- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 22 Jan '21

22 Jan '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1501000: (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1501000: (NULL_RETURNS) /bgpd/bgp_route.c: 3519 in bgp_attr_add_no_advertise_community() 3513 struct community *noadv; 3514 3515 old = attr->community; 3516 noadv = community_str2com("no-advertise"); 3517 3518 if (old) { >>> CID 1501000: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "noadv" when calling "community_merge". 3519 merge = community_merge(community_dup(old), noadv); 3520 3521 if (!old->refcnt) 3522 community_free(&old); 3523 3524 new = community_uniq_sort(merge); /bgpd/bgp_route.c: 3527 in bgp_attr_add_no_advertise_community() 3521 if (!old->refcnt) 3522 community_free(&old); 3523 3524 new = community_uniq_sort(merge); 3525 community_free(&merge); 3526 } else { >>> CID 1501000: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "noadv" when calling "community_dup". 3527 new = community_dup(noadv); 3528 } 3529 3530 community_free(&noadv); 3531 3532 attr->community = new; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

FRR Telco meeting
by olivier.dugeon＠orange.com 19 Jan '21

19 Jan '21

When: Occurs on Wednesday every other week from 4:00 PM to 5:00 PM effective 1/6/2021 until 12/29/2021. (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna Where: BlueJean https://bluejeans.com/377688464 *~*~*~*~*~*~*~*~*~* Hi all, This is the invite for the regular be-weekly Telco's meeting for 2021. NOTE: THE MEETING ID CHANGE. Please use https://bluejeans.com/377688464 for the next Telco meetings Regards Olivier _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 19 Jan '21

19 Jan '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1500944: Error handling issues (CHECKED_RETURN) /lib/command.c: 2316 in script() ________________________________________________________________________________________________________ *** CID 1500944: Error handling issues (CHECKED_RETURN) /lib/command.c: 2316 in script() 2310 script_cmd, 2311 "script SCRIPT", 2312 "Test command - execute a script\n" 2313 "Script name (same as filename in /etc/frr/scripts/\n") 2314 { 2315 struct prefix p; >>> CID 1500944: Error handling issues (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 61 out of 63 times). 2316 str2prefix("1.2.3.4/24", &p); 2317 2318 struct frrscript *fs = frrscript_load(argv[1]->arg, NULL); 2319 2320 if (fs == NULL) { 2321 vty_out(vty, "Script '/etc/frr/scripts/%s.lua' not found\n", ** CID 1500943: Error handling issues (CHECKED_RETURN) /lib/frrlua.c: 79 in lua_toprefix() ________________________________________________________________________________________________________ *** CID 1500943: Error handling issues (CHECKED_RETURN) /lib/frrlua.c: 79 in lua_toprefix() 73 74 void *lua_toprefix(lua_State *L, int idx) 75 { 76 struct prefix *p = XCALLOC(MTYPE_TMP, sizeof(struct prefix)); 77 78 lua_getfield(L, idx, "network"); >>> CID 1500943: Error handling issues (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 61 out of 63 times). 79 str2prefix(lua_tostring(L, -1), p); 80 lua_pop(L, 1); 81 82 return p; 83 } 84 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

FRRounting for debian 10.6
by Eva 14 Jan '21

14 Jan '21

Good afternoon, i would like to make a request to provide a distribution for debian 10.6

2 1

New location for weekly technical development meeting
by Quentin Young 12 Jan '21

12 Jan '21

The weekly technical meeting, which takes place each Tuesday @ 11 AM EST, has moved to a new location: https://bluejeans.com/377688464 The old link will no longer work.

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 05 Jan '21

05 Jan '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1500604: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_updgrp_adv.c: 521 in bgp_adj_out_set_subgroup() ________________________________________________________________________________________________________ *** CID 1500604: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_updgrp_adv.c: 521 in bgp_adj_out_set_subgroup() 515 adv = adj->adv; 516 adv->dest = dest; 517 assert(adv->pathi == NULL); 518 /* bgp_path_info adj_out reference */ 519 adv->pathi = bgp_path_info_lock(path); 520 >>> CID 1500604: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "attr" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 521 if (attr) 522 adv->baa = bgp_advertise_intern(subgrp->hash, attr); 523 else 524 adv->baa = baa_new(); 525 adv->adj = adj; 526 adj->attr_hash = attr_hash; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

FRR Telco meeting
by olivier.dugeon＠orange.com 04 Jan '21

04 Jan '21

Quand : A lieu le mercredi toutes les deux semaines de 16:00 à 17:00 à partir du 06/01/2021 jusqu'au 29/12/2021. (UTC+01:00) Amsterdam, Berlin, Berne, Rome, Stockholm, Vienne Où : BlueJean https://bluejeans.com/9192742159 *~*~*~*~*~*~*~*~*~* Hi all, This is the invite for the regular be-weekly Telco's meeting for 2021. We'll use the bluejeans meeting room n°9192742159 https://bluejeans.com/9192742159 Regards Olivier _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 04 Jan '21

