- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 01 Apr '21

01 Apr '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 5 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 5 of 5 defect(s) ** CID 1503597: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_te.c: 2464 in ospf_te_parse_ri() ________________________________________________________________________________________________________ *** CID 1503597: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_te.c: 2464 in ospf_te_parse_ri() 2458 2459 ote_debug(" |- Process Router Information LSA %pI4 for Vertex %pI4", 2460 &lsa->data->id, &node->router_id); 2461 2462 /* Initialize TLV browsing */ 2463 len = ntohs(lsah->length) - OSPF_LSA_HEADER_SIZE; >>> CID 1503597: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "len" as a loop boundary. 2464 for (tlvh = TLV_HDR_TOP(lsah); sum < len; tlvh = TLV_HDR_NEXT(tlvh)) { 2465 struct ri_sr_tlv_sr_algorithm *algo; 2466 struct ri_sr_tlv_sid_label_range *range; 2467 struct ri_sr_tlv_node_msd *msd; 2468 uint32_t size, lower; 2469 ** CID 1503596: Error handling issues (CHECKED_RETURN) /bgpd/bgp_routemap_nb_config.c: 2580 in lib_route_map_entry_set_action_rmap_set_action_extcommunity_lb_finish() ________________________________________________________________________________________________________ *** CID 1503596: Error handling issues (CHECKED_RETURN) /bgpd/bgp_routemap_nb_config.c: 2580 in lib_route_map_entry_set_action_rmap_set_action_extcommunity_lb_finish() 2574 snprintf(str, sizeof(str), "%s", "num-multipaths"); 2575 } 2576 2577 if (yang_dnode_get_bool(args->dnode, "./two-octet-as-specific")) 2578 strlcat(str, " non-transitive", sizeof(str)); 2579 >>> CID 1503596: Error handling issues (CHECKED_RETURN) >>> Calling "generic_set_add" without checking return value (as is done elsewhere 27 out of 29 times). 2580 generic_set_add(rhc->rhc_rmi, 2581 "extcommunity bandwidth", str, 2582 args->errmsg, args->errmsg_len); 2583 } 2584 2585 /* ** CID 1503595: Error handling issues (CHECKED_RETURN) /bgpd/bgp_routemap_nb_config.c: 2401 in lib_route_map_entry_set_action_rmap_set_action_aggregator_finish() ________________________________________________________________________________________________________ *** CID 1503595: Error handling issues (CHECKED_RETURN) /bgpd/bgp_routemap_nb_config.c: 2401 in lib_route_map_entry_set_action_rmap_set_action_aggregator_finish() 2395 2396 /* Set destroy information. */ 2397 rhc->rhc_shook = generic_set_delete; 2398 rhc->rhc_rule = "aggregator as"; 2399 rhc->rhc_event = RMAP_EVENT_SET_DELETED; 2400 >>> CID 1503595: Error handling issues (CHECKED_RETURN) >>> Calling "generic_set_add" without checking return value (as is done elsewhere 27 out of 29 times). 2401 generic_set_add(rhc->rhc_rmi, rhc->rhc_rule, argstr, 2402 args->errmsg, args->errmsg_len); 2403 XFREE(MTYPE_ROUTE_MAP_COMPILED, argstr); 2404 } 2405 /* 2406 * XPath: ** CID 1503594: Error handling issues (CHECKED_RETURN) /bgpd/bgp_routemap_nb_config.c: 1017 in lib_route_map_entry_match_condition_rmap_match_condition_comm_list_finish() ________________________________________________________________________________________________________ *** CID 1503594: Error handling issues (CHECKED_RETURN) /bgpd/bgp_routemap_nb_config.c: 1017 in lib_route_map_entry_match_condition_rmap_match_condition_comm_list_finish() 1011 } else { 1012 rhc->rhc_rule = "extcommunity"; 1013 event = RMAP_EVENT_ECLIST_ADDED; 1014 rhc->rhc_event = RMAP_EVENT_ECLIST_DELETED; 1015 } 1016 >>> CID 1503594: Error handling issues (CHECKED_RETURN) >>> Calling "bgp_route_match_add" without checking return value (as is done elsewhere 20 out of 21 times). 1017 bgp_route_match_add(rhc->rhc_rmi, rhc->rhc_rule, argstr, event, 1018 args->errmsg, args->errmsg_len); 1019 1020 if (argstr != value) 1021 XFREE(MTYPE_ROUTE_MAP_COMPILED, argstr); 1022 } ** CID 1496618: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496618: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_evpn_mh.c: 949 in bgp_evpn_type1_route_update() 943 attr_new = pi->attr; 944 945 /* Perform route selection; 946 * this is just to set the flags correctly as local route in 947 * the ES always wins. 948 */ >>> CID 1496618: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "vpn" to "evpn_route_select_install", which dereferences it. 949 evpn_route_select_install(bgp, vpn, dest); 950 bgp_dest_unlock_node(dest); 951 952 /* If this is a new route or some attribute has changed, export the 953 * route to the global table. The route will be advertised to peers 954 * from there. Note that this table is a 2-level tree (RD-level + ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Annulé : FRR Telco meeting
by olivier.dugeon＠orange.com 31 Mar '21

31 Mar '21

Quand : mercredi 31 mars 2021 16:00-17:00. (UTC+01:00) Bruxelles, Copenhague, Madrid, Paris Où : BlueJean https://bluejeans.com/377688464 *~*~*~*~*~*~*~*~*~* Hi all, I cancel the meeting for today as there is no particular information to share. Regards Olivier _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

Canceled: Northbound weekly meeting
by Santosh P K 30 Mar '21

30 Mar '21

Hello All, As discussed over last meeting updated time and also location. Thanks Santosh P K

1 0

Northbound weekly meeting
by Santosh P K 30 Mar '21

30 Mar '21

Adjusting day light saving. Thanks Santosh P K

1 0

Question on PBR daemon
by Atul Chowdhry 26 Mar '21

26 Mar '21

Hi Guys, I was looking at PBR daemon code and looks like in current code, the whole pbr-policy (struct pbr_map) is considered to invalid if any one of the contained rules (struct pbr_map_sequence) inside the policy becomes invalid. I cannot figure the reason for this design choice. To me it looks like policy rules are pretty much independent and policy is just a container for these rules. What am I missing? I will really appreciate it if anyone can reply to my query. Thanks a lot in advance. Rgds Atul

2 2

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 25 Mar '21

25 Mar '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 37 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1502949: Possible Control flow issues (DEADCODE) /ospfd/ospf_vty.c: 7390 in show_ip_ospf_database_type_adv_router() ________________________________________________________________________________________________________ *** CID 1502949: Possible Control flow issues (DEADCODE) /ospfd/ospf_vty.c: 7390 in show_ip_ospf_database_type_adv_router() 7384 ospf = ospf_lookup_by_vrf_id(VRF_DEFAULT); 7385 if (ospf == NULL || !ospf->oi_running) { 7386 vty_out(vty, "%% OSPF instance not found\n"); 7387 return CMD_SUCCESS; 7388 } 7389 >>> CID 1502949: Possible Control flow issues (DEADCODE) >>> Execution cannot reach the expression "1" inside this statement: "ret = show_ip_ospf_database...". 7390 ret = show_ip_ospf_database_type_adv_router_common( 7391 vty, ospf, idx ? 1 : 0, argc, argv, use_vrf, json, uj); 7392 } 7393 7394 if (uj) { 7395 vty_out(vty, "%s\n", json_object_to_json_string(json)); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Northbound weekly meeting
by Santosh P K 22 Mar '21

