfd/ospf_apiserver.c: 1175 in ospf_apiserver_handle_register_event() ________________________________________________________________________________________________________ *** CID 1504897: Memory - corruptions (OVERRUN) /ospfd/ospf_apiserver.c: 1175 in ospf_apiserver_handle_register_event() 1169 size = ntohs(msg->hdr.msglen); 1170 if (size < OSPF_MAX_LSA_SIZE) { 1171 1172 apiserv->filter = XMALLOC(MTYPE_OSPF_APISERVER_MSGFILTER, size); 1173 1174 /* copy it over. */ >>> CID 1504897: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_filter_type of 4 bytes by passing it to a function which accesses it at byte offset 1498 using argument "size" (which evaluates to 1499). 1175 memcpy(apiserv->filter, &rmsg->filter, size); 1176 rc = OSPF_API_OK; 1177 } else 1178 rc = OSPF_API_NOMEMORY; 1179 1180 /* Send a reply back to client with return code */ ** CID 1504585: Insecure data handling (TAINTED_SCALAR) /ospfclient/ospf_apiclient.c: 334 in ospf_apiclient_send_request() ________________________________________________________________________________________________________ *** CID 1504585: Insecure data handling (TAINTED_SCALAR) /ospfclient/ospf_apiclient.c: 334 in ospf_apiclient_send_request() 328 /* Wait for reply */ /* NB: New "msg" is allocated by "msg_read()". */ 329 msg = msg_read(oclient->fd_sync); 330 if (!msg) 331 return -1; 332 333 assert(msg->hdr.msgtype == MSG_REPLY); >>> CID 1504585: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "reqseq" as a loop boundary. 334 assert(ntohl(msg->hdr.msgseq) == reqseq); 335 336 msgreply = (struct msg_reply *)STREAM_DATA(msg->s); 337 rc = msgreply->errcode; 338 msg_free(msg); 339 ** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 623 in ospf_apiclient_handle_lsa_delete() ________________________________________________________________________________________________________ *** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 623 in ospf_apiclient_handle_lsa_delete() 617 __func__, lsalen, OSPF_MAX_LSA_SIZE); 618 return; 619 } 620 621 p = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 622 >>> CID 1497888: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 623 memcpy(p, &(cn->data), lsalen); 624 lsa = p; 625 626 /* Invoke registered update callback function */ 627 if (oclient->delete_notify) { 628 (oclient->delete_notify)(cn->ifaddr, cn->area_id, ** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 588 in ospf_apiclient_handle_lsa_update() ________________________________________________________________________________________________________ *** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 588 in ospf_apiclient_handle_lsa_update() 582 __func__, lsalen, OSPF_MAX_LSA_SIZE); 583 return; 584 } 585 586 p = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 587 >>> CID 1497886: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 588 memcpy(p, &(cn->data), lsalen); 589 lsa = p; 590 591 /* Invoke registered update callback function */ 592 if (oclient->update_notify) { 593 (oclient->update_notify)(cn->ifaddr, cn->area_id, ** CID 1485637: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb_allocator.h: 57 in qpb_alloc_ptr_array() ________________________________________________________________________________________________________ *** CID 1485637: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb_allocator.h: 57 in qpb_alloc_ptr_array() 51 * 52 * Allocate space for the specified number of pointers. 53 */ 54 static inline void *qpb_alloc_ptr_array(qpb_allocator_t *allocator, 55 size_t num_ptrs) 56 { >>> CID 1485637: Incorrect expression (SIZEOF_MISMATCH) >>> Passing argument "num_ptrs * 8UL /* sizeof (void *) */" to function "qpb_alloc" which returns a value of type "void *" is suspicious. 57 return qpb_alloc(allocator, num_ptrs * sizeof(void *)); 58 } 59 60 /* 61 * qpb_free 62 */ ** CID 1485635: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb.h: 124 in qpb__l3_prefix__get() ________________________________________________________________________________________________________ *** CID 1485635: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb.h: 124 in qpb__l3_prefix__get() 118 uint8_t family, struct prefix *prefix) 119 { 120 121 switch (family) { 122 123 case AF_INET: >>> CID 1485635: Incorrect expression (SIZEOF_MISMATCH) >>> Passing argument "prefix" of type "struct prefix *" and argument "16UL" ("sizeof (struct prefix_ipv4)") to function "memset" is suspicious because a multiple of "sizeof (struct prefix) /*48*/" is expected. 124 memset(prefix, 0, sizeof(struct prefix_ipv4)); 125 break; 126 127 case AF_INET6: 128 memset(prefix, 0, sizeof(struct prefix_ipv6)); 129 break; ** CID 1482217: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1482217: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_packet.c: 355 in ospf_check_md5_digest() 349 EVP_DigestUpdate(ctx, ck->auth_key, OSPF_AUTH_MD5_SIZE); 350 EVP_DigestFinal(ctx, digest, &md5_size); 351 EVP_MD_CTX_free(ctx); 352 #elif CRYPTO_INTERNAL 353 memset(&ctx, 0, sizeof(ctx)); 354 MD5Init(&ctx); >>> CID 1482217: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "length" to a tainted sink. 355 MD5Update(&ctx, ospfh, length); 356 MD5Update(&ctx, ck->auth_key, OSPF_AUTH_MD5_SIZE); 357 MD5Final(digest, &ctx); 358 #endif 359 360 /* compare the two */ ** CID 1482211: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1482211: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_packet.c: 430 in ospf_make_md5_digest() 424 EVP_DigestUpdate(ctx, auth_key, OSPF_AUTH_MD5_SIZE); 425 EVP_DigestFinal(ctx, digest, &md5_size); 426 EVP_MD_CTX_free(ctx); 427 #elif CRYPTO_INTERNAL 428 memset(&ctx, 0, sizeof(ctx)); 429 MD5Init(&ctx); >>> CID 1482211: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(ospfh->length)" to a tainted sink. 430 MD5Update(&ctx, ibuf, ntohs(ospfh->length)); 431 MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE); 432 MD5Final(digest, &ctx); 433 #endif 434 435 /* Append md5 digest to the end of the stream. */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 17 Sep '21