04 Jan '21

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 101 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 101 defect(s) ** CID 1500587: Security best practices violations (DC.WEAK_CRYPTO) /pathd/pathd.c: 483 in srte_candidate_add() ________________________________________________________________________________________________________ *** CID 1500587: Security best practices violations (DC.WEAK_CRYPTO) /pathd/pathd.c: 483 in srte_candidate_add() 477 candidate = XCALLOC(MTYPE_PATH_SR_CANDIDATE, sizeof(*candidate)); 478 lsp = XCALLOC(MTYPE_PATH_SR_CANDIDATE, sizeof(*lsp)); 479 480 candidate->preference = preference; 481 candidate->policy = policy; 482 candidate->type = SRTE_CANDIDATE_TYPE_UNDEFINED; >>> CID 1500587: Security best practices violations (DC.WEAK_CRYPTO) >>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 483 candidate->discriminator = rand(); 484 485 lsp->candidate = candidate; 486 candidate->lsp = lsp; 487 488 RB_INSERT(srte_candidate_head, &policy->candidate_paths, candidate); ** CID 1500586: Null pointer dereferences (FORWARD_NULL) /pbrd/pbr_nht.c: 773 in pbr_nht_individual_nexthop_gw_update() ________________________________________________________________________________________________________ *** CID 1500586: Null pointer dereferences (FORWARD_NULL) /pbrd/pbr_nht.c: 773 in pbr_nht_individual_nexthop_gw_update() 767 break; 768 } 769 } 770 goto done; 771 } 772 >>> CID 1500586: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "pnhi->nhr". 773 switch (pnhi->nhr->prefix.family) { 774 case AF_INET: 775 if (pnhc->nexthop.gate.ipv4.s_addr 776 != pnhi->nhr->prefix.u.prefix4.s_addr) 777 goto done; /* Unrelated change */ 778 break; ** CID 1500585: API usage errors (LOCK) /pathd/path_zebra.c: 161 in path_zebra_router_id_update() ________________________________________________________________________________________________________ *** CID 1500585: API usage errors (LOCK) /pathd/path_zebra.c: 161 in path_zebra_router_id_update() 155 } else { 156 pthread_mutex_unlock(&g_router_id_v4_mtx); 157 zlog_warn("Unexpected router ID address family for vrf %u: %u", 158 vrf_id, pref.family); 159 return 0; 160 } >>> CID 1500585: API usage errors (LOCK) >>> "pthread_mutex_unlock" unlocks "g_router_id_v4_mtx" while it is unlocked. 161 pthread_mutex_unlock(&g_router_id_v4_mtx); 162 zlog_info("%s Router Id updated for VRF %u: %s", family, vrf_id, buf); 163 return 0; 164 } 165 166 /** ** CID 1499854: Error handling issues (CHECKED_RETURN) /zebra/dplane_fpm_nl.c: 1239 in fpm_process_queue() ________________________________________________________________________________________________________ *** CID 1499854: Error handling issues (CHECKED_RETURN) /zebra/dplane_fpm_nl.c: 1239 in fpm_process_queue() 1233 frr_with_mutex (&fnc->ctxqueue_mutex) { 1234 ctx = dplane_ctx_dequeue(&fnc->ctxqueue); 1235 } 1236 if (ctx == NULL) 1237 break; 1238 >>> CID 1499854: Error handling issues (CHECKED_RETURN) >>> Calling "fpm_nl_enqueue" without checking return value (as is done elsewhere 4 out of 5 times). 1239 fpm_nl_enqueue(fnc, ctx); 1240 1241 /* Account the processed entries. */ 1242 processed_contexts++; 1243 atomic_fetch_sub_explicit(&fnc->counters.ctxqueue_len, 1, 1244 memory_order_relaxed); ** CID 1499389: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_nb_config.c: 6295 in bgp_peer_group_peer_lookup() ________________________________________________________________________________________________________ *** CID 1499389: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_nb_config.c: 6295 in bgp_peer_group_peer_lookup() 6289 static struct peer *bgp_peer_group_peer_lookup(struct bgp *bgp, 6290 const char *peer_str) 6291 { 6292 struct peer_group *group = NULL; 6293 6294 group = peer_group_lookup(bgp, peer_str); >>> CID 1499389: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "group", which is known to be "NULL". 6295 return group->conf; 6296 } 6297 6298 /* 6299 * XPath: 6300 * /frr-routing:routing/control-plane-protocols/control-plane-protocol/frr-bgp:bgp/peer-groups/peer-group ** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 620 in ospf_apiclient_handle_lsa_delete() ________________________________________________________________________________________________________ *** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 620 in ospf_apiclient_handle_lsa_delete() 614 __func__, lsalen, OSPF_MAX_LSA_SIZE); 615 return; 616 } 617 618 p = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 619 >>> CID 1497888: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 620 memcpy(p, &(cn->data), lsalen); 621 lsa = p; 622 623 /* Invoke registered update callback function */ 624 if (oclient->delete_notify) { 625 (oclient->delete_notify)(cn->ifaddr, cn->area_id, ** CID 1497887: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 248 in ospf_extract_grace_lsa_fields() ________________________________________________________________________________________________________ *** CID 1497887: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 248 in ospf_extract_grace_lsa_fields() 242 __func__, length); 243 return OSPF_GR_FAILURE; 244 } 245 246 length -= OSPF_LSA_HEADER_SIZE; 247 >>> CID 1497887: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 248 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 249 tlvh = TLV_HDR_NEXT(tlvh)) { 250 251 /* Check TLV len against overall LSA */ 252 if (sum + TLV_SIZE(tlvh) > length) { 253 if (IS_DEBUG_OSPF_GR_HELPER) ** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 585 in ospf_apiclient_handle_lsa_update() ________________________________________________________________________________________________________ *** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 585 in ospf_apiclient_handle_lsa_update() 579 __func__, lsalen, OSPF_MAX_LSA_SIZE); 580 return; 581 } 582 583 p = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 584 >>> CID 1497886: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 585 memcpy(p, &(cn->data), lsalen); 586 lsa = p; 587 588 /* Invoke registered update callback function */ 589 if (oclient->update_notify) { 590 (oclient->update_notify)(cn->ifaddr, cn->area_id, ** CID 1497885: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 1017 in show_ospf_grace_lsa_info() ________________________________________________________________________________________________________ *** CID 1497885: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 1017 in show_ospf_grace_lsa_info() 1011 } 1012 1013 length -= OSPF_LSA_HEADER_SIZE; 1014 1015 vty_out(vty, " TLV info:\n"); 1016 >>> CID 1497885: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 1017 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 1018 tlvh = TLV_HDR_NEXT(tlvh)) { 1019 /* Check TLV len */ 1020 if (sum + TLV_SIZE(tlvh) > length) { 1021 vty_out(vty, "%% Invalid TLV length: %u\n", 1022 TLV_SIZE(tlvh)); ** CID 1497792: (USE_AFTER_FREE) /ospf6d/ospf6_interface.c: 1135 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 1146 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 1135 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 1146 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 1101 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 1101 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 1120 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 1120 in ospf6_interface_show() ________________________________________________________________________________________________________ *** CID 1497792: (USE_AFTER_FREE) /ospf6d/ospf6_interface.c: 1135 in ospf6_interface_show() 1129 timerstring(&res, duration, sizeof(duration)); 1130 vty_out(vty, 1131 " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", 1132 oi->lsupdate_list->count, duration, 1133 (oi->thread_send_lsupdate ? "on" : "off")); 1134 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1135 vty_out(vty, " %s\n", lsa->name); 1136 1137 timerclear(&res); 1138 if (oi->thread_send_lsack) 1139 timersub(&oi->thread_send_lsack->u.sands, &now, &res); 1140 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_interface.c: 1146 in ospf6_interface_show() 1140 timerstring(&res, duration, sizeof(duration)); 1141 vty_out(vty, 1142 " %d Pending LSAs for LSAck in Time %s [thread %s]\n", 1143 oi->lsack_list->count, duration, 1144 (oi->thread_send_lsack ? "on" : "off")); 1145 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1146 vty_out(vty, " %s\n", lsa->name); 1147 } 1148 ospf6_bfd_show_info(vty, oi->bfd_info, 1, json_obj, use_json); 1149 return 0; 1150 } 1151 /ospf6d/ospf6_interface.c: 1135 in ospf6_interface_show() 1129 timerstring(&res, duration, sizeof(duration)); 1130 vty_out(vty, 1131 " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", 1132 oi->lsupdate_list->count, duration, 1133 (oi->thread_send_lsupdate ? "on" : "off")); 1134 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1135 vty_out(vty, " %s\n", lsa->name); 1136 1137 timerclear(&res); 1138 if (oi->thread_send_lsack) 1139 timersub(&oi->thread_send_lsack->u.sands, &now, &res); 1140 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_interface.c: 1146 in ospf6_interface_show() 1140 timerstring(&res, duration, sizeof(duration)); 1141 vty_out(vty, 1142 " %d Pending LSAs for LSAck in Time %s [thread %s]\n", 1143 oi->lsack_list->count, duration, 1144 (oi->thread_send_lsack ? "on" : "off")); 1145 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1146 vty_out(vty, " %s\n", lsa->name); 1147 } 1148 ospf6_bfd_show_info(vty, oi->bfd_info, 1, json_obj, use_json); 1149 return 0; 1150 } 1151 /ospf6d/ospf6_interface.c: 1101 in ospf6_interface_show() 1095 json_object_string_add( 1096 json_obj, "lsUpdateSendThread", 1097 (oi->thread_send_lsupdate ? "on" : "off")); 1098 1099 json_arr = json_object_new_array(); 1100 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1101 json_object_array_add( 1102 json_arr, json_object_new_string(lsa->name)); 