22 Mar '21

Hello All, As discussed over last meeting updated time and also location. Thanks Santosh P K

1 0

Northbound weekly meeting
by Santosh P K 22 Mar '21

22 Mar '21

Hello All, As discussed over last meeting updated time and also location. Thanks Santosh P K

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 16 Mar '21

16 Mar '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 39 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 39 defect(s) ** CID 1502815: Integer handling issues (NEGATIVE_RETURNS) ________________________________________________________________________________________________________ *** CID 1502815: Integer handling issues (NEGATIVE_RETURNS) /pceplib/test/pcep_msg_tools_test.c: 516 in test_pcep_msg_read_pcep_open_cisco_pce() 510 511 void test_pcep_msg_read_pcep_open_cisco_pce() 512 { 513 int fd = convert_hexstrs_to_binary( 514 pcep_open_cisco_pce_hexbyte_strs, 515 pcep_open_cisco_pce_hexbyte_strs_length); >>> CID 1502815: Integer handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. 516 double_linked_list *msg_list = pcep_msg_read(fd); 517 CU_ASSERT_PTR_NOT_NULL(msg_list); 518 CU_ASSERT_EQUAL(msg_list->num_entries, 1); 519 520 struct pcep_message *msg = (struct pcep_message *)msg_list->head->data; 521 CU_ASSERT_EQUAL(msg->msg_header->type, PCEP_TYPE_OPEN); ** CID 1502814: (SIZEOF_MISMATCH) /pceplib/pcep_msg_objects_encoding.c: 1692 in pcep_decode_obj_ro() /pceplib/pcep_msg_objects_encoding.c: 1671 in pcep_decode_obj_ro() /pceplib/pcep_msg_objects_encoding.c: 1687 in pcep_decode_obj_ro() /pceplib/pcep_msg_objects_encoding.c: 1697 in pcep_decode_obj_ro() ________________________________________________________________________________________________________ *** CID 1502814: (SIZEOF_MISMATCH) /pceplib/pcep_msg_objects_encoding.c: 1692 in pcep_decode_obj_ro() 1686 sizeof(struct in_addr)); 1687 ipv4->s_addr = uint32_ptr[LENGTH_4WORDS]; 1688 dll_append(sr_subobj->nai_list, ipv4); 1689 1690 ipv6 = pceplib_malloc(PCEPLIB_MESSAGES, 1691 sizeof(struct in6_addr)); >>> CID 1502814: (SIZEOF_MISMATCH) >>> Adding "20UL /* sizeof (uint32_t) * 5 */" to pointer "uint32_ptr" of type "uint32_t *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 4 bytes, of the pointed-to type, "uint32_t". Most likely, the multiplication by "sizeof (uint32_t)" in this expression is extraneous and should be eliminated. 1692 decode_ipv6(uint32_ptr + LENGTH_5WORDS, ipv6); 1693 dll_append(sr_subobj->nai_list, ipv6); 1694 1695 ipv4 = pceplib_malloc(PCEPLIB_MESSAGES, 1696 sizeof(struct in_addr)); 1697 ipv4->s_addr = uint32_ptr[LENGTH_9WORDS]; /pceplib/pcep_msg_objects_encoding.c: 1671 in pcep_decode_obj_ro() 1665 sizeof(struct in6_addr)); 1666 decode_ipv6(uint32_ptr, ipv6); 1667 dll_append(sr_subobj->nai_list, ipv6); 1668 1669 ipv6 = pceplib_malloc(PCEPLIB_MESSAGES, 1670 sizeof(struct in6_addr)); >>> CID 1502814: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (uint32_t) * 4 */" to pointer "uint32_ptr" of type "uint32_t *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 4 bytes, of the pointed-to type, "uint32_t". Most likely, the multiplication by "sizeof (uint32_t)" in this expression is extraneous and should be eliminated. 1671 decode_ipv6(uint32_ptr + LENGTH_4WORDS, ipv6); 1672 dll_append(sr_subobj->nai_list, ipv6); 1673 1674 read_count += LENGTH_8WORDS; 1675 } break; 1676 /pceplib/pcep_msg_objects_encoding.c: 1687 in pcep_decode_obj_ro() 1681 decode_ipv6(uint32_ptr, ipv6); 1682 dll_append(sr_subobj->nai_list, ipv6); 1683 1684 struct in_addr *ipv4 = 1685 pceplib_malloc(PCEPLIB_MESSAGES, 1686 sizeof(struct in_addr)); >>> CID 1502814: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (uint32_t) * 4 */" to pointer "uint32_ptr" of type "uint32_t *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 4 bytes, of the pointed-to type, "uint32_t". Most likely, the multiplication by "sizeof (uint32_t)" in this expression is extraneous and should be eliminated. 1687 ipv4->s_addr = uint32_ptr[LENGTH_4WORDS]; 1688 dll_append(sr_subobj->nai_list, ipv4); 1689 1690 ipv6 = pceplib_malloc(PCEPLIB_MESSAGES, 1691 sizeof(struct in6_addr)); 1692 decode_ipv6(uint32_ptr + LENGTH_5WORDS, ipv6); /pceplib/pcep_msg_objects_encoding.c: 1697 in pcep_decode_obj_ro() 1691 sizeof(struct in6_addr)); 1692 decode_ipv6(uint32_ptr + LENGTH_5WORDS, ipv6); 1693 dll_append(sr_subobj->nai_list, ipv6); 1694 1695 ipv4 = pceplib_malloc(PCEPLIB_MESSAGES, 1696 sizeof(struct in_addr)); >>> CID 1502814: (SIZEOF_MISMATCH) >>> Adding "36UL /* sizeof (uint32_t) * 9 */" to pointer "uint32_ptr" of type "uint32_t *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 4 bytes, of the pointed-to type, "uint32_t". Most likely, the multiplication by "sizeof (uint32_t)" in this expression is extraneous and should be eliminated. 1697 ipv4->s_addr = uint32_ptr[LENGTH_9WORDS]; 1698 dll_append(sr_subobj->nai_list, ipv4); 1699 1700 read_count += LENGTH_10WORDS; 1701 } break; 1702 ** CID 1502813: Memory - corruptions (OVERRUN) /pceplib/pcep_msg_tools.c: 143 in pcep_msg_read() ________________________________________________________________________________________________________ *** CID 1502813: Memory - corruptions (OVERRUN) /pceplib/pcep_msg_tools.c: 143 in pcep_msg_read() 137 int read_ret = 0; 138 pcep_log( 139 LOG_INFO, 140 "%s: pcep_msg_read: Message not fully read! Trying to read %d bytes more, fd [%d]", 141 __func__, read_len, sock_fd); 142 >>> CID 1502813: Memory - corruptions (OVERRUN) >>> Overrunning buffer pointed to by "&buffer[ret]" of 6000 bytes by passing it to a function which accesses it at byte offset 6000. 