- dev - lists.frrouting.org

Northbound weekly meeting
by Lou Berger 13 Nov '20

13 Nov '20

1 0

Northbound weekly meeting
by Lou Berger 12 Nov '20

12 Nov '20

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 12 Nov '20

12 Nov '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1496950: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496950: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_route.c: 4514 in bgp_soft_reconfig_table() 4508 if (pi) 4509 memcpy(&evpn, &pi->attr->evpn_overlay, 4510 sizeof(evpn)); 4511 else 4512 memset(&evpn, 0, sizeof(evpn)); 4513 >>> CID 1496950: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "label_pnt" to "bgp_update", which dereferences it. 4514 ret = bgp_update(peer, bgp_dest_get_prefix(dest), 4515 ain->addpath_rx_id, ain->attr, afi, 4516 safi, ZEBRA_ROUTE_BGP, 4517 BGP_ROUTE_NORMAL, prd, label_pnt, 4518 num_labels, 1, &evpn); 4519 ** CID 1496947: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496947: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_rpki.c: 445 in revalidate_bgp_node() 439 uint32_t num_labels = 0; 440 441 if (path && path->extra) { 442 label = path->extra->label; 443 num_labels = path->extra->num_labels; 444 } >>> CID 1496947: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "label" to "bgp_update", which dereferences it. 445 ret = bgp_update(ain->peer, bgp_dest_get_prefix(bgp_dest), 446 ain->addpath_rx_id, ain->attr, afi, safi, 447 ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL, NULL, label, 448 num_labels, 1, NULL); 449 450 if (ret < 0) ** CID 1496946: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496946: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_mac.c: 213 in bgp_process_mac_rescan_table() 207 peer->host, pfx_buf); 208 } 209 continue; 210 } 211 212 memcpy(&evpn, &pi->attr->evpn_overlay, sizeof(evpn)); >>> CID 1496946: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "label_pnt" to "bgp_update", which dereferences it. 213 int32_t ret = bgp_update(peer, p, 214 pi->addpath_rx_id, 215 pi->attr, AFI_L2VPN, SAFI_EVPN, 216 ZEBRA_ROUTE_BGP, 217 BGP_ROUTE_NORMAL, &prd, 218 label_pnt, num_labels, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Knowing requirements for contrbutions
by jatin jain 12 Nov '20

12 Nov '20

*To* *FRRouting* *Sir, I am a young programmer. I found your organisation from GSOC-2020 archives. I want to contribute to your open source organisation, so please tell me what are requirements (like language, algorithms) to write code for your organisation* *Thanking You* *JATIN JAIN*

2 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 05 Nov '20

05 Nov '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1499389: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_nb_config.c: 6280 in bgp_peer_group_peer_lookup() ________________________________________________________________________________________________________ *** CID 1499389: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_nb_config.c: 6280 in bgp_peer_group_peer_lookup() 6274 const char *peer_str) 6275 { 6276 struct peer *peer = NULL; 6277 struct peer_group *group = NULL; 6278 6279 group = peer_group_lookup(bgp, peer_str); >>> CID 1499389: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "group", which is known to be "NULL". 6280 return peer = group->conf; 6281 } 6282 6283 /* 6284 * XPath: 6285 * /frr-routing:routing/control-plane-protocols/control-plane-protocol/frr-bgp:bgp/peer-groups/peer-group ** CID 1499388: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1499388: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_nb_config.c: 5201 in bgp_neighbors_unnumbered_neighbor_neighbor_remote_as_remote_as_type_destroy() 5195 bgp = nb_running_get_entry(args->dnode, NULL, true); 5196 peer_str = 5197 yang_dnode_get_string(args->dnode, "../../interface"); 5198 peer = peer_lookup_by_conf_if(bgp, peer_str); 5199 5200 /* remote-as set to 0 and as_type to unspecified */ >>> CID 1499388: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "peer" when calling "peer_as_change". 5201 peer_as_change(peer, 0, AS_UNSPECIFIED); 5202 5203 break; 5204 } 5205 5206 return NB_OK; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Northbound Weekly meeting
by Santosh P K 02 Nov '20

02 Nov '20

All, Adjusted day light saving and this is the new slot we are going to use for northbound weekly meeting. Thanks Santosh P K

1 0

Northbound Weekly meeting
by Santosh P K 02 Nov '20

02 Nov '20

All, Adjusted day light saving and this is the new slot we are going to use for northbound weekly meeting. Thanks Santosh P K