1103 json_object_object_add(json_obj, "pendingLsaLsUpdate", 1104 json_arr); 1105 1106 timerclear(&res); /ospf6d/ospf6_interface.c: 1101 in ospf6_interface_show() 1095 json_object_string_add( 1096 json_obj, "lsUpdateSendThread", 1097 (oi->thread_send_lsupdate ? "on" : "off")); 1098 1099 json_arr = json_object_new_array(); 1100 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1101 json_object_array_add( 1102 json_arr, json_object_new_string(lsa->name)); 1103 json_object_object_add(json_obj, "pendingLsaLsUpdate", 1104 json_arr); 1105 1106 timerclear(&res); /ospf6d/ospf6_interface.c: 1120 in ospf6_interface_show() 1114 duration); 1115 json_object_string_add(json_obj, "lsAckSendThread", 1116 (oi->thread_send_lsack ? "on" : "off")); 1117 1118 json_arr = json_object_new_array(); 1119 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1120 json_object_array_add( 1121 json_arr, json_object_new_string(lsa->name)); 1122 json_object_object_add(json_obj, "pendingLsaLsAck", json_arr); 1123 1124 } else { 1125 timerclear(&res); /ospf6d/ospf6_interface.c: 1120 in ospf6_interface_show() 1114 duration); 1115 json_object_string_add(json_obj, "lsAckSendThread", 1116 (oi->thread_send_lsack ? "on" : "off")); 1117 1118 json_arr = json_object_new_array(); 1119 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1120 json_object_array_add( 1121 json_arr, json_object_new_string(lsa->name)); 1122 json_object_object_add(json_obj, "pendingLsaLsAck", json_arr); 1123 1124 } else { 1125 timerclear(&res); ** CID 1497791: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 685 in ospfv3GeneralGroup() /ospf6d/ospf6_snmp.c: 685 in ospfv3GeneralGroup() ________________________________________________________________________________________________________ *** CID 1497791: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 685 in ospfv3GeneralGroup() 679 return SNMP_INTEGER(ospf6->lsdb->count); 680 return SNMP_INTEGER(0); 681 case OSPFv3ASSCOPELSACHECKSUMSUM: 682 if (ospf6) { 683 sum = 0; 684 for (ALL_LSDB(ospf6->lsdb, lsa, lsanext)) >>> CID 1497791: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 685 sum += ntohs(lsa->header->checksum); 686 return SNMP_INTEGER(sum); 687 } 688 return SNMP_INTEGER(0); 689 case OSPFv3ORIGINATENEWLSAS: 690 return SNMP_INTEGER( /ospf6d/ospf6_snmp.c: 685 in ospfv3GeneralGroup() 679 return SNMP_INTEGER(ospf6->lsdb->count); 680 return SNMP_INTEGER(0); 681 case OSPFv3ASSCOPELSACHECKSUMSUM: 682 if (ospf6) { 683 sum = 0; 684 for (ALL_LSDB(ospf6->lsdb, lsa, lsanext)) >>> CID 1497791: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 685 sum += ntohs(lsa->header->checksum); 686 return SNMP_INTEGER(sum); 687 } 688 return SNMP_INTEGER(0); 689 case OSPFv3ORIGINATENEWLSAS: 690 return SNMP_INTEGER( ** CID 1497790: (USE_AFTER_FREE) /ospf6d/ospf6_asbr.c: 1090 in ospf6_asbr_send_externals_to_area() /ospf6d/ospf6_asbr.c: 1090 in ospf6_asbr_send_externals_to_area() ________________________________________________________________________________________________________ *** CID 1497790: (USE_AFTER_FREE) /ospf6d/ospf6_asbr.c: 1090 in ospf6_asbr_send_externals_to_area() 1084 /* When an area is unstubified, flood all the external LSAs in the area */ 1085 void ospf6_asbr_send_externals_to_area(struct ospf6_area *oa) 1086 { 1087 struct ospf6_lsa *lsa, *lsanext; 1088 1089 for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) { >>> CID 1497790: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1090 if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) { 1091 zlog_debug("%s: Flooding AS-External LSA %s", 1092 __func__, lsa->name); 1093 ospf6_flood_area(NULL, lsa, oa); 1094 } 1095 } /ospf6d/ospf6_asbr.c: 1090 in ospf6_asbr_send_externals_to_area() 1084 /* When an area is unstubified, flood all the external LSAs in the area */ 1085 void ospf6_asbr_send_externals_to_area(struct ospf6_area *oa) 1086 { 1087 struct ospf6_lsa *lsa, *lsanext; 1088 1089 for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) { >>> CID 1497790: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1090 if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) { 1091 zlog_debug("%s: Flooding AS-External LSA %s", 1092 __func__, lsa->name); 1093 ospf6_flood_area(NULL, lsa, oa); 1094 } 1095 } ** CID 1497789: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 1184 in ospfv3IfEntry() /ospf6d/ospf6_snmp.c: 1184 in ospfv3IfEntry() ________________________________________________________________________________________________________ *** CID 1497789: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 1184 in ospfv3IfEntry() 1178 return SNMP_INTEGER(oi->cost); 1179 case OSPFv3IFLINKSCOPELSACOUNT: 1180 return SNMP_INTEGER(oi->lsdb->count); 1181 case OSPFv3IFLINKLSACKSUMSUM: 1182 sum = 0; 1183 for (ALL_LSDB(oi->lsdb, lsa, lsanext)) >>> CID 1497789: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1184 sum += ntohs(lsa->header->checksum); 1185 return SNMP_INTEGER(sum); 1186 