- dev - lists.frrouting.org

Discussion on new CMGD Infra
by Pushpasis Sarkar 25 Jun '21

25 Jun '21

Hi All, Let’s meet to continue on discussing the new CMGD infra architecture proposal as discussed on the ‘yang’ slack channel. Thanks and regards -Pushpasis

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 24 Jun '21

24 Jun '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1505589: (USE_AFTER_FREE) /bgpd/bgp_updgrp_adv.c: 832 in subgroup_default_originate() /bgpd/bgp_updgrp_adv.c: 832 in subgroup_default_originate() ________________________________________________________________________________________________________ *** CID 1505589: (USE_AFTER_FREE) /bgpd/bgp_updgrp_adv.c: 832 in subgroup_default_originate() 826 pi = pi->next) { 827 struct attr tmp_attr; 828 struct bgp_path_info tmp_pi; 829 struct bgp_path_info_extra tmp_pie; 830 831 tmp_attr = *pi->attr; >>> CID 1505589: (USE_AFTER_FREE) >>> Using freed pointer "attr.aspath". 832 tmp_attr.aspath = attr.aspath; 833 834 prep_for_rmap_apply(&tmp_pi, &tmp_pie, dest, pi, 835 pi->peer, &tmp_attr); 836 837 ret = route_map_apply( /bgpd/bgp_updgrp_adv.c: 832 in subgroup_default_originate() 826 pi = pi->next) { 827 struct attr tmp_attr; 828 struct bgp_path_info tmp_pi; 829 struct bgp_path_info_extra tmp_pie; 830 831 tmp_attr = *pi->attr; >>> CID 1505589: (USE_AFTER_FREE) >>> Using freed pointer "attr.aspath". 832 tmp_attr.aspath = attr.aspath; 833 834 prep_for_rmap_apply(&tmp_pi, &tmp_pie, dest, pi, 835 pi->peer, &tmp_attr); 836 837 ret = route_map_apply( ** CID 1500587: Security best practices violations (DC.WEAK_CRYPTO) /pathd/pathd.c: 669 in srte_candidate_add() ________________________________________________________________________________________________________ *** CID 1500587: Security best practices violations (DC.WEAK_CRYPTO) /pathd/pathd.c: 669 in srte_candidate_add() 663 candidate = XCALLOC(MTYPE_PATH_SR_CANDIDATE, sizeof(*candidate)); 664 lsp = XCALLOC(MTYPE_PATH_SR_CANDIDATE, sizeof(*lsp)); 665 666 candidate->preference = preference; 667 candidate->policy = policy; 668 candidate->type = SRTE_CANDIDATE_TYPE_UNDEFINED; >>> CID 1500587: Security best practices violations (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 669 candidate->discriminator = rand(); 670 candidate->protocol_origin = origin; 671 if (originator != NULL) { 672 strlcpy(candidate->originator, originator, 673 sizeof(candidate->originator)); 674 lsp->protocol_origin = origin; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 23 Jun '21