1 0

FRR Debian Packages
by Jafar Al-Gharaibeh 28 Oct '20

28 Oct '20

Dear All, Recently we have made changes to how we create and publish FRR deb packages. We have also moved the repository to new servers. We have had some issues with DNS and site certs during the transition in the last couple of days. We also introduced a new signing key which means you have to re-sync your keys following the instructions on [1]. Sorry for any inconvenience this may have caused. All of the issues related to this transition reported so far have been resolved. Please let me know if you still have issues. Regards, Jafar Al-Gharaibeh [1] https://deb.frrouting.org/

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 27 Oct '20

27 Oct '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 92 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 92 defect(s) ** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 620 in ospf_apiclient_handle_lsa_delete() ________________________________________________________________________________________________________ *** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 620 in ospf_apiclient_handle_lsa_delete() 614 __func__, lsalen, OSPF_MAX_LSA_SIZE); 615 return; 616 } 617 618 p = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 619 >>> CID 1497888: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 620 memcpy(p, &(cn->data), lsalen); 621 lsa = p; 622 623 /* Invoke registered update callback function */ 624 if (oclient->delete_notify) { 625 (oclient->delete_notify)(cn->ifaddr, cn->area_id, ** CID 1497887: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 248 in ospf_extract_grace_lsa_fields() ________________________________________________________________________________________________________ *** CID 1497887: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 248 in ospf_extract_grace_lsa_fields() 242 __func__, length); 243 return OSPF_GR_FAILURE; 244 } 245 246 length -= OSPF_LSA_HEADER_SIZE; 247 >>> CID 1497887: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 248 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 249 tlvh = TLV_HDR_NEXT(tlvh)) { 250 251 /* Check TLV len against overall LSA */ 252 if (sum + TLV_SIZE(tlvh) > length) { 253 if (IS_DEBUG_OSPF_GR_HELPER) ** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 585 in ospf_apiclient_handle_lsa_update() ________________________________________________________________________________________________________ *** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 585 in ospf_apiclient_handle_lsa_update() 579 __func__, lsalen, OSPF_MAX_LSA_SIZE); 580 return; 581 } 582 583 p = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 584 >>> CID 1497886: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 585 memcpy(p, &(cn->data), lsalen); 586 lsa = p; 587 588 /* Invoke registered update callback function */ 589 if (oclient->update_notify) { 590 (oclient->update_notify)(cn->ifaddr, cn->area_id, ** CID 1497885: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 1017 in show_ospf_grace_lsa_info() ________________________________________________________________________________________________________ *** CID 1497885: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 1017 in show_ospf_grace_lsa_info() 1011 } 1012 1013 length -= OSPF_LSA_HEADER_SIZE; 1014 1015 vty_out(vty, " TLV info:\n"); 1016 >>> CID 1497885: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 1017 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 1018 tlvh = TLV_HDR_NEXT(tlvh)) { 1019 /* Check TLV len */ 1020 if (sum + TLV_SIZE(tlvh) > length) { 1021 vty_out(vty, "%% Invalid TLV length: %zu\n", 1022 TLV_SIZE(tlvh)); ** CID 1497792: (USE_AFTER_FREE) /ospf6d/ospf6_interface.c: 978 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 988 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 988 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 978 in ospf6_interface_show() ________________________________________________________________________________________________________ *** CID 1497792: (USE_AFTER_FREE) /ospf6d/ospf6_interface.c: 978 in ospf6_interface_show() 972 timerstring(&res, duration, sizeof(duration)); 973 vty_out(vty, 974 " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", 975 oi->lsupdate_list->count, duration, 976 (oi->thread_send_lsupdate ? "on" : "off")); 977 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 978 vty_out(vty, " %s\n", lsa->name); 979 980 timerclear(&res); 981 if (oi->thread_send_lsack) 982 timersub(&oi->thread_send_lsack->u.sands, &now, &res); 983 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_interface.c: 988 in ospf6_interface_show() 982 timersub(&oi->thread_send_lsack->u.sands, &now, &res); 983 timerstring(&res, duration, sizeof(duration)); 984 vty_out(vty, " %d Pending LSAs for LSAck in Time %s [thread %s]\n", 985 oi->lsack_list->count, duration, 986 (oi->thread_send_lsack ? "on" : "off")); 987 