143 read_ret = read(sock_fd, &buffer[ret], read_len); 144 145 if (read_ret != read_len) { 146 pcep_log( 147 LOG_INFO, 148 "%s: pcep_msg_read: Did not manage to read enough data (%d != %d) fd [%d]", ** CID 1502812: API usage errors (SWAPPED_ARGUMENTS) ________________________________________________________________________________________________________ *** CID 1502812: API usage errors (SWAPPED_ARGUMENTS) /pceplib/pcep_session_logic.c: 576 in create_pcep_open() 570 || session->pcc_config.support_lsp_triggered_resync 571 || session->pcc_config.support_lsp_delta_sync 572 || session->pcc_config.support_pce_triggered_initial_sync) { 573 /* Prepend this TLV as the first in the list */ 574 dll_append( 575 tlv_list, >>> CID 1502812: API usage errors (SWAPPED_ARGUMENTS) >>> The positions of arguments in the call to "pcep_tlv_create_stateful_pce_capability" do not match the ordering of the parameters: * "session->pcc_config.support_lsp_triggered_resync" is passed to "flag_i_lsp_instantiation_capability" * "session->pcc_config.support_lsp_delta_sync" is passed to "flag_t_triggered_resync" * "session->pcc_config.support_pce_triggered_initial_sync" is passed to "flag_d_delta_lsp_sync" * "session->pcc_config.support_pce_lsp_instantiation" is passed to "flag_f_triggered_initial_sync" 576 pcep_tlv_create_stateful_pce_capability( 577 session->pcc_config 578 .support_stateful_pce_lsp_update, /* U 579 flag 580 */ 581 session->pcc_config ** CID 1502811: Integer handling issues (NEGATIVE_RETURNS) ________________________________________________________________________________________________________ *** CID 1502811: Integer handling issues (NEGATIVE_RETURNS) /pceplib/test/pcep_msg_tools_test.c: 491 in test_pcep_msg_read_pcep_open_initiate() 485 486 void test_pcep_msg_read_pcep_open_initiate() 487 { 488 int fd = convert_hexstrs_to_binary( 489 pcep_open_initiate_odl_hexbyte_strs, 490 pcep_open_initiate_hexbyte_strs_length); >>> CID 1502811: Integer handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. 491 double_linked_list *msg_list = pcep_msg_read(fd); 492 CU_ASSERT_PTR_NOT_NULL(msg_list); 493 CU_ASSERT_EQUAL(msg_list->num_entries, 2); 494 495 struct pcep_message *msg = (struct pcep_message *)msg_list->head->data; 496 CU_ASSERT_EQUAL(msg->obj_list->num_entries, 1); ** CID 1502810: Security best practices violations (SECURE_TEMP) /pceplib/test/pcep_msg_tools_test.c: 167 in convert_hexstrs_to_binary() ________________________________________________________________________________________________________ *** CID 1502810: Security best practices violations (SECURE_TEMP) /pceplib/test/pcep_msg_tools_test.c: 167 in convert_hexstrs_to_binary() 161 162 /* Reads an array of hexbyte strs, and writes them to a temporary file. 163 * The caller should close the returned file. */ 164 int convert_hexstrs_to_binary(const char *hexbyte_strs[], 165 uint16_t hexbyte_strs_length) 166 { >>> CID 1502810: Security best practices violations (SECURE_TEMP) >>> "tmpfile" creates files with predictable names, which is unsafe. 167 int fd = fileno(tmpfile()); 168 169 int i = 0; 170 for (; i < hexbyte_strs_length; i++) { 171 uint8_t byte = (uint8_t)strtol(hexbyte_strs[i], 0, 16); 172 if (write(fd, (char *)&byte, 1) < 0) { ** CID 1502809: Memory - corruptions (OVERRUN) /pathd/path_pcep_cli.c: 1047 in path_pcep_cli_pcc_pcc_peer() ________________________________________________________________________________________________________ *** CID 1502809: Memory - corruptions (OVERRUN) /pathd/path_pcep_cli.c: 1047 in path_pcep_cli_pcc_pcc_peer() 1041 return CMD_WARNING; 1042 } 1043 1044 /* Update the pcc_opts with the source ip, port, and msd */ 1045 struct pcc_opts *pcc_opts_copy = 1046 XMALLOC(MTYPE_PCEP, sizeof(struct pcc_opts)); >>> CID 1502809: Memory - corruptions (OVERRUN) >>> Overrunning struct type ipaddr of 20 bytes by passing it to a function which accesses it at byte offset 23 using argument "24UL". 1047 memcpy(&pcc_opts_copy->addr, 1048 &pce_opts_cli->pce_opts.config_opts.source_ip, 1049 sizeof(struct pcc_opts)); 1050 pcc_opts_copy->msd = pcc_msd_g; 1051 pcc_opts_copy->port = pce_opts_cli->pce_opts.config_opts.source_port; 1052 if (pcep_ctrl_update_pcc_options(pcep_g->fpt, pcc_opts_copy)) { ** CID 1502808: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_session_logic.c: 64 in run_session_logic_common() ________________________________________________________________________________________________________ *** CID 1502808: Concurrent data access violations (MISSING_LOCK) /pceplib/pcep_session_logic.c: 64 in run_session_logic_common() 58 59 session_logic_handle_ = pceplib_malloc( 60 PCEPLIB_INFRA, sizeof(pcep_session_logic_handle)); 61 memset(session_logic_handle_, 0, sizeof(pcep_session_logic_handle)); 62 63 session_logic_handle_->active = true; >>> CID 1502808: Concurrent data access violations (MISSING_LOCK) >>> Accessing "session_logic_handle_->session_logic_condition" without holding lock "pcep_session_logic_handle_.session_logic_mutex". Elsewhere, "pcep_session_logic_handle_.session_logic_condition" is accessed with "pcep_session_logic_handle_.session_logic_mutex" held 5 out of 7 times (3 of these accesses strongly imply that it is necessary). 64 session_logic_handle_->session_logic_condition = false; 65 session_logic_handle_->session_list = 66 ordered_list_initialize(pointer_compare_function); 67 session_logic_handle_->session_event_queue = queue_initialize(); 68 69 /* Initialize the event queue */ ** CID 1502807: Memory - illegal accesses (OVERRUN) ________________________________________________________________________________________________________ *** CID 1502807: Memory - illegal accesses (OVERRUN) /pceplib/pcep_msg_messages_encoding.c: 129 in pcep_encode_message() 123 return; 124 } 125 126 /* Encode each of the objects */ 127 double_linked_list_node *node = message->obj_list->head; 128 for (; node != NULL; node = node->next_node) { >>> CID 1502807: Memory - illegal accesses (OVERRUN) >>> Overrunning array of 65535 bytes at byte offset 65535 by dereferencing pointer "message_buffer + message_length". 129 message_length += 130 pcep_encode_object(node->data, versioning, 131 message_buffer + message_length); 132 if (message_length > PCEP_MESSAGE_LENGTH) { 133 message->encoded_message = NULL; 134 message->encoded_message_length = 0; ** CID 1502806: (TAINTED_SCALAR) /pceplib/pcep_msg_tools.c: 143 in pcep_msg_read() ________________________________________________________________________________________________________ *** CID 1502806: (TAINTED_SCALAR) /pceplib/pcep_msg_tools.c: 143 in pcep_msg_read() 137 int read_ret = 0; 138 pcep_log( 139 LOG_INFO, 140 "%s: pcep_msg_read: Message not fully read! Trying to read %d bytes more, fd [%d]", 141 __func__, read_len, sock_fd); 142 >>> CID 1502806: (TAINTED_SCALAR) >>> Passing tainted variable "read_len" to a tainted sink. 143 read_ret = read(sock_fd, &buffer[ret], read_len); 144 145 if (read_ret != read_len) { 146 pcep_log( 147 LOG_INFO, 148 "%s: pcep_msg_read: Did not manage to read enough data (%d != %d) fd [%d]", /pceplib/pcep_msg_tools.c: 154 in pcep_msg_read() 148 "%s: pcep_msg_read: Did not manage to read enough data (%d != %d) fd [%d]", 