17 Sep '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 63 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1506902: Error handling issues (CHECKED_RETURN) /zebra/zebra_fpm.c: 2000 in zfpm_init() ________________________________________________________________________________________________________ *** CID 1506902: Error handling issues (CHECKED_RETURN) /zebra/zebra_fpm.c: 2000 in zfpm_init() 1994 1995 zfpm_stats_init(&zfpm_g->stats); 1996 zfpm_stats_init(&zfpm_g->last_ivl_stats); 1997 zfpm_stats_init(&zfpm_g->cumulative_stats); 1998 1999 memset(&ipv4ll_gateway, 0, sizeof(ipv4ll_gateway)); >>> CID 1506902: Error handling issues (CHECKED_RETURN) >>> Calling "inet_pton" without checking return value (as is done elsewhere 10 out of 11 times). 2000 inet_pton(AF_INET, ipv4_ll_buf, &ipv4ll_gateway.ipv4); 2001 2002 install_node(&zebra_node); 2003 install_element(ENABLE_NODE, &show_zebra_fpm_stats_cmd); 2004 install_element(ENABLE_NODE, &clear_zebra_fpm_stats_cmd); 2005 install_element(CONFIG_NODE, &fpm_remote_ip_cmd); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 15 Sep '21

15 Sep '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1506874: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1506874: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_updgrp_adv.c: 939 in subgroup_default_originate() 933 SET_FLAG(subgrp->sflags, 934 SUBGRP_STATUS_DEFAULT_ORIGINATE); 935 subgroup_default_update_packet(subgrp, new_attr, from); 936 } 937 } 938 >>> CID 1506874: Null pointer dereferences (FORWARD_NULL) >>> Passing "&attr.aspath" to "aspath_unintern", which dereferences null "attr.aspath". 939 aspath_unintern(&attr.aspath); 940 } 941 942 /* 943 * Announce the BGP table to a subgroup. 944 * ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Announcing FRR 8.0.1
by Martin Winter 30 Aug '21

30 Aug '21

We are pleased to announce release 8.0.1 of FRRouting! Github Release - https://github.com/FRRouting/frr/releases/tag/frr-8.0.1 Debian Packaging - https://deb.frrouting.org/ RPM Packaging - https://rpm.frrouting.org/ This is a bugfix release of FRR 8.0 For a detailed changelog with all the fixes over 8.0 see https://github.com/FRRouting/frr/releases/tag/frr-8.0.1 As always, thank you to all contributors! - Martin