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 988 vty_out(vty, " %s\n", lsa->name); 989 ospf6_bfd_show_info(vty, oi->bfd_info, 1); 990 return 0; 991 } 992 993 /* show interface */ /ospf6d/ospf6_interface.c: 988 in ospf6_interface_show() 982 timersub(&oi->thread_send_lsack->u.sands, &now, &res); 983 timerstring(&res, duration, sizeof(duration)); 984 vty_out(vty, " %d Pending LSAs for LSAck in Time %s [thread %s]\n", 985 oi->lsack_list->count, duration, 986 (oi->thread_send_lsack ? "on" : "off")); 987 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 988 vty_out(vty, " %s\n", lsa->name); 989 ospf6_bfd_show_info(vty, oi->bfd_info, 1); 990 return 0; 991 } 992 993 /* show interface */ /ospf6d/ospf6_interface.c: 978 in ospf6_interface_show() 972 timerstring(&res, duration, sizeof(duration)); 973 vty_out(vty, 974 " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", 975 oi->lsupdate_list->count, duration, 976 (oi->thread_send_lsupdate ? "on" : "off")); 977 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 978 vty_out(vty, " %s\n", lsa->name); 979 980 timerclear(&res); 981 if (oi->thread_send_lsack) 982 timersub(&oi->thread_send_lsack->u.sands, &now, &res); 983 timerstring(&res, duration, sizeof(duration)); ** CID 1497791: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 683 in ospfv3GeneralGroup() /ospf6d/ospf6_snmp.c: 683 in ospfv3GeneralGroup() ________________________________________________________________________________________________________ *** CID 1497791: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 683 in ospfv3GeneralGroup() 677 return SNMP_INTEGER(ospf6->lsdb->count); 678 return SNMP_INTEGER(0); 679 case OSPFv3ASSCOPELSACHECKSUMSUM: 680 if (ospf6) { 681 sum = 0; 682 for (ALL_LSDB(ospf6->lsdb, lsa, lsanext)) >>> CID 1497791: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 683 sum += ntohs(lsa->header->checksum); 684 return SNMP_INTEGER(sum); 685 } 686 return SNMP_INTEGER(0); 687 case OSPFv3ORIGINATENEWLSAS: 688 return SNMP_INTEGER( /ospf6d/ospf6_snmp.c: 683 in ospfv3GeneralGroup() 677 return SNMP_INTEGER(ospf6->lsdb->count); 678 return SNMP_INTEGER(0); 679 case OSPFv3ASSCOPELSACHECKSUMSUM: 680 if (ospf6) { 681 sum = 0; 682 for (ALL_LSDB(ospf6->lsdb, lsa, lsanext)) >>> CID 1497791: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 683 sum += ntohs(lsa->header->checksum); 684 return SNMP_INTEGER(sum); 685 } 686 return SNMP_INTEGER(0); 687 case OSPFv3ORIGINATENEWLSAS: 688 return SNMP_INTEGER( ** CID 1497790: (USE_AFTER_FREE) /ospf6d/ospf6_asbr.c: 997 in ospf6_asbr_send_externals_to_area() /ospf6d/ospf6_asbr.c: 997 in ospf6_asbr_send_externals_to_area() ________________________________________________________________________________________________________ *** CID 1497790: (USE_AFTER_FREE) /ospf6d/ospf6_asbr.c: 997 in ospf6_asbr_send_externals_to_area() 991 /* When an area is unstubified, flood all the external LSAs in the area */ 992 void ospf6_asbr_send_externals_to_area(struct ospf6_area *oa) 993 { 994 struct ospf6_lsa *lsa, *lsanext; 995 996 for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) { >>> CID 1497790: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 997 if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) { 998 zlog_debug("%s: Flooding AS-External LSA %s", 999 __func__, lsa->name); 1000 ospf6_flood_area(NULL, lsa, oa); 1001 } 1002 } /ospf6d/ospf6_asbr.c: 997 in ospf6_asbr_send_externals_to_area() 991 /* When an area is unstubified, flood all the external LSAs in the area */ 992 void ospf6_asbr_send_externals_to_area(struct ospf6_area *oa) 993 { 994 struct ospf6_lsa *lsa, *lsanext; 995 996 for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) { >>> CID 1497790: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 997 if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) { 998 zlog_debug("%s: Flooding AS-External LSA %s", 999 __func__, lsa->name); 1000 ospf6_flood_area(NULL, lsa, oa); 1001 } 1002 } ** CID 1497789: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 1175 in ospfv3IfEntry() /ospf6d/ospf6_snmp.c: 1175 in ospfv3IfEntry() ________________________________________________________________________________________________________ *** CID 1497789: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 1175 in ospfv3IfEntry() 1169 return SNMP_INTEGER(oi->cost); 1170 case OSPFv3IFLINKSCOPELSACOUNT: 1171 return SNMP_INTEGER(oi->lsdb->count); 1172 case OSPFv3IFLINKLSACKSUMSUM: 1173 sum = 0; 1174 for (ALL_LSDB(oi->lsdb, lsa, lsanext)) >>> CID 1497789: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1175 sum += ntohs(lsa->header->checksum); 1176 return SNMP_INTEGER(sum); 1177 case OSPFv3IFDEMANDNBRPROBE: 1178 case OSPFv3IFDEMANDNBRPROBERETRANSLIMIT: 1179 case OSPFv3IFDEMANDNBRPROBEINTERVAL: 1180 case OSPFv3IFTEDISABLED: /ospf6d/ospf6_snmp.c: 1175 in ospfv3IfEntry() 1169 return SNMP_INTEGER(oi->cost); 1170 case OSPFv3IFLINKSCOPELSACOUNT: 1171 return SNMP_INTEGER(oi->lsdb->count); 