case OSPFv3IFDEMANDNBRPROBE: 1187 case OSPFv3IFDEMANDNBRPROBERETRANSLIMIT: 1188 case OSPFv3IFDEMANDNBRPROBEINTERVAL: 1189 case OSPFv3IFTEDISABLED: /ospf6d/ospf6_snmp.c: 1184 in ospfv3IfEntry() 1178 return SNMP_INTEGER(oi->cost); 1179 case OSPFv3IFLINKSCOPELSACOUNT: 1180 return SNMP_INTEGER(oi->lsdb->count); 1181 case OSPFv3IFLINKLSACKSUMSUM: 1182 sum = 0; 1183 for (ALL_LSDB(oi->lsdb, lsa, lsanext)) >>> CID 1497789: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1184 sum += ntohs(lsa->header->checksum); 1185 return SNMP_INTEGER(sum); 1186 case OSPFv3IFDEMANDNBRPROBE: 1187 case OSPFv3IFDEMANDNBRPROBERETRANSLIMIT: 1188 case OSPFv3IFDEMANDNBRPROBEINTERVAL: 1189 case OSPFv3IFTEDISABLED: ** CID 1497788: (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 835 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 782 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 909 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 835 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 855 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 818 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 818 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 791 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 872 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 782 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 800 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 872 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 855 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 800 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 791 in ospf6_neighbor_show_detail() ________________________________________________________________________________________________________ *** CID 1497788: (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 835 in ospf6_neighbor_show_detail() 829 json_object_string_add(json_neighbor, "pendingLsaLsReqTime", 830 duration); 831 json_object_string_add(json_neighbor, "lsReqSendThread", 832 (on->thread_send_lsreq ? "on" : "off")); 833 json_array = json_object_new_array(); 834 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 835 json_object_array_add( 836 json_array, json_object_new_string(lsa->name)); 837 json_object_object_add(json_neighbor, "pendingLsaLsReq", 838 json_array); 839 840 /ospf6d/ospf6_neighbor.c: 782 in ospf6_neighbor_show_detail() 776 (unsigned long)ntohl(on->dbdesc_seqnum)); 777 778 json_array = json_object_new_array(); 779 json_object_int_add(json_neighbor, "summaryListCount", 780 on->summary_list->count); 781 for (ALL_LSDB(on->summary_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 782 json_object_array_add( 783 json_array, json_object_new_string(lsa->name)); 784 json_object_object_add(json_neighbor, "summaryListLsa", 785 json_array); 786 787 json_array = json_object_new_array(); /ospf6d/ospf6_neighbor.c: 909 in ospf6_neighbor_show_detail() 903 : "Slave"), 904 (unsigned long)ntohl(on->dbdesc_seqnum)); 905 906 vty_out(vty, " Summary-List: %d LSAs\n", 907 on->summary_list->count); 908 for (ALL_LSDB(on->summary_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 909 vty_out(vty, " %s\n", lsa->name); 910 911 vty_out(vty, " Request-List: %d LSAs\n", 912 on->request_list->count); 913 for (ALL_LSDB(on->request_list, lsa, lsanext)) 914 vty_out(vty, " %s\n", lsa->name); /ospf6d/ospf6_neighbor.c: 835 in ospf6_neighbor_show_detail() 829 json_object_string_add(json_neighbor, "pendingLsaLsReqTime", 830 duration); 831 json_object_string_add(json_neighbor, "lsReqSendThread", 832 (on->thread_send_lsreq ? "on" : "off")); 833 json_array = json_object_new_array(); 834 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 835 json_object_array_add( 836 json_array, json_object_new_string(lsa->name)); 837 json_object_object_add(json_neighbor, "pendingLsaLsReq", 838 json_array); 839 840 /ospf6d/ospf6_neighbor.c: 855 in ospf6_neighbor_show_detail() 849 duration); 850 json_object_string_add( 851 json_neighbor, "lsUpdateSendThread", 852 (on->thread_send_lsupdate ? "on" : "off")); 853 json_array = json_object_new_array(); 854 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 855 json_object_array_add( 856 json_array, json_object_new_string(lsa->name)); 857 json_object_object_add(json_neighbor, "pendingLsaLsUpdate", 858 json_array); 859 860 timerclear(&res); /ospf6d/ospf6_neighbor.c: 818 in ospf6_neighbor_show_detail() 812 json_object_string_add(json_neighbor, "pendingLsaDbDescTime", 813 duration); 814 json_object_string_add(json_neighbor, "dbDescSendThread", 815 (on->thread_send_dbdesc ? "on" : "off")); 816 json_array = json_object_new_array(); 817 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 818 json_object_array_add( 819 json_array, json_object_new_string(lsa->name)); 820 json_object_object_add(json_neighbor, "pendingLsaDbDesc", 821 json_array); 822 823 timerclear(&res); /ospf6d/ospf6_neighbor.c: 818 in ospf6_neighbor_show_detail() 812 json_object_string_add(json_neighbor, "pendingLsaDbDescTime", 