23 Jun '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 13 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 10 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 13 of 13 defect(s) ** CID 1505419: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2366 in ospf6_make_lsupdate_list() /ospf6d/ospf6_message.c: 2366 in ospf6_make_lsupdate_list() ________________________________________________________________________________________________________ *** CID 1505419: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2365 in ospf6_make_lsupdate_list() 2359 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2360 struct ospf6_lsa *lsa, *lsanext; 2361 2362 /* skip over fixed header */ 2363 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2364 >>> CID 1505419: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2365 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { 2366 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2367 + OSPF6_HEADER_SIZE) 2368 > ospf6_packet_max(on->ospf6_if)) { 2369 ospf6_fill_header(on->ospf6_if, (*op)->s, 2370 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2366 in ospf6_make_lsupdate_list() 2360 struct ospf6_lsa *lsa, *lsanext; 2361 2362 /* skip over fixed header */ 2363 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2364 2365 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { >>> CID 1505419: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2366 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2367 + OSPF6_HEADER_SIZE) 2368 > ospf6_packet_max(on->ospf6_if)) { 2369 ospf6_fill_header(on->ospf6_if, (*op)->s, 2370 length + OSPF6_HEADER_SIZE); 2371 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2365 in ospf6_make_lsupdate_list() 2359 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2360 struct ospf6_lsa *lsa, *lsanext; 2361 2362 /* skip over fixed header */ 2363 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2364 >>> CID 1505419: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2365 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { 2366 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2367 + OSPF6_HEADER_SIZE) 2368 > ospf6_packet_max(on->ospf6_if)) { 2369 ospf6_fill_header(on->ospf6_if, (*op)->s, 2370 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2366 in ospf6_make_lsupdate_list() 2360 struct ospf6_lsa *lsa, *lsanext; 2361 2362 /* skip over fixed header */ 2363 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2364 2365 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) { >>> CID 1505419: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2366 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2367 + OSPF6_HEADER_SIZE) 2368 > ospf6_packet_max(on->ospf6_if)) { 2369 ospf6_fill_header(on->ospf6_if, (*op)->s, 2370 length + OSPF6_HEADER_SIZE); 2371 (*op)->length = length + OSPF6_HEADER_SIZE; ** CID 1505418: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2207 in ospf6_make_lsreq() /ospf6d/ospf6_message.c: 2207 in ospf6_make_lsreq() ________________________________________________________________________________________________________ *** CID 1505418: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2207 in ospf6_make_lsreq() 2201 ospf6_lsa_unlock(lsa); 2202 if (lsanext) 2203 ospf6_lsa_unlock(lsanext); 2204 break; 2205 } 2206 stream_putw(s, 0); /* reserved */ >>> CID 1505418: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2207 stream_putw(s, ntohs(lsa->header->type)); 2208 stream_putl(s, ntohl(lsa->header->id)); 2209 stream_putl(s, ntohl(lsa->header->adv_router)); 2210 length += sizeof(struct ospf6_lsreq_entry); 2211 last_req = lsa; 2212 } /ospf6d/ospf6_message.c: 2201 in ospf6_make_lsreq() 2195 uint16_t length = 0; 2196 struct ospf6_lsa *lsa, *lsanext, *last_req = NULL; 2197 2198 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 2199 if ((length + OSPF6_HEADER_SIZE) 2200 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1505418: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2201 ospf6_lsa_unlock(lsa); 2202 if (lsanext) 2203 ospf6_lsa_unlock(lsanext); 2204 break; 2205 } 2206 stream_putw(s, 0); /* reserved */ /ospf6d/ospf6_message.c: 2201 in ospf6_make_lsreq() 2195 uint16_t length = 0; 2196 struct ospf6_lsa *lsa, *lsanext, *last_req = NULL; 2197 2198 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 2199 if ((length + OSPF6_HEADER_SIZE) 2200 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1505418: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2201 ospf6_lsa_unlock(lsa); 2202 if (lsanext) 2203 ospf6_lsa_unlock(lsanext); 2204 break; 2205 } 2206 stream_putw(s, 0); /* reserved */ /ospf6d/ospf6_message.c: 2207 in ospf6_make_lsreq() 2201 ospf6_lsa_unlock(lsa); 2202 if (lsanext) 2203 ospf6_lsa_unlock(lsanext); 2204 break; 2205 } 2206 stream_putw(s, 0); /* reserved */ >>> CID 1505418: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2207 stream_putw(s, ntohs(lsa->header->type)); 2208 stream_putl(s, ntohl(lsa->header->id)); 2209 stream_putl(s, ntohl(lsa->header->adv_router)); 2210 length += sizeof(struct ospf6_lsreq_entry); 2211 last_req = lsa; 2212 } ** CID 1505417: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2404 in ospf6_make_ls_retrans_list() /ospf6d/ospf6_message.c: 2404 in ospf6_make_ls_retrans_list() ________________________________________________________________________________________________________ *** CID 1505417: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2404 in ospf6_make_ls_retrans_list() 2398 struct ospf6_lsa *lsa, *lsanext; 2399 2400 /* skip over fixed header */ 2401 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2402 2403 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { >>> CID 1505417: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2404 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2405 + OSPF6_HEADER_SIZE) 2406 > ospf6_packet_max(on->ospf6_if)) { 2407 ospf6_fill_header(on->ospf6_if, (*op)->s, 2408 length + OSPF6_HEADER_SIZE); 2409 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2404 in ospf6_make_ls_retrans_list() 2398 struct ospf6_lsa *lsa, *lsanext; 2399 2400 /* skip over fixed header */ 2401 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2402 2403 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { >>> CID 1505417: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2404 if ((length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2405 + OSPF6_HEADER_SIZE) 2406 > ospf6_packet_max(on->ospf6_if)) { 2407 ospf6_fill_header(on->ospf6_if, (*op)->s, 2408 length + OSPF6_HEADER_SIZE); 2409 (*op)->length = length + OSPF6_HEADER_SIZE; ** CID 1505416: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /ospf6d/ospf6_message.c: 1949 in ospf6_write() ________________________________________________________________________________________________________ *** CID 1505416: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /ospf6d/ospf6_message.c: 1949 in ospf6_write() 1943 monotime(&timestamp); 1944 if (oi->hello_out) 1945 latency = monotime_since(&oi->last_hello, NULL) 1946 - (oi->hello_interval * 1000000); 1947 1948 /* log if latency exceeds the hello period */ >>> CID 1505416: Integer handling issues (OVERFLOW_BEFORE_WIDEN) >>> Potentially overflowing expression "oi->hello_interval * 1000000" with type "int" (32 bits, signed) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "_int64_t" (64 bits, signed). 1949 if (latency > (oi->hello_interval * 1000000)) 1950 zlog_warn("%s hello TX high latency %" PRId64 1951 "us.", 1952 __func__, latency); 1953 oi->last_hello = timestamp; 1954 oi->hello_out++; ** CID 1505415: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505415: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2218 in ospf6_make_lsreq() 2212 } 2213 2214 if (last_req != NULL) { 2215 if (on->last_ls_req != NULL) 2216 on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); 2217 >>> CID 1505415: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 2218 ospf6_lsa_lock(last_req); 2219 on->last_ls_req = last_req; 2220 } 2221 2222 return length; 2223 } /ospf6d/ospf6_message.c: 2218 in ospf6_make_lsreq() 2212 } 2213 2214 if (last_req != NULL) { 2215 if (on->last_ls_req != NULL) 2216 on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); 2217 >>> CID 1505415: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 2218 ospf6_lsa_lock(last_req); 2219 on->last_ls_req = last_req; 2220 } 2221 2222 return length; 2223 } ** CID 1505414: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505414: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2081 in ospf6_make_dbdesc() 2075 stream_putc(s, on->dbdesc_bits); 2076 stream_putl(s, on->dbdesc_seqnum); 2077 2078 /* if this is not initial one, set LSA headers in dbdesc */ 2079 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 2080 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1505414: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2081 ospf6_lsa_age_update_to_send(lsa, 2082 on->ospf6_if->transdelay); 2083 2084 /* MTU check */ 2085 if ((length + sizeof(struct ospf6_lsa_header) 2086 + OSPF6_HEADER_SIZE) /ospf6d/ospf6_message.c: 2081 in ospf6_make_dbdesc() 2075 stream_putc(s, on->dbdesc_bits); 2076 stream_putl(s, on->dbdesc_seqnum); 2077 2078 /* if this is not initial one, set LSA headers in dbdesc */ 2079 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 2080 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1505414: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2081 ospf6_lsa_age_update_to_send(lsa, 2082 on->ospf6_if->transdelay); 2083 2084 /* MTU check */ 2085 if ((length + sizeof(struct ospf6_lsa_header) 2086 + OSPF6_HEADER_SIZE) ** CID 1505413: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_evpn_vty.c: 67 in argv_find_and_parse_oly_idx() ________________________________________________________________________________________________________ *** CID 1505413: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_evpn_vty.c: 67 in argv_find_and_parse_oly_idx() 61 62 int argv_find_and_parse_oly_idx(struct cmd_token **argv, int argc, int *oly_idx, 63 enum overlay_index_type *oly) 64 { 65 *oly = OVERLAY_INDEX_TYPE_NONE; 66 if (argv_find(argv, argc, "gateway-ip", oly_idx)) { >>> CID 1505413: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "oly" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 67 if (oly) 68 *oly = OVERLAY_INDEX_GATEWAY_IP; 69 } 70 return 1; 71 } 72 ** CID 1505412: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505412: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2672 in ospf6_make_lsack_interface() 2666 static uint16_t ospf6_make_lsack_interface(struct ospf6_interface *oi, 2667 struct ospf6_packet *op) 2668 { 2669 uint16_t length = 0; 2670 struct ospf6_lsa *lsa, *lsanext; 2671 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2672 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) { 2673 if ((length + sizeof(struct ospf6_lsa_header) 2674 + OSPF6_HEADER_SIZE) 2675 > ospf6_packet_max(oi)) { 2676 /* if we run out of packet size/space here, 2677 better to try again soon. */ /ospf6d/ospf6_message.c: 2687 in ospf6_make_lsack_interface() 2681 2682 ospf6_lsa_unlock(lsa); 2683 if (lsanext) 2684 ospf6_lsa_unlock(lsanext); 2685 break; 2686 } >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2687 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2688 