1172 case OSPFv3IFLINKLSACKSUMSUM: 1173 sum = 0; 1174 for (ALL_LSDB(oi->lsdb, lsa, lsanext)) >>> CID 1497789: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1175 sum += ntohs(lsa->header->checksum); 1176 return SNMP_INTEGER(sum); 1177 case OSPFv3IFDEMANDNBRPROBE: 1178 case OSPFv3IFDEMANDNBRPROBERETRANSLIMIT: 1179 case OSPFv3IFDEMANDNBRPROBEINTERVAL: 1180 case OSPFv3IFTEDISABLED: ** CID 1497788: (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 747 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 758 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 727 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 737 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 737 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 747 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 723 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 727 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 719 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 719 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 768 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 768 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 723 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 758 in ospf6_neighbor_show_detail() ________________________________________________________________________________________________________ *** CID 1497788: (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 747 in ospf6_neighbor_show_detail() 741 timersub(&on->thread_send_lsreq->u.sands, &now, &res); 742 timerstring(&res, duration, sizeof(duration)); 743 vty_out(vty, " %d Pending LSAs for LSReq in Time %s [thread %s]\n", 744 on->request_list->count, duration, 745 (on->thread_send_lsreq ? "on" : "off")); 746 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 747 vty_out(vty, " %s\n", lsa->name); 748 749 timerclear(&res); 750 if (on->thread_send_lsupdate) 751 timersub(&on->thread_send_lsupdate->u.sands, &now, &res); 752 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 758 in ospf6_neighbor_show_detail() 752 timerstring(&res, duration, sizeof(duration)); 753 vty_out(vty, 754 " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", 755 on->lsupdate_list->count, duration, 756 (on->thread_send_lsupdate ? "on" : "off")); 757 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 758 vty_out(vty, " %s\n", lsa->name); 759 760 timerclear(&res); 761 if (on->thread_send_lsack) 762 timersub(&on->thread_send_lsack->u.sands, &now, &res); 763 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 727 in ospf6_neighbor_show_detail() 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) 723 vty_out(vty, " %s\n", lsa->name); 724 725 vty_out(vty, " Retrans-List: %d LSAs\n", on->retrans_list->count); 726 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 727 vty_out(vty, " %s\n", lsa->name); 728 729 timerclear(&res); 730 if (on->thread_send_dbdesc) 731 timersub(&on->thread_send_dbdesc->u.sands, &now, &res); 732 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 737 in ospf6_neighbor_show_detail() 731 timersub(&on->thread_send_dbdesc->u.sands, &now, &res); 732 timerstring(&res, duration, sizeof(duration)); 733 vty_out(vty, " %d Pending LSAs for DbDesc in Time %s [thread %s]\n", 734 on->dbdesc_list->count, duration, 735 (on->thread_send_dbdesc ? "on" : "off")); 736 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 737 vty_out(vty, " %s\n", lsa->name); 738 739 timerclear(&res); 740 if (on->thread_send_lsreq) 741 timersub(&on->thread_send_lsreq->u.sands, &now, &res); 742 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 737 in ospf6_neighbor_show_detail() 731 timersub(&on->thread_send_dbdesc->u.sands, &now, &res); 732 timerstring(&res, duration, sizeof(duration)); 733 vty_out(vty, " %d Pending LSAs for DbDesc in Time %s [thread %s]\n", 734 on->dbdesc_list->count, duration, 735 (on->thread_send_dbdesc ? "on" : "off")); 736 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 737 vty_out(vty, " %s\n", lsa->name); 738 739 timerclear(&res); 740 if (on->thread_send_lsreq) 741 timersub(&on->thread_send_lsreq->u.sands, &now, &res); 742 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 747 in ospf6_neighbor_show_detail() 741 timersub(&on->thread_send_lsreq->u.sands, &now, &res); 742 timerstring(&res, duration, sizeof(duration)); 743 vty_out(vty, " %d Pending LSAs for LSReq in Time %s [thread %s]\n", 744 on->request_list->count, duration, 745 (on->thread_send_lsreq ? "on" : "off")); 746 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 747 vty_out(vty, " %s\n", lsa->name); 748 749 timerclear(&res); 750 if (on->thread_send_lsupdate) 751 timersub(&on->thread_send_lsupdate->u.sands, &now, &res); 752 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 723 in ospf6_neighbor_show_detail() 717 vty_out(vty, " Summary-List: %d LSAs\n", on->summary_list->count); 718 for (ALL_LSDB(on->summary_list, lsa, lsanext)) 719 vty_out(vty, " %s\n", lsa->name); 720 