813 duration); 814 json_object_string_add(json_neighbor, "dbDescSendThread", 815 (on->thread_send_dbdesc ? "on" : "off")); 816 json_array = json_object_new_array(); 817 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 818 json_object_array_add( 819 json_array, json_object_new_string(lsa->name)); 820 json_object_object_add(json_neighbor, "pendingLsaDbDesc", 821 json_array); 822 823 timerclear(&res); /ospf6d/ospf6_neighbor.c: 791 in ospf6_neighbor_show_detail() 785 json_array); 786 787 json_array = json_object_new_array(); 788 json_object_int_add(json_neighbor, "requestListCount", 789 on->request_list->count); 790 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 791 json_object_array_add( 792 json_array, json_object_new_string(lsa->name)); 793 json_object_object_add(json_neighbor, "requestListLsa", 794 json_array); 795 796 json_array = json_object_new_array(); /ospf6d/ospf6_neighbor.c: 872 in ospf6_neighbor_show_detail() 866 json_object_string_add(json_neighbor, "pendingLsaLsAckTime", 867 duration); 868 json_object_string_add(json_neighbor, "lsAckSendThread", 869 (on->thread_send_lsack ? "on" : "off")); 870 json_array = json_object_new_array(); 871 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 872 json_object_array_add( 873 json_array, json_object_new_string(lsa->name)); 874 json_object_object_add(json_neighbor, "pendingLsaLsAck", 875 json_array); 876 877 ospf6_bfd_show_info(vty, on->bfd_info, 0, json_neighbor, /ospf6d/ospf6_neighbor.c: 782 in ospf6_neighbor_show_detail() 776 (unsigned long)ntohl(on->dbdesc_seqnum)); 777 778 json_array = json_object_new_array(); 779 json_object_int_add(json_neighbor, "summaryListCount", 780 on->summary_list->count); 781 for (ALL_LSDB(on->summary_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 782 json_object_array_add( 783 json_array, json_object_new_string(lsa->name)); 784 json_object_object_add(json_neighbor, "summaryListLsa", 785 json_array); 786 787 json_array = json_object_new_array(); /ospf6d/ospf6_neighbor.c: 800 in ospf6_neighbor_show_detail() 794 json_array); 795 796 json_array = json_object_new_array(); 797 json_object_int_add(json_neighbor, "reTransListCount", 798 on->retrans_list->count); 799 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 800 json_object_array_add( 801 json_array, json_object_new_string(lsa->name)); 802 json_object_object_add(json_neighbor, "reTransListLsa", 803 json_array); 804 805 /ospf6d/ospf6_neighbor.c: 872 in ospf6_neighbor_show_detail() 866 json_object_string_add(json_neighbor, "pendingLsaLsAckTime", 867 duration); 868 json_object_string_add(json_neighbor, "lsAckSendThread", 869 (on->thread_send_lsack ? "on" : "off")); 870 json_array = json_object_new_array(); 871 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 872 json_object_array_add( 873 json_array, json_object_new_string(lsa->name)); 874 json_object_object_add(json_neighbor, "pendingLsaLsAck", 875 json_array); 876 877 ospf6_bfd_show_info(vty, on->bfd_info, 0, json_neighbor, /ospf6d/ospf6_neighbor.c: 855 in ospf6_neighbor_show_detail() 849 duration); 850 json_object_string_add( 851 json_neighbor, "lsUpdateSendThread", 852 (on->thread_send_lsupdate ? "on" : "off")); 853 json_array = json_object_new_array(); 854 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 855 json_object_array_add( 856 json_array, json_object_new_string(lsa->name)); 857 json_object_object_add(json_neighbor, "pendingLsaLsUpdate", 858 json_array); 859 860 timerclear(&res); /ospf6d/ospf6_neighbor.c: 800 in ospf6_neighbor_show_detail() 794 json_array); 795 796 json_array = json_object_new_array(); 797 json_object_int_add(json_neighbor, "reTransListCount", 798 on->retrans_list->count); 799 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 800 json_object_array_add( 801 json_array, json_object_new_string(lsa->name)); 802 json_object_object_add(json_neighbor, "reTransListLsa", 803 json_array); 804 805 /ospf6d/ospf6_neighbor.c: 791 in ospf6_neighbor_show_detail() 785 json_array); 786 787 json_array = json_object_new_array(); 788 json_object_int_add(json_neighbor, "requestListCount", 789 on->request_list->count); 790 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 791 json_object_array_add( 792 json_array, json_object_new_string(lsa->name)); 793 json_object_object_add(json_neighbor, "requestListLsa", 794 json_array); 795 796 json_array = json_object_new_array(); ** CID 1497787: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() ________________________________________________________________________________________________________ *** CID 1497787: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() 1936 /* set Request entries in lsreq */ 1937 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 1938 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 1939 /* MTU check */ 1940 if (p - sendbuf + sizeof(struct ospf6_lsreq_entry) 1941 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1497787: (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_lsa_unlock" frees pointer "lsa" which has already been freed. 