149 __func__, read_ret, read_len, sock_fd); 150 return msg_list; 151 } 152 } 153 >>> CID 1502806: (TAINTED_SCALAR) >>> Passing tainted variable "buffer + buffer_read" to a tainted sink. 154 msg = pcep_decode_message(buffer + buffer_read); 155 buffer_read += msg_hdr_length; 156 157 if (msg == NULL) { 158 return msg_list; 159 } else { ** CID 1502805: Resource leaks (RESOURCE_LEAK) /pceplib/pcep_pcc.c: 316 in send_pce_report_message() ________________________________________________________________________________________________________ *** CID 1502805: Resource leaks (RESOURCE_LEAK) /pceplib/pcep_pcc.c: 316 in send_pce_report_message() 310 plsp_id, lsp_status, c_flag, a_flag, r_flag, s_flag, d_flag, 311 lsp_tlv_list); 312 if (obj == NULL) { 313 pcep_log(LOG_WARNING, 314 "%s: send_pce_report_message LSP object was NULL", 315 __func__); >>> CID 1502805: Resource leaks (RESOURCE_LEAK) >>> Variable "report_list" going out of scope leaks the storage it points to. 316 return; 317 } 318 dll_append(report_list, obj); 319 320 /* Create 2 ERO NONAI sub-objects */ 321 double_linked_list *ero_subobj_list = dll_initialize(); ** CID 1502804: Concurrent data access violations (MISSING_LOCK) /pceplib/test/pcep_timers_event_loop_test.c: 133 in test_walk_and_process_timers_timer_expired() ________________________________________________________________________________________________________ *** CID 1502804: Concurrent data access violations (MISSING_LOCK) /pceplib/test/pcep_timers_event_loop_test.c: 133 in test_walk_and_process_timers_timer_expired() 127 /* We need to alloc it, since it will be free'd in 128 * walk_and_process_timers */ 129 pcep_timer *timer = pceplib_malloc(PCEPLIB_INFRA, sizeof(pcep_timer)); 130 timer->data = timer; 131 // Set the timer to expire 10 seconds ago 132 timer->expire_time = time(NULL) - 10; >>> CID 1502804: Concurrent data access violations (MISSING_LOCK) >>> Accessing "timer->timer_id" without holding lock "pcep_timers_context_.timer_list_lock". Elsewhere, "pcep_timer_.timer_id" is accessed with "pcep_timers_context_.timer_list_lock" held 3 out of 4 times (3 of these accesses strongly imply that it is necessary). 133 timer->timer_id = TEST_EVENT_LOOP_TIMER_ID; 134 ordered_list_add_node(test_timers_context->timer_list, timer); 135 136 walk_and_process_timers(test_timers_context); 137 138 /* Since the timer expired, the expire_handler should have been called ** CID 1502803: (RESOURCE_LEAK) /pceplib/test/pcep_msg_tlvs_test.c: 196 in test_pcep_tlv_create_path_setup_type_capability() /pceplib/test/pcep_msg_tlvs_test.c: 178 in test_pcep_tlv_create_path_setup_type_capability() ________________________________________________________________________________________________________ *** CID 1502803: (RESOURCE_LEAK) /pceplib/test/pcep_msg_tlvs_test.c: 196 in test_pcep_tlv_create_path_setup_type_capability() 190 *pst1 = 1; 191 *pst2 = 2; 192 *pst3 = 3; 193 dll_append(pst_list, pst1); 194 dll_append(pst_list, pst2); 195 dll_append(pst_list, pst3); >>> CID 1502803: (RESOURCE_LEAK) >>> Overwriting "tlv" in "tlv = pcep_tlv_create_path_setup_type_capability(pst_list, sub_tlv_list)" leaks the storage that "tlv" points to. 196 tlv = pcep_tlv_create_path_setup_type_capability(pst_list, 197 sub_tlv_list); 198 CU_ASSERT_PTR_NOT_NULL(tlv); 199 200 pcep_encode_tlv(&tlv->header, versioning, tlv_buf); 201 CU_ASSERT_EQUAL(tlv->header.type, /pceplib/test/pcep_msg_tlvs_test.c: 178 in test_pcep_tlv_create_path_setup_type_capability() 172 double_linked_list *pst_list = dll_initialize(); 173 tlv = pcep_tlv_create_path_setup_type_capability(pst_list, NULL); 174 CU_ASSERT_PTR_NULL(tlv); 175 176 /* Should still return NULL if pst_list is NULL */ 177 double_linked_list *sub_tlv_list = dll_initialize(); >>> CID 1502803: (RESOURCE_LEAK) >>> Overwriting "tlv" in "tlv = pcep_tlv_create_path_setup_type_capability(NULL, sub_tlv_list)" leaks the storage that "tlv" points to. 178 tlv = pcep_tlv_create_path_setup_type_capability(NULL, sub_tlv_list); 179 CU_ASSERT_PTR_NULL(tlv); 180 181 /* Should still return NULL if pst_list is empty */ 182 tlv = pcep_tlv_create_path_setup_type_capability(pst_list, 183 sub_tlv_list); ** CID 1502802: Resource leaks (RESOURCE_LEAK) /pceplib/test/pcep_session_logic_loop_test.c: 131 in test_session_logic_msg_ready_handler() ________________________________________________________________________________________________________ *** CID 1502802: Resource leaks (RESOURCE_LEAK) /pceplib/test/pcep_session_logic_loop_test.c: 131 in test_session_logic_msg_ready_handler() 125 { 126 /* Just testing that it does not core dump */ 127 CU_ASSERT_EQUAL(session_logic_msg_ready_handler(NULL, 0), -1); 128 129 /* Read from an empty file should return 0, thus 130 * session_logic_msg_ready_handler returns -1 */ >>> CID 1502802: Resource leaks (RESOURCE_LEAK) >>> Failing to save or free storage allocated by "tmpfile()" leaks it. 131 int fd = fileno(tmpfile()); 132 pcep_session session; 133 memset(&session, 0, sizeof(pcep_session)); 134 session.session_id = 100; 135 CU_ASSERT_EQUAL(session_logic_msg_ready_handler(&session, fd), 0); 136 CU_ASSERT_EQUAL(session_logic_handle_->session_event_queue->num_entries, ** CID 1502801: Resource leaks (RESOURCE_LEAK) /pceplib/test/pcep_msg_tlvs_test.c: 114 in test_pcep_tlv_create_speaker_entity_id() ________________________________________________________________________________________________________ *** CID 1502801: Resource leaks (RESOURCE_LEAK) /pceplib/test/pcep_msg_tlvs_test.c: 114 in test_pcep_tlv_create_speaker_entity_id() 108 CU_ASSERT_PTR_NULL(tlv); 109 110 uint32_t *speaker_entity = 111 pceplib_malloc(PCEPLIB_MESSAGES, sizeof(uint32_t)); 112 *speaker_entity = 42; 113 dll_append(list, speaker_entity); >>> CID 1502801: Resource leaks (RESOURCE_LEAK) >>> Overwriting "tlv" in "tlv = pcep_tlv_create_speaker_entity_id(list)" leaks the storage that "tlv" points to. 114 tlv = pcep_tlv_create_speaker_entity_id(list); 115 CU_ASSERT_PTR_NOT_NULL(tlv); 116 117 pcep_encode_tlv(&tlv->header, versioning, tlv_buf); 118 CU_ASSERT_EQUAL(tlv->header.type, PCEP_OBJ_TLV_TYPE_SPEAKER_ENTITY_ID); 119 CU_ASSERT_EQUAL(tlv->header.encoded_tlv_length, sizeof(uint32_t)); ** CID 1502800: (BAD_SHIFT) /pceplib/pcep_socket_comm_loop.c: 157 in build_fd_sets() /pceplib/pcep_socket_comm_loop.c: 155 in build_fd_sets() /pceplib/pcep_socket_comm_loop.c: 137 in build_fd_sets() /pceplib/pcep_socket_comm_loop.c: 139 in build_fd_sets() ________________________________________________________________________________________________________ *** CID 1502800: (BAD_SHIFT) /pceplib/pcep_socket_comm_loop.c: 157 in build_fd_sets() 151 152 /*pcep_log(LOG_DEBUG, "%s: [%ld] socket_comm::build_fdSets set 153 ready_toWrite [%d]", __func__, time(NULL), 154 comm_session->socket_fd);*/ 155 FD_SET(comm_session->socket_fd, 156 &socket_comm_handle->write_master_set); >>> CID 1502800: (BAD_SHIFT) >>> In expression "1UL << comm_session->socket_fd % 64", shifting by a negative amount has undefined behavior. The shift amount, "comm_session->socket_fd % 64", is as little as -63. 