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 25 Aug '21

25 Aug '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1506591: Control flow issues (DEADCODE) /pimd/pim_igmpv3.c: 548 in allow() ________________________________________________________________________________________________________ *** CID 1506591: Control flow issues (DEADCODE) /pimd/pim_igmpv3.c: 548 in allow() 542 GMI, accomplishes this. 543 */ 544 igmp_source_reset_gmi(igmp, group, source); 545 546 } /* scan received sources */ 547 >>> CID 1506591: Control flow issues (DEADCODE) >>> Execution cannot reach the expression "group->group_filtermode_isexcl" inside this statement: "if (num_sources == 0 && gro...". 548 if ((num_sources == 0) && (group->group_filtermode_isexcl) 549 && (listcount(group->group_source_list) == 1)) { 550 struct in_addr star = {.s_addr = INADDR_ANY}; 551 552 source = igmp_find_source_by_addr(group, star); 553 if (source) ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 21 Aug '21

21 Aug '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1506514: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 1222 in ospf6_grace_lsa_show_info() ________________________________________________________________________________________________________ *** CID 1506514: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 1222 in ospf6_grace_lsa_show_info() 1216 if (!use_json) 1217 vty_out(vty, "TLV info:\n"); 1218 } else { 1219 zlog_debug(" TLV info:"); 1220 } 1221 >>> CID 1506514: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 1222 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 1223 tlvh = TLV_HDR_NEXT(tlvh)) { 1224 switch (ntohs(tlvh->type)) { 1225 case GRACE_PERIOD_TYPE: 1226 gracePeriod = (struct grace_tlv_graceperiod *)tlvh; 1227 sum += TLV_SIZE(tlvh); ** CID 1506513: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 160 in ospf6_extract_grace_lsa_fields() ________________________________________________________________________________________________________ *** CID 1506513: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_gr_helper.c: 160 in ospf6_extract_grace_lsa_fields() 154 int sum = 0; 155 156 lsah = (struct ospf6_lsa_header *)lsa->header; 157 158 length = ntohs(lsah->length) - OSPF6_LSA_HEADER_SIZE; 159 >>> CID 1506513: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 160 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 161 tlvh = TLV_HDR_NEXT(tlvh)) { 162 switch (ntohs(tlvh->type)) { 163 case GRACE_PERIOD_TYPE: 164 gracePeriod = (struct grace_tlv_graceperiod *)tlvh; 165 *interval = ntohl(gracePeriod->interval); ** CID 1506512: (USE_AFTER_FREE) /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() ________________________________________________________________________________________________________ *** CID 1506512: (USE_AFTER_FREE) /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() 226 for (ALL_LSDB(nbr->retrans_list, lsa, lsanext)) { 227 struct ospf6_lsa *lsa_in_db = NULL; 228 229 /* Fetching the same copy of LSA form LSDB to validate the 230 * topochange. 231 */ >>> CID 1506512: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 232 lsa_in_db = 233 ospf6_lsdb_lookup(lsa->header->type, lsa->header->id, 234 lsa->header->adv_router, lsa->lsdb); 235 236 if (lsa_in_db && lsa_in_db->tobe_acknowledged) 237 return OSPF6_TRUE; /ospf6d/ospf6_gr_helper.c: 232 in ospf6_check_chg_in_rxmt_list() 226 for (ALL_LSDB(nbr->retrans_list, lsa, lsanext)) { 227 struct ospf6_lsa *lsa_in_db = NULL; 228 229 /* Fetching the same copy of LSA form LSDB to validate the 230 * topochange. 231 */ >>> CID 1506512: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 232 lsa_in_db = 233 ospf6_lsdb_lookup(lsa->header->type, lsa->header->id, 234 lsa->header->adv_router, lsa->lsdb); 235 236 if (lsa_in_db && lsa_in_db->tobe_acknowledged) 237 return OSPF6_TRUE; ** CID 1506511: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1506511: Null pointer dereferences (NULL_RETURNS) /ospf6d/ospf6_gr_helper.c: 1163 in show_ipv6_ospf6_gr_helper_magic() 1157 if (argv_find(argv, argc, "detail", &idx)) 1158 detail = true; 1159 1160 if (uj) 1161 json = json_object_new_object(); 1162 >>> CID 1506511: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "ospf6" when calling "show_ospf6_gr_helper_details". 1163 show_ospf6_gr_helper_details(vty, ospf6, json, uj, detail); 1164 1165 if (uj) { 1166 vty_out(vty, "%s\n", 1167 json_object_to_json_string_ext( 1168 json, JSON_C_TO_STRING_PRETTY)); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0