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; 1947 e->type = lsa->header->type; /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() 1936 /* set Request entries in lsreq */ 1937 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 1938 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 1939 /* MTU check */ 1940 if (p - sendbuf + sizeof(struct ospf6_lsreq_entry) 1941 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1497787: (USE_AFTER_FREE) >>> Passing freed pointer "lsa" as an argument to "ospf6_lsdb_lsa_unlock". 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; 1947 e->type = lsa->header->type; /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() 1936 /* set Request entries in lsreq */ 1937 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 1938 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 1939 /* MTU check */ 1940 if (p - sendbuf + sizeof(struct ospf6_lsreq_entry) 1941 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1497787: (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_lsa_unlock" frees pointer "lsa" which has already been freed. 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; 1947 e->type = lsa->header->type; /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() 1941 > ospf6_packet_max(on->ospf6_if)) { 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; >>> CID 1497787: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1947 e->type = lsa->header->type; 1948 e->id = lsa->header->id; 1949 e->adv_router = lsa->header->adv_router; 1950 p += sizeof(struct ospf6_lsreq_entry); 1951 last_req = lsa; 1952 } /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() 1941 > ospf6_packet_max(on->ospf6_if)) { 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; >>> CID 1497787: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1947 e->type = lsa->header->type; 1948 e->id = lsa->header->id; 1949 e->adv_router = lsa->header->adv_router; 1950 p += sizeof(struct ospf6_lsreq_entry); 1951 last_req = lsa; 1952 } ** CID 1497786: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1497786: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1837 in ospf6_dbdesc_send() 1831 dbdesc->seqnum = htonl(on->dbdesc_seqnum); 1832 1833 /* if this is not initial one, set LSA headers in dbdesc */ 1834 p = (uint8_t *)((caddr_t)dbdesc + sizeof(struct ospf6_dbdesc)); 1835 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 1836 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1497786: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 1837 ospf6_lsa_age_update_to_send(lsa, 1838 on->ospf6_if->transdelay); 1839 1840 /* MTU check */ 1841 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 1842 > ospf6_packet_max(on->ospf6_if)) { /ospf6d/ospf6_message.c: 1837 in ospf6_dbdesc_send() 1831 dbdesc->seqnum = htonl(on->dbdesc_seqnum); 1832 1833 /* if this is not initial one, set LSA headers in dbdesc */ 1834 p = (uint8_t *)((caddr_t)dbdesc + sizeof(struct ospf6_dbdesc)); 1835 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 1836 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1497786: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 1837 ospf6_lsa_age_update_to_send(lsa, 1838 on->ospf6_if->transdelay); 1839 1840 /* MTU check */ 1841 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 1842 > ospf6_packet_max(on->ospf6_if)) { ** CID 1496729: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 268 in ecommunity_dup() ________________________________________________________________________________________________________ *** CID 1496729: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 268 in ecommunity_dup() 262 struct ecommunity *new; 263 264 new = XCALLOC(MTYPE_ECOMMUNITY, sizeof(struct ecommunity)); 265 new->size = ecom->size; 266 new->unit_size = ecom->unit_size; 267 if (new->size) { >>> CID 1496729: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 268 new->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 269 ecom->size * ecom->unit_size); 270 memcpy(new->val, ecom->val, 271 (size_t)ecom->size * (size_t)ecom->unit_size); 272 } else 273 new->val = NULL; ** CID 1496726: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1259 in ecommunity_strip() ________________________________________________________________________________________________________ *** CID 1496726: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1259 in ecommunity_strip() 1253 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); 1254 ecom->size = 0; 1255 return true; 1256 } 1257 1258 /* Strip matching ext community(ies). */ >>> CID 1496726: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - found) * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - found) * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1259 new = XMALLOC(MTYPE_ECOMMUNITY_VAL, 1260 (ecom->size - found) * ecom->unit_size); 1261 q = new; 1262 for (c = 0, p = ecom->val; c < ecom->size; c++, p += ecom->unit_size) { 1263 if (!