157 FD_SET(comm_session->socket_fd, 158 &socket_comm_handle->except_master_set); 159 node = node->next_node; 160 } 161 162 pthread_mutex_unlock(&(socket_comm_handle->socket_comm_mutex)); /pceplib/pcep_socket_comm_loop.c: 155 in build_fd_sets() 149 max_fd = comm_session->socket_fd; 150 } 151 152 /*pcep_log(LOG_DEBUG, "%s: [%ld] socket_comm::build_fdSets set 153 ready_toWrite [%d]", __func__, time(NULL), 154 comm_session->socket_fd);*/ >>> CID 1502800: (BAD_SHIFT) >>> In expression "1UL << comm_session->socket_fd % 64", shifting by a negative amount has undefined behavior. The shift amount, "comm_session->socket_fd % 64", is as little as -63. 155 FD_SET(comm_session->socket_fd, 156 &socket_comm_handle->write_master_set); 157 FD_SET(comm_session->socket_fd, 158 &socket_comm_handle->except_master_set); 159 node = node->next_node; 160 } /pceplib/pcep_socket_comm_loop.c: 137 in build_fd_sets() 131 max_fd = comm_session->socket_fd; 132 } 133 134 /*pcep_log(LOG_DEBUG, ld] socket_comm::build_fdSets set 135 ready_toRead 136 [%d]", __func__, time(NULL), comm_session->socket_fd);*/ >>> CID 1502800: (BAD_SHIFT) >>> In expression "1UL << comm_session->socket_fd % 64", shifting by a negative amount has undefined behavior. The shift amount, "comm_session->socket_fd % 64", is as little as -63. 137 FD_SET(comm_session->socket_fd, 138 &socket_comm_handle->read_master_set); 139 FD_SET(comm_session->socket_fd, 140 &socket_comm_handle->except_master_set); 141 node = node->next_node; 142 } /pceplib/pcep_socket_comm_loop.c: 139 in build_fd_sets() 133 134 /*pcep_log(LOG_DEBUG, ld] socket_comm::build_fdSets set 135 ready_toRead 136 [%d]", __func__, time(NULL), comm_session->socket_fd);*/ 137 FD_SET(comm_session->socket_fd, 138 &socket_comm_handle->read_master_set); >>> CID 1502800: (BAD_SHIFT) >>> In expression "1UL << comm_session->socket_fd % 64", shifting by a negative amount has undefined behavior. The shift amount, "comm_session->socket_fd % 64", is as little as -63. 139 FD_SET(comm_session->socket_fd, 140 &socket_comm_handle->except_master_set); 141 node = node->next_node; 142 } 143 144 FD_ZERO(&socket_comm_handle->write_master_set); ** CID 1502799: Integer handling issues (NEGATIVE_RETURNS) ________________________________________________________________________________________________________ *** CID 1502799: Integer handling issues (NEGATIVE_RETURNS) /pceplib/test/pcep_msg_tools_test.c: 711 in test_pcep_msg_read_pcep_report_cisco_pcc() 705 706 void test_pcep_msg_read_pcep_report_cisco_pcc() 707 { 708 int fd = convert_hexstrs_to_binary( 709 pcep_report_cisco_pcc_hexbyte_strs, 710 pcep_report_cisco_pcc_hexbyte_strs_length); >>> CID 1502799: Integer handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. 711 double_linked_list *msg_list = pcep_msg_read(fd); 712 CU_ASSERT_PTR_NOT_NULL(msg_list); 713 CU_ASSERT_EQUAL(msg_list->num_entries, 1); 714 715 struct pcep_message *msg = (struct pcep_message *)msg_list->head->data; 716 CU_ASSERT_EQUAL(msg->msg_header->type, PCEP_TYPE_REPORT); ** CID 1502798: Integer handling issues (NEGATIVE_RETURNS) ________________________________________________________________________________________________________ *** CID 1502798: Integer handling issues (NEGATIVE_RETURNS) /pceplib/test/pcep_msg_tools_test.c: 413 in test_pcep_msg_read_pcep_update() 407 } 408 409 void test_pcep_msg_read_pcep_update() 410 { 411 int fd = convert_hexstrs_to_binary(pcep_update_hexbyte_strs, 412 pcep_update_hexbyte_strs_length); >>> CID 1502798: Integer handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. 413 double_linked_list *msg_list = pcep_msg_read(fd); 414 CU_ASSERT_PTR_NOT_NULL(msg_list); 415 CU_ASSERT_EQUAL(msg_list->num_entries, 1); 416 417 struct pcep_message *msg = (struct pcep_message *)msg_list->head->data; 418 CU_ASSERT_EQUAL(msg->obj_list->num_entries, 3); ** CID 1502797: Integer handling issues (NEGATIVE_RETURNS) ________________________________________________________________________________________________________ *** CID 1502797: Integer handling issues (NEGATIVE_RETURNS) /pceplib/test/pcep_msg_tools_test.c: 290 in test_pcep_msg_read_pcep_initiate2() 284 285 286 void test_pcep_msg_read_pcep_initiate2() 287 { 288 int fd = convert_hexstrs_to_binary(pcep_initiate2_hexbyte_strs, 289 pcep_initiate2_hexbyte_strs_length); >>> CID 1502797: Integer handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. 290 double_linked_list *msg_list = pcep_msg_read(fd); 291 CU_ASSERT_PTR_NOT_NULL(msg_list); 292 CU_ASSERT_EQUAL(msg_list->num_entries, 1); 293 294 struct pcep_message *msg = (struct pcep_message *)msg_list->head->data; 295 CU_ASSERT_EQUAL(msg->obj_list->num_entries, 4); ** CID 1502796: Resource leaks (RESOURCE_LEAK) /pceplib/test/pcep_msg_messages_test.c: 393 in test_pcep_msg_create_update() ________________________________________________________________________________________________________ *** CID 1502796: Resource leaks (RESOURCE_LEAK) /pceplib/test/pcep_msg_messages_test.c: 393 in test_pcep_msg_create_update() 387 dll_append(obj_list, srp); 388 dll_append(obj_list, lsp); 389 message = pcep_msg_create_update(obj_list); 390 CU_ASSERT_PTR_NULL(message); 391 392 dll_append(obj_list, ero); >>> CID 1502796: Resource leaks (RESOURCE_LEAK) >>> Overwriting "message" in "message = pcep_msg_create_update(obj_list)" leaks the storage that "message" points to. 393 message = pcep_msg_create_update(obj_list); 394 CU_ASSERT_PTR_NOT_NULL(message); 395 pcep_encode_message(message, versioning); 396 CU_ASSERT_PTR_NOT_NULL(message->msg_header); 397 CU_ASSERT_PTR_NOT_NULL(message->obj_list); 398 CU_ASSERT_EQUAL(message->obj_list->num_entries, 3); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 16 Mar '21