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 723 vty_out(vty, " %s\n", lsa->name); 724 725 vty_out(vty, " Retrans-List: %d LSAs\n", on->retrans_list->count); 726 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) 727 vty_out(vty, " %s\n", lsa->name); 728 /ospf6d/ospf6_neighbor.c: 727 in ospf6_neighbor_show_detail() 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) 723 vty_out(vty, " %s\n", lsa->name); 724 725 vty_out(vty, " Retrans-List: %d LSAs\n", on->retrans_list->count); 726 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 727 vty_out(vty, " %s\n", lsa->name); 728 729 timerclear(&res); 730 if (on->thread_send_dbdesc) 731 timersub(&on->thread_send_dbdesc->u.sands, &now, &res); 732 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 719 in ospf6_neighbor_show_detail() 713 (CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT) ? "Master" 714 : "Slave"), 715 (unsigned long)ntohl(on->dbdesc_seqnum)); 716 717 vty_out(vty, " Summary-List: %d LSAs\n", on->summary_list->count); 718 for (ALL_LSDB(on->summary_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 719 vty_out(vty, " %s\n", lsa->name); 720 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) 723 vty_out(vty, " %s\n", lsa->name); 724 /ospf6d/ospf6_neighbor.c: 719 in ospf6_neighbor_show_detail() 713 (CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT) ? "Master" 714 : "Slave"), 715 (unsigned long)ntohl(on->dbdesc_seqnum)); 716 717 vty_out(vty, " Summary-List: %d LSAs\n", on->summary_list->count); 718 for (ALL_LSDB(on->summary_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 719 vty_out(vty, " %s\n", lsa->name); 720 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) 723 vty_out(vty, " %s\n", lsa->name); 724 /ospf6d/ospf6_neighbor.c: 768 in ospf6_neighbor_show_detail() 762 timersub(&on->thread_send_lsack->u.sands, &now, &res); 763 timerstring(&res, duration, sizeof(duration)); 764 vty_out(vty, " %d Pending LSAs for LSAck in Time %s [thread %s]\n", 765 on->lsack_list->count, duration, 766 (on->thread_send_lsack ? "on" : "off")); 767 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 768 vty_out(vty, " %s\n", lsa->name); 769 770 ospf6_bfd_show_info(vty, on->bfd_info, 0); 771 } 772 773 DEFUN (show_ipv6_ospf6_neighbor, /ospf6d/ospf6_neighbor.c: 768 in ospf6_neighbor_show_detail() 762 timersub(&on->thread_send_lsack->u.sands, &now, &res); 763 timerstring(&res, duration, sizeof(duration)); 764 vty_out(vty, " %d Pending LSAs for LSAck in Time %s [thread %s]\n", 765 on->lsack_list->count, duration, 766 (on->thread_send_lsack ? "on" : "off")); 767 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 768 vty_out(vty, " %s\n", lsa->name); 769 770 ospf6_bfd_show_info(vty, on->bfd_info, 0); 771 } 772 773 DEFUN (show_ipv6_ospf6_neighbor, /ospf6d/ospf6_neighbor.c: 723 in ospf6_neighbor_show_detail() 717 vty_out(vty, " Summary-List: %d LSAs\n", on->summary_list->count); 718 for (ALL_LSDB(on->summary_list, lsa, lsanext)) 719 vty_out(vty, " %s\n", lsa->name); 720 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 723 vty_out(vty, " %s\n", lsa->name); 724 725 vty_out(vty, " Retrans-List: %d LSAs\n", on->retrans_list->count); 726 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) 727 vty_out(vty, " %s\n", lsa->name); 728 /ospf6d/ospf6_neighbor.c: 758 in ospf6_neighbor_show_detail() 752 timerstring(&res, duration, sizeof(duration)); 753 vty_out(vty, 754 " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", 755 on->lsupdate_list->count, duration, 756 (on->thread_send_lsupdate ? "on" : "off")); 757 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 758 vty_out(vty, " %s\n", lsa->name); 759 760 timerclear(&res); 761 if (on->thread_send_lsack) 762 timersub(&on->thread_send_lsack->u.sands, &now, &res); 763 timerstring(&res, duration, sizeof(duration)); ** CID 1497787: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() ________________________________________________________________________________________________________ *** CID 1497787: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() 1941 > ospf6_packet_max(on->ospf6_if)) { 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; >>> CID 1497787: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1947 e->type = lsa->header->type; 1948 e->id = lsa->header->id; 1949 e->adv_router = lsa->header->adv_router; 1950 p += sizeof(struct ospf6_lsreq_entry); 1951 last_req = lsa; 1952 } /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() 1941 > ospf6_packet_max(on->ospf6_if)) { 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; >>> CID 1497787: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1947 e->type = lsa->header->type; 1948 e->id = lsa->header->id; 1949 e->adv_router = lsa->header->adv_router; 1950 p += sizeof(struct ospf6_lsreq_entry); 1951 last_req = lsa; 1952 } /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() 1936 /* set Request entries in lsreq */ 1937 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 1938 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 1939 /* MTU check */ 1940 if (p - sendbuf + sizeof(struct ospf6_lsreq_entry) 1941 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1497787: (USE_AFTER_FREE) >>> Passing freed pointer "lsa" as an argument to "ospf6_lsdb_lsa_unlock". 