stream_put(op->s, lsa->header, sizeof(struct ospf6_lsa_header)); 2689 length += sizeof(struct ospf6_lsa_header); 2690 2691 assert(lsa->lock == 2); 2692 ospf6_lsdb_remove(lsa, oi->lsack_list); /ospf6d/ospf6_message.c: 2687 in ospf6_make_lsack_interface() 2681 2682 ospf6_lsa_unlock(lsa); 2683 if (lsanext) 2684 ospf6_lsa_unlock(lsanext); 2685 break; 2686 } >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2687 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2688 stream_put(op->s, lsa->header, sizeof(struct ospf6_lsa_header)); 2689 length += sizeof(struct ospf6_lsa_header); 2690 2691 assert(lsa->lock == 2); 2692 ospf6_lsdb_remove(lsa, oi->lsack_list); /ospf6d/ospf6_message.c: 2682 in ospf6_make_lsack_interface() 2676 /* if we run out of packet size/space here, 2677 better to try again soon. */ 2678 THREAD_OFF(oi->thread_send_lsack); 2679 thread_add_event(master, ospf6_lsack_send_interface, oi, 2680 0, &oi->thread_send_lsack); 2681 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2682 ospf6_lsa_unlock(lsa); 2683 if (lsanext) 2684 ospf6_lsa_unlock(lsanext); 2685 break; 2686 } 2687 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); /ospf6d/ospf6_message.c: 2672 in ospf6_make_lsack_interface() 2666 static uint16_t ospf6_make_lsack_interface(struct ospf6_interface *oi, 2667 struct ospf6_packet *op) 2668 { 2669 uint16_t length = 0; 2670 struct ospf6_lsa *lsa, *lsanext; 2671 >>> CID 1505412: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2672 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) { 2673 if ((length + sizeof(struct ospf6_lsa_header) 2674 + OSPF6_HEADER_SIZE) 2675 > ospf6_packet_max(oi)) { 2676 /* if we run out of packet size/space here, 2677 better to try again soon. */ ** CID 1505411: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /ospf6d/ospf6_message.c: 449 in ospf6_hello_recv() ________________________________________________________________________________________________________ *** CID 1505411: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /ospf6d/ospf6_message.c: 449 in ospf6_hello_recv() 443 444 /* check latency against hello period */ 445 if (on->hello_in) 446 latency = monotime_since(&on->last_hello, NULL) 447 - (oi->hello_interval * 1000000); 448 /* log if latency exceeds the hello period */ >>> CID 1505411: Integer handling issues (OVERFLOW_BEFORE_WIDEN) >>> Potentially overflowing expression "oi->hello_interval * 1000000" with type "int" (32 bits, signed) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "_int64_t" (64 bits, signed). 449 if (latency > (oi->hello_interval * 1000000)) 450 zlog_warn("%s RX %pI4 high latency %" PRId64 "us.", __func__, 451 &on->router_id, latency); 452 on->last_hello = timestamp; 453 on->hello_in++; 454 ** CID 1505410: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2545 in ospf6_make_lsupdate_interface() /ospf6d/ospf6_message.c: 2545 in ospf6_make_lsupdate_interface() ________________________________________________________________________________________________________ *** CID 1505410: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2544 in ospf6_make_lsupdate_interface() 2538 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2539 struct ospf6_lsa *lsa, *lsanext; 2540 2541 /* skip over fixed header */ 2542 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2543 >>> CID 1505410: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2544 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { 2545 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2546 + OSPF6_HEADER_SIZE 2547 > ospf6_packet_max(oi)) { 2548 ospf6_fill_header(oi, (*op)->s, 2549 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2544 in ospf6_make_lsupdate_interface() 2538 uint16_t length = OSPF6_LS_UPD_MIN_SIZE; 2539 struct ospf6_lsa *lsa, *lsanext; 2540 2541 /* skip over fixed header */ 2542 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2543 >>> CID 1505410: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2544 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { 2545 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2546 + OSPF6_HEADER_SIZE 2547 > ospf6_packet_max(oi)) { 2548 ospf6_fill_header(oi, (*op)->s, 2549 length + OSPF6_HEADER_SIZE); /ospf6d/ospf6_message.c: 2545 in ospf6_make_lsupdate_interface() 2539 struct ospf6_lsa *lsa, *lsanext; 2540 2541 /* skip over fixed header */ 2542 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2543 2544 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { >>> CID 1505410: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2545 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2546 + OSPF6_HEADER_SIZE 2547 > ospf6_packet_max(oi)) { 2548 ospf6_fill_header(oi, (*op)->s, 2549 length + OSPF6_HEADER_SIZE); 2550 (*op)->length = length + OSPF6_HEADER_SIZE; /ospf6d/ospf6_message.c: 2545 in ospf6_make_lsupdate_interface() 2539 struct ospf6_lsa *lsa, *lsanext; 2540 2541 /* skip over fixed header */ 2542 stream_forward_endp((*op)->s, OSPF6_LS_UPD_MIN_SIZE); 2543 2544 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) { >>> CID 1505410: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2545 if (length + (unsigned int)OSPF6_LSA_SIZE(lsa->header) 2546 + OSPF6_HEADER_SIZE 2547 > ospf6_packet_max(oi)) { 2548 ospf6_fill_header(oi, (*op)->s, 2549 length + OSPF6_HEADER_SIZE); 2550 (*op)->length = length + OSPF6_HEADER_SIZE; ** CID 1505409: (SIGN_EXTENSION) /ospf6d/ospf6_message.c: 1946 in ospf6_write() /ospf6d/ospf6_message.c: 1949 in ospf6_write() ________________________________________________________________________________________________________ *** CID 1505409: (SIGN_EXTENSION) /ospf6d/ospf6_message.c: 