16 Mar '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 72 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 72 defect(s) ** CID 1502776: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1502776: Memory - corruptions (OVERRUN) /isisd/isis_snmp.c: 3359 in isis_snmp_lsp_error_update() 3353 * This is a special case because 3354 * it have more variables 3355 */ 3356 netsnmp_variable_list *notification_vars; 3357 long val; 3358 >>> CID 1502776: Memory - corruptions (OVERRUN) >>> Overrunning callee's array of size 18 by passing argument "18UL" in call to "isis_snmp_trap_throttle". 3359 if (!isis_snmp_trap_throttle(ISIS_TRAP_LSP_ERROR)) 3360 return 0; 3361 3362 notification_vars = NULL; 3363 3364 /* Put in trap value */ ** CID 1502775: Null pointer dereferences (FORWARD_NULL) /isisd/isis_snmp.c: 1022 in isis_snmp_circuit_level_lookup_next() ________________________________________________________________________________________________________ *** CID 1502775: Null pointer dereferences (FORWARD_NULL) /isisd/isis_snmp.c: 1022 in isis_snmp_circuit_level_lookup_next() 1016 if (isis == NULL) 1017 return 0; 1018 1019 start = 0; 1020 1021 if (oid_idx != NULL || oid_idx_len != 0) { >>> CID 1502775: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "oid_idx". 1022 if (oid_idx[0] > SNMP_CIRCUITS_MAX) 1023 return 0; 1024 1025 start = oid_idx[0]; 1026 } 1027 ** CID 1502774: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /isisd/isis_snmp.c: 2571 in isis_snmp_find_isadj() ________________________________________________________________________________________________________ *** CID 1502774: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /isisd/isis_snmp.c: 2571 in isis_snmp_find_isadj() 2565 2566 now_time = isis_snmp_time(); 2567 2568 if (adj->last_flap >= now_time) 2569 return SNMP_INTEGER(up_ticks); 2570 >>> CID 1502774: Integer handling issues (OVERFLOW_BEFORE_WIDEN) >>> Potentially overflowing expression "(now_time - adj->last_flap) * 10U" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "_uint64_t" (64 bits, unsigned). 2571 delta_ticks = (now_time - adj->last_flap) * 10; 2572 2573 if (up_ticks < delta_ticks) 2574 return SNMP_INTEGER(up_ticks); 2575 2576 return SNMP_INTEGER((uint32_t)(up_ticks - delta_ticks)); ** CID 1502773: (USE_AFTER_FREE) /ospf6d/ospf6_asbr.c: 1118 in ospf6_asbr_remove_externals_from_area() /ospf6d/ospf6_asbr.c: 1118 in ospf6_asbr_remove_externals_from_area() ________________________________________________________________________________________________________ *** CID 1502773: (USE_AFTER_FREE) /ospf6d/ospf6_asbr.c: 1118 in ospf6_asbr_remove_externals_from_area() 1112 for (ALL_LIST_ELEMENTS(ospf6->area_list, node, nnode, area)) 1113 if (!IS_AREA_STUB(area)) 1114 return; 1115 1116 /* if router is only in a stub area then purge AS-External LSAs */ 1117 for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) { >>> CID 1502773: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1118 if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) 1119 ospf6_lsdb_remove(lsa, ospf6->lsdb); 1120 } 1121 } 1122 1123 void ospf6_asbr_redistribute_add(int type, ifindex_t ifindex, /ospf6d/ospf6_asbr.c: 1117 in ospf6_asbr_remove_externals_from_area() 1111 /* skip if router is in other non-stub areas */ 1112 for (ALL_LIST_ELEMENTS(ospf6->area_list, node, nnode, area)) 1113 if (!IS_AREA_STUB(area)) 1114 return; 1115 1116 /* if router is only in a stub area then purge AS-External LSAs */ >>> CID 1502773: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 1117 for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) { 1118 if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) 1119 ospf6_lsdb_remove(lsa, ospf6->lsdb); 1120 } 1121 } 1122 /ospf6d/ospf6_asbr.c: 1117 in ospf6_asbr_remove_externals_from_area() 1111 /* skip if router is in other non-stub areas */ 1112 for (ALL_LIST_ELEMENTS(ospf6->area_list, node, nnode, area)) 1113 if (!IS_AREA_STUB(area)) 1114 return; 1115 1116 /* if router is only in a stub area then purge AS-External LSAs */ >>> CID 1502773: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 1117 for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) { 1118 if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) 1119 ospf6_lsdb_remove(lsa, ospf6->lsdb); 1120 } 1121 } 1122 /ospf6d/ospf6_asbr.c: 1118 in ospf6_asbr_remove_externals_from_area() 1112 for (ALL_LIST_ELEMENTS(ospf6->area_list, node, nnode, area)) 1113 if (!IS_AREA_STUB(area)) 1114 return; 1115 1116 /* if router is only in a stub area then purge AS-External LSAs */ 1117 for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) { >>> CID 1502773: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1118 if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) 1119 ospf6_lsdb_remove(lsa, ospf6->lsdb); 1120 } 1121 } 1122 1123 void ospf6_asbr_redistribute_add(int type, ifindex_t ifindex, ** CID 1502772: Null pointer dereferences (FORWARD_NULL) /isisd/isis_snmp.c: 948 in isis_snmp_circuit_lookup_next() ________________________________________________________________________________________________________ *** CID 1502772: Null pointer dereferences (FORWARD_NULL) /isisd/isis_snmp.c: 948 in isis_snmp_circuit_lookup_next() 942 if (isis == NULL) 943 return 0; 944 945 start = 0; 946 947 if (oid_idx != NULL || oid_idx_len != 0) { >>> CID 1502772: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "oid_idx". 