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; 1947 e->type = lsa->header->type; /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() 1936 /* set Request entries in lsreq */ 1937 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 1938 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 1939 /* MTU check */ 1940 if (p - sendbuf + sizeof(struct ospf6_lsreq_entry) 1941 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1497787: (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_lsa_unlock" frees pointer "lsa" which has already been freed. 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; 1947 e->type = lsa->header->type; /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() 1936 /* set Request entries in lsreq */ 1937 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 1938 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 1939 /* MTU check */ 1940 if (p - sendbuf + sizeof(struct ospf6_lsreq_entry) 1941 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1497787: (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_lsa_unlock" frees pointer "lsa" which has already been freed. 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; 1947 e->type = lsa->header->type; ** CID 1497786: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1497786: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1837 in ospf6_dbdesc_send() 1831 dbdesc->seqnum = htonl(on->dbdesc_seqnum); 1832 1833 /* if this is not initial one, set LSA headers in dbdesc */ 1834 p = (uint8_t *)((caddr_t)dbdesc + sizeof(struct ospf6_dbdesc)); 1835 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 1836 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1497786: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 1837 ospf6_lsa_age_update_to_send(lsa, 1838 on->ospf6_if->transdelay); 1839 1840 /* MTU check */ 1841 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 1842 > ospf6_packet_max(on->ospf6_if)) { /ospf6d/ospf6_message.c: 1837 in ospf6_dbdesc_send() 1831 dbdesc->seqnum = htonl(on->dbdesc_seqnum); 1832 1833 /* if this is not initial one, set LSA headers in dbdesc */ 1834 p = (uint8_t *)((caddr_t)dbdesc + sizeof(struct ospf6_dbdesc)); 1835 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 1836 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1497786: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 1837 ospf6_lsa_age_update_to_send(lsa, 1838 on->ospf6_if->transdelay); 1839 1840 /* MTU check */ 1841 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 1842 > ospf6_packet_max(on->ospf6_if)) { ** CID 1496729: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 268 in ecommunity_dup() ________________________________________________________________________________________________________ *** CID 1496729: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 268 in ecommunity_dup() 262 struct ecommunity *new; 263 264 new = XCALLOC(MTYPE_ECOMMUNITY, sizeof(struct ecommunity)); 265 new->size = ecom->size; 266 new->unit_size = ecom->unit_size; 267 if (new->size) { >>> CID 1496729: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 268 new->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 269 ecom->size * ecom->unit_size); 270 memcpy(new->val, ecom->val, 271 (size_t)ecom->size * (size_t)ecom->unit_size); 272 } else 273 new->val = NULL; ** CID 1496726: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1235 in ecommunity_strip() ________________________________________________________________________________________________________ *** CID 1496726: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1235 in ecommunity_strip() 1229 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); 1230 ecom->size = 0; 1231 return true; 1232 } 1233 1234 /* Strip matching ext community(ies). */ >>> CID 1496726: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - found) * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - found) * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1235 new = XMALLOC(MTYPE_ECOMMUNITY_VAL, 1236 (ecom->size - found) * ecom->unit_size); 1237 q = new; 1238 for (c = 0, p = ecom->val; c < ecom->size; c++, p += ecom->unit_size) { 1239 if (!