1946 in ospf6_write() 1940 } 1941 switch (oh->type) { 1942 case OSPF6_MESSAGE_TYPE_HELLO: 1943 monotime(&timestamp); 1944 if (oi->hello_out) 1945 latency = monotime_since(&oi->last_hello, NULL) >>> CID 1505409: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "oi->hello_interval" with type "uint16_t" (16 bits, unsigned) is promoted in "oi->hello_interval * 1000000" to type "int" (32 bits, signed), then sign-extended to type "long long" (64 bits, signed). If "oi->hello_interval * 1000000" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1946 - (oi->hello_interval * 1000000); 1947 1948 /* log if latency exceeds the hello period */ 1949 if (latency > (oi->hello_interval * 1000000)) 1950 zlog_warn("%s hello TX high latency %" PRId64 1951 "us.", /ospf6d/ospf6_message.c: 1949 in ospf6_write() 1943 monotime(&timestamp); 1944 if (oi->hello_out) 1945 latency = monotime_since(&oi->last_hello, NULL) 1946 - (oi->hello_interval * 1000000); 1947 1948 /* log if latency exceeds the hello period */ >>> CID 1505409: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "oi->hello_interval" with type "uint16_t" (16 bits, unsigned) is promoted in "oi->hello_interval * 1000000" to type "int" (32 bits, signed), then sign-extended to type "long long" (64 bits, signed). If "oi->hello_interval * 1000000" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1949 if (latency > (oi->hello_interval * 1000000)) 1950 zlog_warn("%s hello TX high latency %" PRId64 1951 "us.", 1952 __func__, latency); 1953 oi->last_hello = timestamp; 1954 oi->hello_out++; ** CID 1505408: (SIGN_EXTENSION) /ospf6d/ospf6_message.c: 447 in ospf6_hello_recv() /ospf6d/ospf6_message.c: 449 in ospf6_hello_recv() ________________________________________________________________________________________________________ *** CID 1505408: (SIGN_EXTENSION) /ospf6d/ospf6_message.c: 447 in ospf6_hello_recv() 441 on->priority = hello->priority; 442 } 443 444 /* check latency against hello period */ 445 if (on->hello_in) 446 latency = monotime_since(&on->last_hello, NULL) >>> CID 1505408: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "oi->hello_interval" with type "uint16_t" (16 bits, unsigned) is promoted in "oi->hello_interval * 1000000" to type "int" (32 bits, signed), then sign-extended to type "long long" (64 bits, signed). If "oi->hello_interval * 1000000" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 447 - (oi->hello_interval * 1000000); 448 /* log if latency exceeds the hello period */ 449 if (latency > (oi->hello_interval * 1000000)) 450 zlog_warn("%s RX %pI4 high latency %" PRId64 "us.", __func__, 451 &on->router_id, latency); 452 on->last_hello = timestamp; /ospf6d/ospf6_message.c: 449 in ospf6_hello_recv() 443 444 /* check latency against hello period */ 445 if (on->hello_in) 446 latency = monotime_since(&on->last_hello, NULL) 447 - (oi->hello_interval * 1000000); 448 /* log if latency exceeds the hello period */ >>> CID 1505408: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "oi->hello_interval" with type "uint16_t" (16 bits, unsigned) is promoted in "oi->hello_interval * 1000000" to type "int" (32 bits, signed), then sign-extended to type "long long" (64 bits, signed). If "oi->hello_interval * 1000000" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 449 if (latency > (oi->hello_interval * 1000000)) 450 zlog_warn("%s RX %pI4 high latency %" PRId64 "us.", __func__, 451 &on->router_id, latency); 452 on->last_hello = timestamp; 453 on->hello_in++; 454 ** CID 1505407: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1505407: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2232 in ospf6_make_lsack_neighbor() 2226 struct ospf6_packet **op) 2227 { 2228 uint16_t length = 0; 2229 struct ospf6_lsa *lsa, *lsanext; 2230 int lsa_cnt = 0; 2231 >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2232 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) { 2233 if ((length + sizeof(struct ospf6_lsa_header) 2234 + OSPF6_HEADER_SIZE) 2235 > ospf6_packet_max(on->ospf6_if)) { 2236 /* if we run out of packet size/space here, 2237 better to try again soon. */ /ospf6d/ospf6_message.c: 2232 in ospf6_make_lsack_neighbor() 2226 struct ospf6_packet **op) 2227 { 2228 uint16_t length = 0; 2229 struct ospf6_lsa *lsa, *lsanext; 2230 int lsa_cnt = 0; 2231 >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 2232 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) { 2233 if ((length + sizeof(struct ospf6_lsa_header) 2234 + OSPF6_HEADER_SIZE) 2235 > ospf6_packet_max(on->ospf6_if)) { 2236 /* if we run out of packet size/space here, 2237 better to try again soon. */ /ospf6d/ospf6_message.c: 2254 in ospf6_make_lsack_neighbor() 2248 ospf6_make_header(OSPF6_MESSAGE_TYPE_LSACK, 2249 on->ospf6_if, (*op)->s); 2250 length = 0; 2251 lsa_cnt = 0; 2252 } 2253 } >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2254 ospf6_lsa_age_update_to_send(lsa, on->ospf6_if->transdelay); 2255 stream_put((*op)->s, lsa->header, 2256 sizeof(struct ospf6_lsa_header)); 2257 length += sizeof(struct ospf6_lsa_header); 2258 2259 assert(lsa->lock == 2); /ospf6d/ospf6_message.c: 2254 in ospf6_make_lsack_neighbor() 2248 ospf6_make_header(OSPF6_MESSAGE_TYPE_LSACK, 2249 on->ospf6_if, (*op)->s); 2250 length = 0; 2251 lsa_cnt = 0; 2252 } 2253 } >>> CID 1505407: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2254 ospf6_lsa_age_update_to_send(lsa, on->ospf6_if->transdelay); 2255 stream_put((*op)->s, lsa->header, 2256 sizeof(struct ospf6_lsa_header)); 2257 length += sizeof(struct ospf6_lsa_header); 2258 2259 assert(lsa->lock == 2); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 10 Jun '21

