- dev - lists.frrouting.org

Help: Is Supporting BGP-LS on Roadmap?
by 高燕翔 16 Oct '20

16 Oct '20

2 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 13 Oct '20

13 Oct '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 615 in ospf_apiclient_handle_lsa_delete() ________________________________________________________________________________________________________ *** CID 1497888: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 615 in ospf_apiclient_handle_lsa_delete() 609 "%s: message received size: %d is greater than a LSA size: %d", 610 __func__, lsalen, OSPF_MAX_LSA_SIZE); 611 return; 612 } 613 lsa = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 614 >>> CID 1497888: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 615 memcpy(lsa, &(cn->data), lsalen); 616 617 /* Invoke registered update callback function */ 618 if (oclient->delete_notify) { 619 (oclient->delete_notify)(cn->ifaddr, cn->area_id, 620 cn->is_self_originated, lsa); ** CID 1497887: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 205 in ospf_extract_grace_lsa_fields() ________________________________________________________________________________________________________ *** CID 1497887: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 205 in ospf_extract_grace_lsa_fields() 199 int sum = 0; 200 201 lsah = (struct lsa_header *)lsa->data; 202 203 length = ntohs(lsah->length) - OSPF_LSA_HEADER_SIZE; 204 >>> CID 1497887: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 205 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 206 tlvh = TLV_HDR_NEXT(tlvh)) { 207 switch (ntohs(tlvh->type)) { 208 case GRACE_PERIOD_TYPE: 209 grace_period = (struct grace_tlv_graceperiod *)tlvh; 210 *interval = ntohl(grace_period->interval); ** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 583 in ospf_apiclient_handle_lsa_update() ________________________________________________________________________________________________________ *** CID 1497886: Memory - corruptions (OVERRUN) /ospfclient/ospf_apiclient.c: 583 in ospf_apiclient_handle_lsa_update() 577 "%s: message received size: %d is greater than a LSA size: %d", 578 __func__, lsalen, OSPF_MAX_LSA_SIZE); 579 return; 580 } 581 lsa = XMALLOC(MTYPE_OSPF_APICLIENT, lsalen); 582 >>> CID 1497886: Memory - corruptions (OVERRUN) >>> Overrunning struct type lsa_header of 20 bytes by passing it to a function which accesses it at byte offset 1499 using argument "lsalen" (which evaluates to 1500). 583 memcpy(lsa, &(cn->data), lsalen); 584 585 /* Invoke registered update callback function */ 586 if (oclient->update_notify) { 587 (oclient->update_notify)(cn->ifaddr, cn->area_id, 588 cn->is_self_originated, lsa); ** CID 1497885: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 936 in show_ospf_grace_lsa_info() ________________________________________________________________________________________________________ *** CID 1497885: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_gr_helper.c: 936 in show_ospf_grace_lsa_info() 930 lsah = (struct lsa_header *)lsa->data; 931 932 length = ntohs(lsah->length) - OSPF_LSA_HEADER_SIZE; 933 934 vty_out(vty, " TLV info:\n"); 935 >>> CID 1497885: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "length" as a loop boundary. 936 for (tlvh = TLV_HDR_TOP(lsah); sum < length; 937 tlvh = TLV_HDR_NEXT(tlvh)) { 938 switch (ntohs(tlvh->type)) { 939 case GRACE_PERIOD_TYPE: 940 gracePeriod = (struct grace_tlv_graceperiod *)tlvh; 941 sum += TLV_SIZE(tlvh); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 12 Oct '20