(p[0] == type && p[1] == subtype)) { 1240 memcpy(q, p, ecom->unit_size); ** CID 1496724: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1280 in ecommunity_del_val() /bgpd/bgp_ecommunity.c: 1276 in ecommunity_del_val() /bgpd/bgp_ecommunity.c: 1274 in ecommunity_del_val() ________________________________________________________________________________________________________ *** CID 1496724: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1280 in ecommunity_del_val() 1274 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1275 if (c != 0) 1276 memcpy(p, ecom->val, c * ecom->unit_size); 1277 if ((ecom->size - c) != 0) 1278 memcpy(p + (c)*ecom->unit_size, 1279 ecom->val + (c + 1) * ecom->unit_size, >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - c) * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - c) * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1280 (ecom->size - c) * ecom->unit_size); 1281 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); 1282 ecom->val = p; 1283 return true; 1284 } 1285 /bgpd/bgp_ecommunity.c: 1276 in ecommunity_del_val() 1270 return false; 1271 1272 /* Delete the selected value */ 1273 ecom->size--; 1274 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1275 if (c != 0) >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "c * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "c * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1276 memcpy(p, ecom->val, c * ecom->unit_size); 1277 if ((ecom->size - c) != 0) 1278 memcpy(p + (c)*ecom->unit_size, 1279 ecom->val + (c + 1) * ecom->unit_size, 1280 (ecom->size - c) * ecom->unit_size); 1281 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); /bgpd/bgp_ecommunity.c: 1274 in ecommunity_del_val() 1268 } 1269 if (found == 0) 1270 return false; 1271 1272 /* Delete the selected value */ 1273 ecom->size--; >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1274 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1275 if (c != 0) 1276 memcpy(p, ecom->val, c * ecom->unit_size); 1277 if ((ecom->size - c) != 0) 1278 memcpy(p + (c)*ecom->unit_size, 1279 ecom->val + (c + 1) * ecom->unit_size, ** CID 1496723: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 164 in ecommunity_add_val_internal() /bgpd/bgp_ecommunity.c: 106 in ecommunity_add_val_internal() /bgpd/bgp_ecommunity.c: 158 in ecommunity_add_val_internal() ________________________________________________________________________________________________________ *** CID 1496723: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 164 in ecommunity_add_val_internal() 158 ecom->val = XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom->val, 159 ecom_length_size(ecom, ecom_size)); 160 161 162 memmove(ecom->val + ((ins_idx + 1) * ecom_size), 163 ecom->val + (ins_idx * ecom_size), >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - 1 - ins_idx) * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - 1 - ins_idx) * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 164 (ecom->size - 1 - ins_idx) * ecom_size); 165 memcpy(ecom->val + (ins_idx * ecom_size), 166 eval, ecom_size); 167 168 return true; 169 } /bgpd/bgp_ecommunity.c: 106 in ecommunity_add_val_internal() 100 const struct ecommunity_val_ipv6 *eval6 = 101 (struct ecommunity_val_ipv6 *)eval; 102 103 /* When this is fist value, just add it. */ 104 if (ecom->val == NULL) { 105 ecom->size = 1; >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 106 ecom->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 107 ecom_length_size(ecom, ecom_size)); 108 memcpy(ecom->val, eval, ecom_size); 109 return true; 110 } 111 /bgpd/bgp_ecommunity.c: 158 in ecommunity_add_val_internal() 152 153 if (ins_idx == -1) 154 ins_idx = c; 155 156 /* Add the value to the structure with numerical sorting. */ 157 ecom->size++; >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 158 ecom->val = XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom->val, 159 ecom_length_size(ecom, ecom_size)); 160 161 162 memmove(ecom->val + ((ins_idx + 1) * ecom_size), 163 ecom->val + (ins_idx * ecom_size), ** CID 1496721: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 368 in ecommunity_cmp() ________________________________________________________________________________________________________ *** CID 1496721: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 368 in ecommunity_cmp() 362 return false; 363 364 if (ecom1->unit_size != ecom2->unit_size) 365 return false; 366 367 return (ecom1->size == ecom2->size >>> CID 1496721: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t const" (8 bits, unsigned) is promoted in "ecom1->size * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom1->size * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 368 && memcmp(ecom1->val, ecom2->val, ecom1->size * 369 ecom1->unit_size) == 0); 370 } 371 372 /* Initialize Extended Comminities related hash. */ 373 void ecommunity_init(void) ** CID 1496618: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496618: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_evpn_mh.c: 919 in bgp_evpn_type1_route_update() 913 attr_new = pi->attr; 914 915 /* Perform route selection; 916 * this is just to set the flags correctly as local route in 917 * the ES always wins. 918 */ >>> CID 1496618: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "vpn" to "evpn_route_select_install", which dereferences it. 919 