10 Jun '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1505177: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1505177: Null pointer dereferences (FORWARD_NULL) /ospf6d/ospf6_top.c: 290 in ospf6_top_route_hook_remove() 284 else if (route->table->scope_type == OSPF6_SCOPE_TYPE_AREA) { 285 oa = (struct ospf6_area *)route->table->scope; 286 ospf6 = oa->ospf6; 287 } 288 289 route->flag |= OSPF6_ROUTE_REMOVE; >>> CID 1505177: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "ospf6" to "ospf6_abr_originate_summary", which dereferences it. 290 ospf6_abr_originate_summary(route, ospf6); 291 ospf6_zebra_route_update_remove(route, ospf6); 292 } 293 294 static void ospf6_top_brouter_hook_add(struct ospf6_route *route) 295 { ** CID 1505176: Error handling issues (CHECKED_RETURN) /ospf6d/ospf6_nssa.c: 1096 in ospf6_abr_task_timer() ________________________________________________________________________________________________________ *** CID 1505176: Error handling issues (CHECKED_RETURN) /ospf6d/ospf6_nssa.c: 1096 in ospf6_abr_task_timer() 1090 1091 ospf6->t_abr_task = NULL; 1092 1093 if (IS_OSPF6_DEBUG_ABR) 1094 zlog_debug("Running ABR task on timer"); 1095 >>> CID 1505176: Error handling issues (CHECKED_RETURN) >>> Calling "ospf6_is_router_abr" without checking return value (as is done elsewhere 12 out of 13 times). 1096 ospf6_is_router_abr(ospf6); 1097 ospf6_abr_nssa_check_status(ospf6); 1098 ospf6_abr_task(ospf6); 1099 /* if nssa-abr, then scan Type-7 LSDB */ 1100 ospf6_abr_nssa_task(ospf6); 1101 ospf6_asbr_nssa_redist_task(ospf6); ** CID 1505175: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1505175: Null pointer dereferences (FORWARD_NULL) /ospf6d/ospf6_top.c: 273 in ospf6_top_route_hook_add() 267 ospf6 = route->table->scope; 268 else if (route->table->scope_type == OSPF6_SCOPE_TYPE_AREA) { 269 oa = (struct ospf6_area *)route->table->scope; 270 ospf6 = oa->ospf6; 271 } 272 >>> CID 1505175: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "ospf6" to "ospf6_abr_originate_summary", which dereferences it. 273 ospf6_abr_originate_summary(route, ospf6); 274 ospf6_zebra_route_update_add(route, ospf6); 275 } 276 277 static void ospf6_top_route_hook_remove(struct ospf6_route *route) 278 { ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