948 if (oid_idx[0] > SNMP_CIRCUITS_MAX) 949 return 0; 950 951 start = oid_idx[0]; 952 } 953 ** CID 1501743: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1501743: Memory - corruptions (OVERRUN) /bgpd/bgp_mplsvpn_snmp.c: 1483 in bgpL3vpnRte_lookup() 1477 /* copy the index parameters */ 1478 oid_copy_str(&name[namelen], (*l3vpn_bgp)->name, 1479 vrf_name_len); 1480 oid_index = namelen + vrf_name_len; 1481 name[oid_index++] = 1482 v4 ? INETADDRESSTYPEIPV4 : INETADDRESSTYPEIPV6; >>> CID 1501743: Memory - corruptions (OVERRUN) >>> Overrunning struct type in_addr of 4 bytes by passing it to a function which accesses it at byte offset 15 using argument "addr_len" (which evaluates to 16). 1483 oid_copy_addr(&name[oid_index], &p->u.prefix4, 1484 addr_len); 1485 oid_index += addr_len; 1486 name[oid_index++] = p->prefixlen; 1487 name[oid_index++] = *policy >> 8; 1488 name[oid_index++] = *policy & 0xff; ** CID 1500586: Null pointer dereferences (FORWARD_NULL) /pbrd/pbr_nht.c: 758 in pbr_nht_individual_nexthop_gw_update() ________________________________________________________________________________________________________ *** CID 1500586: Null pointer dereferences (FORWARD_NULL) /pbrd/pbr_nht.c: 758 in pbr_nht_individual_nexthop_gw_update() 752 goto done; /* Unrelated change */ 753 break; 754 } 755 } 756 757 pnhi->nhr_matched = true; >>> CID 1500586: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "pnhi->nhr". 758 if (!pnhi->nhr->nexthop_num) { 759 is_valid = false; 760 goto done; 761 } 762 763 if (pnhc->nexthop.type == NEXTHOP_TYPE_IPV4_IFINDEX ** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 623 in ospf_apiclient_handle_lsa_delete() ________________________________________________________________________________________________________ *** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 623 in ospf_apiclient_handle_lsa_delete() 617 __func__, lsalen, OSPF_MAX_LSA_SIZE); 618 return; 619 } 620 621 p = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 622 >>> CID 1497888: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 623 memcpy(p, &(cn->data), lsalen); 624 lsa = p; 625 626 /* Invoke registered update callback function */ 627 if (oclient->delete_notify) { 628 (oclient->delete_notify)(cn->ifaddr, cn->area_id, ** CID 1497887: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 248 in ospf_extract_grace_lsa_fields() ________________________________________________________________________________________________________ *** CID 1497887: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 248 in ospf_extract_grace_lsa_fields() 242 __func__, length); 243 return OSPF_GR_FAILURE; 244 } 245 246 length -= OSPF_LSA_HEADER_SIZE; 247 >>> CID 1497887: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 248 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 249 tlvh = TLV_HDR_NEXT(tlvh)) { 250 251 /* Check TLV len against overall LSA */ 252 if (sum + TLV_SIZE(tlvh) > length) { 253 if (IS_DEBUG_OSPF_GR_HELPER) ** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 588 in ospf_apiclient_handle_lsa_update() ________________________________________________________________________________________________________ *** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 588 in ospf_apiclient_handle_lsa_update() 582 __func__, lsalen, OSPF_MAX_LSA_SIZE); 583 return; 584 } 585 586 p = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 587 >>> CID 1497886: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 588 memcpy(p, &(cn->data), lsalen); 589 lsa = p; 590 591 /* Invoke registered update callback function */ 592 if (oclient->update_notify) { 593 (oclient->update_notify)(cn->ifaddr, cn->area_id, ** CID 1497885: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 1017 in show_ospf_grace_lsa_info() ________________________________________________________________________________________________________ *** CID 1497885: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 1017 in show_ospf_grace_lsa_info() 1011 } 1012 1013 length -= OSPF_LSA_HEADER_SIZE; 1014 1015 vty_out(vty, " TLV info:\n"); 1016 >>> CID 1497885: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 1017 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 1018 tlvh = TLV_HDR_NEXT(tlvh)) { 1019 /* Check TLV len */ 1020 if (sum + TLV_SIZE(tlvh) > length) { 1021 vty_out(vty, "%% Invalid TLV length: %u\n", 1022 TLV_SIZE(tlvh)); ** CID 1487305: Memory - corruptions (ARRAY_VS_SINGLETON) /lib/prefix.c: 266 in evpn_type5_prefix_match() ________________________________________________________________________________________________________ *** CID 1487305: Memory - corruptions (ARRAY_VS_SINGLETON) /lib/prefix.c: 266 in evpn_type5_prefix_match() 260 return 0; 261 262 offset = prefixlen / PNBBY; 263 shift = prefixlen % PNBBY; 264 265 if (shift) >>> CID 1487305: Memory - corruptions (ARRAY_VS_SINGLETON) >>> Using "np" as an array. This might corrupt or misinterpret adjacent memory locations. 266 if (maskbit[shift] & (np[offset] ^ pp[offset])) 267 return 0; 268 269 while (offset--) 270 if (np[offset] != pp[offset]) 271 return 0; ** CID 1485637: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb_allocator.h: 57 in qpb_alloc_ptr_array() ________________________________________________________________________________________________________ *** CID 1485637: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb_allocator.h: 57 in qpb_alloc_ptr_array() 51 * 52 * Allocate space for the specified number of pointers. 53 */ 54 static inline void *qpb_alloc_ptr_array(qpb_allocator_t *allocator, 55 size_t num_ptrs) 56 { >>> CID 1485637: Incorrect expression (SIZEOF_MISMATCH) >>> Passing argument "num_ptrs * 8UL /* sizeof (void *) */" to function "qpb_alloc" which returns a value of type "void *" is suspicious. 