evpn_route_select_install(bgp, vpn, dest); 920 bgp_dest_unlock_node(dest); 921 922 /* If this is a new route or some attribute has changed, export the 923 * route to the global table. The route will be advertised to peers 924 * from there. Note that this table is a 2-level tree (RD-level + ** CID 1496614: Error handling issues (CHECKED_RETURN) /bgpd/bgp_evpn_mh.c: 1452 in bgp_evpn_local_es_up() ________________________________________________________________________________________________________ *** CID 1496614: Error handling issues (CHECKED_RETURN) /bgpd/bgp_evpn_mh.c: 1452 in bgp_evpn_local_es_up() 1446 /* generate EAD-EVI */ 1447 bgp_evpn_local_type1_evi_route_add(bgp, es); 1448 1449 /* generate EAD-ES */ 1450 build_evpn_type1_prefix(&p, BGP_EVPN_AD_ES_ETH_TAG, 1451 &es->esi, es->originator_ip); >>> CID 1496614: Error handling issues (CHECKED_RETURN) >>> Calling "bgp_evpn_type1_route_update" without checking return value (as is done elsewhere 4 out of 5 times). 1452 bgp_evpn_type1_route_update(bgp, es, NULL, &p); 1453 } 1454 1455 static void bgp_evpn_local_es_do_del(struct bgp *bgp, struct bgp_evpn_es *es) 1456 { 1457 struct bgp_evpn_es_evi *es_evi; ** CID 1487305: Memory - corruptions (ARRAY_VS_SINGLETON) /lib/prefix.c: 265 in evpn_type5_prefix_match() ________________________________________________________________________________________________________ *** CID 1487305: Memory - corruptions (ARRAY_VS_SINGLETON) /lib/prefix.c: 265 in evpn_type5_prefix_match() 259 return 0; 260 261 offset = prefixlen / PNBBY; 262 shift = prefixlen % PNBBY; 263 264 if (shift) >>> CID 1487305: Memory - corruptions (ARRAY_VS_SINGLETON) >>> Using "np" as an array. This might corrupt or misinterpret adjacent memory locations. 265 if (maskbit[shift] & (np[offset] ^ pp[offset])) 266 return 0; 267 268 while (offset--) 269 if (np[offset] != pp[offset]) 270 return 0; ** CID 1486267: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486267: (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 486 in seqnumber_mismatch() 480 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 481 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 482 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 483 484 ospf6_lsdb_remove_all(on->summary_list); 485 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486267: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 486 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { 487 ospf6_decrement_retrans_count(lsa); 488 ospf6_lsdb_remove(lsa, on->retrans_list); 489 } 490 491 THREAD_OFF(on->thread_send_dbdesc); /ospf6d/ospf6_neighbor.c: 487 in seqnumber_mismatch() 481 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 482 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 483 484 ospf6_lsdb_remove_all(on->summary_list); 485 ospf6_lsdb_remove_all(on->request_list); 486 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { >>> CID 1486267: (USE_AFTER_FREE) >>> Calling "ospf6_decrement_retrans_count" dereferences freed pointer "lsa". 487 ospf6_decrement_retrans_count(lsa); 488 ospf6_lsdb_remove(lsa, on->retrans_list); 489 } 490 491 THREAD_OFF(on->thread_send_dbdesc); 492 on->dbdesc_seqnum++; /* Incr seqnum as per RFC2328, sec 10.3 */ /ospf6d/ospf6_neighbor.c: 487 in seqnumber_mismatch() 481 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 482 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 483 484 ospf6_lsdb_remove_all(on->summary_list); 485 ospf6_lsdb_remove_all(on->request_list); 486 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { >>> CID 1486267: (USE_AFTER_FREE) >>> Calling "ospf6_decrement_retrans_count" dereferences freed pointer "lsa". 487 ospf6_decrement_retrans_count(lsa); 488 ospf6_lsdb_remove(lsa, on->retrans_list); 489 } 490 491 THREAD_OFF(on->thread_send_dbdesc); 492 on->dbdesc_seqnum++; /* Incr seqnum as per RFC2328, sec 10.3 */ /ospf6d/ospf6_neighbor.c: 486 in seqnumber_mismatch() 480 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 481 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 482 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 483 484 ospf6_lsdb_remove_all(on->summary_list); 485 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486267: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_unlock" dereferences freed pointer "lsa". 486 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) { 487 ospf6_decrement_retrans_count(lsa); 488 ospf6_lsdb_remove(lsa, on->retrans_list); 489 } 490 491 THREAD_OFF(on->thread_send_dbdesc); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Results of the 2020 TSC Vote
by Alistair Woodman 27 Oct '20

27 Oct '20

All, 21 or 23 maintainers have voted in the TSC Election for the 2019-2020 session. By the single transferable vote algorithm, the following candidates are elected to the TSC. (in alphabetical, not ranked order) . Lou Berger . Donald Sharp . Mark Stapp . Russ White . Martin Winter . Quentin Young Your elections officer /a

1 0