FRR Telco meeting
by olivier.dugeon＠orange.com 10 Jun '21

10 Jun '21

Quand : A lieu le mercredi toutes les 4 semaines de 17:00 à 18:00 à partir du 20/01/2021 jusqu'au 29/12/2021. (UTC+01:00) Bruxelles, Copenhague, Madrid, Paris Où : BlueJean https://bluejeans.com/377688464 *~*~*~*~*~*~*~*~*~* Hi all, This is the invite for the regular be-weekly Telco's meeting for 2021. NOTE: THE MEETING ID CHANGE. Please use https://bluejeans.com/377688464 for the next Telco meetings Regards Olivier _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

FRR Telco meeting
by olivier.dugeon＠orange.com 10 Jun '21

10 Jun '21

Quand : A lieu le mercredi toutes les 4 semaines de 17:00 à 18:00 à partir du 06/01/2021 jusqu'au 29/12/2021. (UTC+01:00) Bruxelles, Copenhague, Madrid, Paris Où : BlueJean https://bluejeans.com/377688464 *~*~*~*~*~*~*~*~*~* Hi all, This is the invite for the regular be-weekly Telco's meeting for 2021. NOTE: THE MEETING ID CHANGE. Please use https://bluejeans.com/377688464 for the next Telco meetings Regards Olivier _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 05 Jun '21

05 Jun '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1505132: Error handling issues (CHECKED_RETURN) /pathd/path_pcep_debug.c: 983 in format_yang_dnode() ________________________________________________________________________________________________________ *** CID 1505132: Error handling issues (CHECKED_RETURN) /pathd/path_pcep_debug.c: 983 in format_yang_dnode() 977 978 const char *format_yang_dnode(struct lyd_node *dnode) 979 { 980 char *buff; 981 int len; 982 >>> CID 1505132: Error handling issues (CHECKED_RETURN) >>> Calling "lyd_print_mem" without checking return value (as is done elsewhere 4 out of 5 times). 983 lyd_print_mem(&buff, dnode, LYD_JSON, LYD_PRINT_WD_ALL); 984 len = strlen(buff); 985 memcpy(_debug_buff, buff, len); 986 free(buff); 987 return _debug_buff; 988 } ** CID 1505131: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_mplsvpn.c: 586 in ensure_vrf_tovpn_sid() ________________________________________________________________________________________________________ *** CID 1505131: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_mplsvpn.c: 586 in ensure_vrf_tovpn_sid() 580 return; 581 582 /* 583 * skip when bgp vpn instance ins't allocated 584 * or srv6 locator chunk isn't allocated 585 */ >>> CID 1505131: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "bgp_vrf" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 586 if (!bgp_vpn || !bgp_vpn->srv6_locator_chunks || !bgp_vrf) 587 return; 588 589 tovpn_sid_index = bgp_vrf->vpn_policy[afi].tovpn_sid_index; 590 tovpn_sid_auto = CHECK_FLAG(bgp_vrf->vpn_policy[afi].flags, 591 BGP_VPN_POLICY_TOVPN_SID_AUTO); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Canceled: FRR Telco meeting
by olivier.dugeon＠orange.com 25 May '21