(p[0] == type && p[1] == subtype)) { 1264 memcpy(q, p, ecom->unit_size); ** CID 1496724: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1300 in ecommunity_del_val() /bgpd/bgp_ecommunity.c: 1298 in ecommunity_del_val() /bgpd/bgp_ecommunity.c: 1304 in ecommunity_del_val() ________________________________________________________________________________________________________ *** CID 1496724: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1300 in ecommunity_del_val() 1294 return false; 1295 1296 /* Delete the selected value */ 1297 ecom->size--; 1298 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1299 if (c != 0) >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "c * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "c * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1300 memcpy(p, ecom->val, c * ecom->unit_size); 1301 if ((ecom->size - c) != 0) 1302 memcpy(p + (c)*ecom->unit_size, 1303 ecom->val + (c + 1) * ecom->unit_size, 1304 (ecom->size - c) * ecom->unit_size); 1305 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); /bgpd/bgp_ecommunity.c: 1298 in ecommunity_del_val() 1292 } 1293 if (found == 0) 1294 return false; 1295 1296 /* Delete the selected value */ 1297 ecom->size--; >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1298 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1299 if (c != 0) 1300 memcpy(p, ecom->val, c * ecom->unit_size); 1301 if ((ecom->size - c) != 0) 1302 memcpy(p + (c)*ecom->unit_size, 1303 ecom->val + (c + 1) * ecom->unit_size, /bgpd/bgp_ecommunity.c: 1304 in ecommunity_del_val() 1298 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1299 if (c != 0) 1300 memcpy(p, ecom->val, c * ecom->unit_size); 1301 if ((ecom->size - c) != 0) 1302 memcpy(p + (c)*ecom->unit_size, 1303 ecom->val + (c + 1) * ecom->unit_size, >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - c) * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - c) * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1304 (ecom->size - c) * ecom->unit_size); 1305 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); 1306 ecom->val = p; 1307 return true; 1308 } 1309 ** CID 1496723: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 158 in ecommunity_add_val_internal() /bgpd/bgp_ecommunity.c: 164 in ecommunity_add_val_internal() /bgpd/bgp_ecommunity.c: 106 in ecommunity_add_val_internal() ________________________________________________________________________________________________________ *** CID 1496723: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 158 in ecommunity_add_val_internal() 152 153 if (ins_idx == -1) 154 ins_idx = c; 155 156 /* Add the value to the structure with numerical sorting. */ 157 ecom->size++; >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 158 ecom->val = XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom->val, 159 ecom_length_size(ecom, ecom_size)); 160 161 162 memmove(ecom->val + ((ins_idx + 1) * ecom_size), 163 ecom->val + (ins_idx * ecom_size), /bgpd/bgp_ecommunity.c: 164 in ecommunity_add_val_internal() 158 ecom->val = XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom->val, 159 ecom_length_size(ecom, ecom_size)); 160 161 162 memmove(ecom->val + ((ins_idx + 1) * ecom_size), 163 ecom->val + (ins_idx * ecom_size), >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - 1 - ins_idx) * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - 1 - ins_idx) * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 164 (ecom->size - 1 - ins_idx) * ecom_size); 165 memcpy(ecom->val + (ins_idx * ecom_size), 166 eval, ecom_size); 167 168 return true; 169 } /bgpd/bgp_ecommunity.c: 106 in ecommunity_add_val_internal() 100 const struct ecommunity_val_ipv6 *eval6 = 101 (struct ecommunity_val_ipv6 *)eval; 102 103 /* When this is fist value, just add it. */ 104 if (ecom->val == NULL) { 105 ecom->size = 1; >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 106 ecom->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 107 ecom_length_size(ecom, ecom_size)); 108 memcpy(ecom->val, eval, ecom_size); 109 return true; 110 } 111 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

how time support trll
by ak_birdofprey 24 Dec '20

24 Dec '20

很感谢自由社区得FRR，能够通过提供一个很好得全功能路由组件实现来让Gnu/Linux变得更了不起。希望FRR能支持IETF定义的各类路由协议和ACTION/ACTION MODE 的具体实现，通过自由社区让网络变得更加自由，让Gnu/Linux变得更加好玩和具有魅力。也同时让FRR变得更加完善，成为IETF得最好具体实现之一

1 0

Canceled: FRR Telco meeting
by olivier.dugeon＠orange.com 18 Dec '20

18 Dec '20

When: Wednesday, December 23, 2020 4:00 PM-5:00 PM. (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna Where: BlueJean https://bluejeans.com/9192742159 *~*~*~*~*~*~*~*~*~* Hi all, This is the invite for the regular Telco's meeting. Note that I must shift it by one hour due to overlap with other personal regular meeting Regards Olivier _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0