57 return qpb_alloc(allocator, num_ptrs * sizeof(void *)); 58 } 59 60 /* 61 * qpb_free 62 */ ** CID 1485635: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb.h: 124 in qpb__l3_prefix__get() ________________________________________________________________________________________________________ *** CID 1485635: Incorrect expression (SIZEOF_MISMATCH) /qpb/qpb.h: 124 in qpb__l3_prefix__get() 118 uint8_t family, struct prefix *prefix) 119 { 120 121 switch (family) { 122 123 case AF_INET: >>> CID 1485635: Incorrect expression (SIZEOF_MISMATCH) >>> Passing argument "prefix" of type "struct prefix *" and argument "16UL" ("sizeof (struct prefix_ipv4)") to function "memset" is suspicious because a multiple of "sizeof (struct prefix) /*48*/" is expected. 124 memset(prefix, 0, sizeof(struct prefix_ipv4)); 125 break; 126 127 case AF_INET6: 128 memset(prefix, 0, sizeof(struct prefix_ipv6)); 129 break; ** CID 1482218: Memory - illegal accesses (OVERRUN) /lib/printf/glue.c: 206 in printfrr_ext_reg() ________________________________________________________________________________________________________ *** CID 1482218: Memory - illegal accesses (OVERRUN) /lib/printf/glue.c: 206 in printfrr_ext_reg() 200 return; 201 for (o++; o <= 'Z' - 'A'; o++) 202 ext_offsets[o]++; 203 204 memmove(entries + i + 1, entries + i, 205 (MAXEXT - i - 1) * sizeof(entries[0])); >>> CID 1482218: Memory - illegal accesses (OVERRUN) >>> Overrunning array of 512 bytes at byte offset 512 by dereferencing pointer "exts + i + 1". 206 memmove(exts + i + 1, exts + i, 207 (MAXEXT - i - 1) * sizeof(exts[0])); 208 209 memcpy(entries[i].fmt, ext->match, 2); 210 exts[i] = ext; 211 } ** CID 1482217: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1482217: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_packet.c: 355 in ospf_check_md5_digest() 349 EVP_DigestUpdate(ctx, ck->auth_key, OSPF_AUTH_MD5_SIZE); 350 EVP_DigestFinal(ctx, digest, &md5_size); 351 EVP_MD_CTX_free(ctx); 352 #elif CRYPTO_INTERNAL 353 memset(&ctx, 0, sizeof(ctx)); 354 MD5Init(&ctx); >>> CID 1482217: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "length" to a tainted sink. 355 MD5Update(&ctx, ospfh, length); 356 MD5Update(&ctx, ck->auth_key, OSPF_AUTH_MD5_SIZE); 357 MD5Final(digest, &ctx); 358 #endif 359 360 /* compare the two */ ** CID 1482215: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_message.c: 2257 in ospf6_lsupdate_send_interface() ________________________________________________________________________________________________________ *** CID 1482215: Insecure data handling (TAINTED_SCALAR) /ospf6d/ospf6_message.c: 2257 in ospf6_lsupdate_send_interface() 2251 ospf6_lsupdate)); 2252 lsa_cnt = 0; 2253 } 2254 } 2255 2256 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); >>> CID 1482215: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(((struct ospf6_lsa_header *)lsa->header)->length)" to a tainted sink. 2257 memcpy(p, lsa->header, OSPF6_LSA_SIZE(lsa->header)); 2258 p += OSPF6_LSA_SIZE(lsa->header); 2259 lsa_cnt++; 2260 2261 assert(lsa->lock == 2); 2262 ospf6_lsdb_remove(lsa, oi->lsupdate_list); ** CID 1482211: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1482211: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_packet.c: 430 in ospf_make_md5_digest() 424 EVP_DigestUpdate(ctx, auth_key, OSPF_AUTH_MD5_SIZE); 425 EVP_DigestFinal(ctx, digest, &md5_size); 426 EVP_MD_CTX_free(ctx); 427 #elif CRYPTO_INTERNAL 428 memset(&ctx, 0, sizeof(ctx)); 429 MD5Init(&ctx); >>> CID 1482211: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(ospfh->length)" to a tainted sink. 430 MD5Update(&ctx, ibuf, ntohs(ospfh->length)); 431 MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE); 432 MD5Final(digest, &ctx); 433 #endif 434 435 /* Append md5 digest to the end of the stream. */ ** CID 1482210: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_vty.c: 6286 in show_network_lsa_detail() ________________________________________________________________________________________________________ *** CID 1482210: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_vty.c: 6286 in show_network_lsa_detail() 6280 else 6281 json_object_int_add(json, "networkMask", 6282 ip_masklen(nl->mask)); 6283 6284 length = ntohs(lsa->data->length) - OSPF_LSA_HEADER_SIZE - 4; 6285 >>> CID 1482210: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 6286 for (i = 0; length > 0; i++, length -= 4) 6287 if (!json) { 6288 vty_out(vty, " Attached Router: %pI4\n", 6289 &nl->routers[i]); 6290 vty_out(vty, "\n"); 6291 } else { ** CID 1482203: (TAINTED_SCALAR) /ospfd/ospf_api.c: 422 in msg_write() ________________________________________________________________________________________________________ *** CID 1482203: (TAINTED_SCALAR) /ospfd/ospf_api.c: 425 in msg_write() 419 420 /* Make contiguous memory buffer for message */ 421 memcpy(buf, &msg->hdr, sizeof(struct apimsghdr)); 422 memcpy(buf + sizeof(struct apimsghdr), STREAM_DATA(msg->s), 423 ntohs(msg->hdr.msglen)); 424 >>> CID 1482203: (TAINTED_SCALAR) >>> Passing tainted variable "l" to a tainted sink. 425 wlen = writen(fd, buf, l); 426 if (wlen < 0) { 427 zlog_warn("msg_write: writen %s", safe_strerror(errno)); 428 return -1; 429 } else if (wlen == 0) { 430 zlog_warn("msg_write: Connection closed by peer"); /ospfd/ospf_api.c: 422 in msg_write() 416 417 /* Length of message including header */ 418 l = sizeof(struct apimsghdr) + ntohs(msg->hdr.msglen); 419 420 /* Make contiguous memory buffer for message */ 421 memcpy(buf, &msg->hdr, sizeof(struct apimsghdr)); >>> CID 1482203: (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(msg->hdr.msglen)" to a tainted sink. 422 memcpy(buf + sizeof(struct apimsghdr), STREAM_DATA(msg->s), 423 ntohs(msg->hdr.msglen)); 424 425 wlen = writen(fd, buf, l); 426 if (wlen < 0) { 427 zlog_warn("msg_write: writen %s", safe_strerror(errno)); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0