25 May '21

When: Wednesday, May 26, 2021 4:00 PM-5:00 PM. (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna Where: BlueJean https://bluejeans.com/377688464 *~*~*~*~*~*~*~*~*~* Hi all, This is the invite for the regular be-weekly Telco's meeting for 2021. NOTE: THE MEETING ID CHANGE. Please use https://bluejeans.com/377688464 for the next Telco meetings Regards Olivier _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 20 May '21

20 May '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 28 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1504898: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1504898: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_dump.c: 585 in ospf_packet_dump() 579 ospf_packet_hello_dump(s, ntohs(ospfh->length)); 580 break; 581 case OSPF_MSG_DB_DESC: 582 ospf_packet_db_desc_dump(s, ntohs(ospfh->length)); 583 break; 584 case OSPF_MSG_LS_REQ: >>> CID 1504898: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(ospfh->length)" to a tainted sink. 585 ospf_packet_ls_req_dump(s, ntohs(ospfh->length)); 586 break; 587 case OSPF_MSG_LS_UPD: 588 ospf_packet_ls_upd_dump(s, ntohs(ospfh->length)); 589 break; 590 case OSPF_MSG_LS_ACK: ** CID 1504897: Memory - corruptions (OVERRUN) /ospfd/ospf_apiserver.c: 1175 in ospf_apiserver_handle_register_event() ________________________________________________________________________________________________________ *** CID 1504897: Memory - corruptions (OVERRUN) /ospfd/ospf_apiserver.c: 1175 in ospf_apiserver_handle_register_event() 1169 size = ntohs(msg->hdr.msglen); 1170 if (size < OSPF_MAX_LSA_SIZE) { 1171 1172 apiserv->filter = XMALLOC(MTYPE_OSPF_APISERVER_MSGFILTER, size); 1173 1174 /* copy it over. */ >>> CID 1504897: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_filter_type of 4 bytes by passing it to a function which accesses it at byte offset 1498 using argument "size" (which evaluates to 1499). 1175 memcpy(apiserv->filter, &rmsg->filter, size); 1176 rc = OSPF_API_OK; 1177 } else 1178 rc = OSPF_API_NOMEMORY; 1179 1180 /* Send a reply back to client with return code */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 19 May '21

19 May '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1504895: Possible Control flow issues (DEADCODE) /lib/northbound.c: 2434 in nb_init() ________________________________________________________________________________________________________ *** CID 1504895: Possible Control flow issues (DEADCODE) /lib/northbound.c: 2434 in nb_init() 2428 DEBUGD(&nb_dbg_events, "northbound: loading %s.yang", 2429 modules[i]->name); 2430 *loadedp++ = yang_module_load(modules[i]->name); 2431 } 2432 2433 if (explicit_compile) >>> CID 1504895: Possible Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "yang_init_loading_complete();". 2434 yang_init_loading_complete(); 2435 2436 /* Initialize the compiled nodes with northbound data */ 2437 for (size_t i = 0; i < nmodules; i++) { 2438 yang_snodes_iterate(loaded[i]->info, nb_node_new_cb, 0, NULL); 2439 nb_load_callbacks(modules[i]); ** CID 1504894: (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1504894: (NULL_RETURNS) /lib/northbound.c: 610 in nb_config_diff() 604 /* Skip rest of sub-tree, move to next sibling 605 */ 606 LYD_TREE_DFS_continue = 1; 607 break; 608 case 'd': /* delete */ 609 target = yang_dnode_get(config1->dnode, path); >>> CID 1504894: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "target" when calling "nb_config_diff_deleted". 610 nb_config_diff_deleted(target, &seq, changes); 611 612 /* Skip rest of sub-tree, move to next sibling 613 */ 614 LYD_TREE_DFS_continue = 1; 615 break; /lib/northbound.c: 602 in nb_config_diff() 596 * dnode from the diff instead of the 597 * candidate config node we get failures when 598 * looking up default values, etc, based on 599 * the diff tree. 600 */ 601 target = yang_dnode_get(config2->dnode, path); >>> CID 1504894: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "target" when calling "nb_config_diff_created". 602 nb_config_diff_created(target, &seq, changes); 603 604 /* Skip rest of sub-tree, move to next sibling 605 */ 606 LYD_TREE_DFS_continue = 1; 607 break; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0