12 Oct '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 7 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 7 of 7 defect(s) ** CID 1497792: (USE_AFTER_FREE) /ospf6d/ospf6_interface.c: 991 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 981 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 991 in ospf6_interface_show() /ospf6d/ospf6_interface.c: 981 in ospf6_interface_show() ________________________________________________________________________________________________________ *** CID 1497792: (USE_AFTER_FREE) /ospf6d/ospf6_interface.c: 991 in ospf6_interface_show() 985 timersub(&oi->thread_send_lsack->u.sands, &now, &res); 986 timerstring(&res, duration, sizeof(duration)); 987 vty_out(vty, " %d Pending LSAs for LSAck in Time %s [thread %s]\n", 988 oi->lsack_list->count, duration, 989 (oi->thread_send_lsack ? "on" : "off")); 990 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 991 vty_out(vty, " %s\n", lsa->name); 992 ospf6_bfd_show_info(vty, oi->bfd_info, 1); 993 return 0; 994 } 995 996 /* show interface */ /ospf6d/ospf6_interface.c: 981 in ospf6_interface_show() 975 timerstring(&res, duration, sizeof(duration)); 976 vty_out(vty, 977 " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", 978 oi->lsupdate_list->count, duration, 979 (oi->thread_send_lsupdate ? "on" : "off")); 980 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 981 vty_out(vty, " %s\n", lsa->name); 982 983 timerclear(&res); 984 if (oi->thread_send_lsack) 985 timersub(&oi->thread_send_lsack->u.sands, &now, &res); 986 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_interface.c: 991 in ospf6_interface_show() 985 timersub(&oi->thread_send_lsack->u.sands, &now, &res); 986 timerstring(&res, duration, sizeof(duration)); 987 vty_out(vty, " %d Pending LSAs for LSAck in Time %s [thread %s]\n", 988 oi->lsack_list->count, duration, 989 (oi->thread_send_lsack ? "on" : "off")); 990 for (ALL_LSDB(oi->lsack_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 991 vty_out(vty, " %s\n", lsa->name); 992 ospf6_bfd_show_info(vty, oi->bfd_info, 1); 993 return 0; 994 } 995 996 /* show interface */ /ospf6d/ospf6_interface.c: 981 in ospf6_interface_show() 975 timerstring(&res, duration, sizeof(duration)); 976 vty_out(vty, 977 " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", 978 oi->lsupdate_list->count, duration, 979 (oi->thread_send_lsupdate ? "on" : "off")); 980 for (ALL_LSDB(oi->lsupdate_list, lsa, lsanext)) >>> CID 1497792: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 981 vty_out(vty, " %s\n", lsa->name); 982 983 timerclear(&res); 984 if (oi->thread_send_lsack) 985 timersub(&oi->thread_send_lsack->u.sands, &now, &res); 986 timerstring(&res, duration, sizeof(duration)); ** CID 1497791: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 683 in ospfv3GeneralGroup() /ospf6d/ospf6_snmp.c: 683 in ospfv3GeneralGroup() ________________________________________________________________________________________________________ *** CID 1497791: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 683 in ospfv3GeneralGroup() 677 return SNMP_INTEGER(ospf6->lsdb->count); 678 return SNMP_INTEGER(0); 679 case OSPFv3ASSCOPELSACHECKSUMSUM: 680 if (ospf6) { 681 sum = 0; 682 for (ALL_LSDB(ospf6->lsdb, lsa, lsanext)) >>> CID 1497791: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 683 sum += ntohs(lsa->header->checksum); 684 return SNMP_INTEGER(sum); 685 } 686 return SNMP_INTEGER(0); 687 case OSPFv3ORIGINATENEWLSAS: 688 return SNMP_INTEGER( /ospf6d/ospf6_snmp.c: 683 in ospfv3GeneralGroup() 677 return SNMP_INTEGER(ospf6->lsdb->count); 678 return SNMP_INTEGER(0); 679 case OSPFv3ASSCOPELSACHECKSUMSUM: 680 if (ospf6) { 681 sum = 0; 682 for (ALL_LSDB(ospf6->lsdb, lsa, lsanext)) >>> CID 1497791: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 683 sum += ntohs(lsa->header->checksum); 684 return SNMP_INTEGER(sum); 685 } 686 return SNMP_INTEGER(0); 687 case OSPFv3ORIGINATENEWLSAS: 688 return SNMP_INTEGER( ** CID 1497790: (USE_AFTER_FREE) /ospf6d/ospf6_asbr.c: 1012 in ospf6_asbr_send_externals_to_area() /ospf6d/ospf6_asbr.c: 1012 in ospf6_asbr_send_externals_to_area() ________________________________________________________________________________________________________ *** CID 1497790: (USE_AFTER_FREE) /ospf6d/ospf6_asbr.c: 1012 in ospf6_asbr_send_externals_to_area() 1006 /* When an area is unstubified, flood all the external LSAs in the area */ 1007 void ospf6_asbr_send_externals_to_area(struct ospf6_area *oa) 1008 { 1009 struct ospf6_lsa *lsa, *lsanext; 1010 1011 for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) { >>> CID 1497790: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1012 if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) { 1013 zlog_debug("%s: Flooding AS-External LSA %s", 1014 __func__, lsa->name); 1015 ospf6_flood_area(NULL, lsa, oa); 1016 } 1017 } /ospf6d/ospf6_asbr.c: 1012 in ospf6_asbr_send_externals_to_area() 1006 /* When an area is unstubified, flood all the external LSAs in the area */ 1007 void ospf6_asbr_send_externals_to_area(struct ospf6_area *oa) 1008 { 1009 struct ospf6_lsa *lsa, *lsanext; 1010 1011 for (ALL_LSDB(oa->ospf6->lsdb, lsa, lsanext)) { >>> CID 1497790: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1012 if (ntohs(lsa->header->type) == OSPF6_LSTYPE_AS_EXTERNAL) { 1013 zlog_debug("%s: Flooding AS-External LSA %s", 1014 __func__, lsa->name); 1015 ospf6_flood_area(NULL, lsa, oa); 1016 } 1017 } ** CID 1497789: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 1175 in ospfv3IfEntry() /ospf6d/ospf6_snmp.c: 1175 in ospfv3IfEntry() ________________________________________________________________________________________________________ *** CID 1497789: (USE_AFTER_FREE) /ospf6d/ospf6_snmp.c: 1175 in ospfv3IfEntry() 1169 return SNMP_INTEGER(oi->cost); 1170 case OSPFv3IFLINKSCOPELSACOUNT: 1171 return SNMP_INTEGER(oi->lsdb->count); 1172 case OSPFv3IFLINKLSACKSUMSUM: 1173 sum = 0; 1174 for (ALL_LSDB(oi->lsdb, lsa, lsanext)) >>> CID 1497789: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1175 sum += ntohs(lsa->header->checksum); 1176 return SNMP_INTEGER(sum); 1177 case OSPFv3IFDEMANDNBRPROBE: 1178 case OSPFv3IFDEMANDNBRPROBERETRANSLIMIT: 1179 case OSPFv3IFDEMANDNBRPROBEINTERVAL: 1180 case OSPFv3IFTEDISABLED: /ospf6d/ospf6_snmp.c: 1175 in ospfv3IfEntry() 1169 return SNMP_INTEGER(oi->cost); 1170 case OSPFv3IFLINKSCOPELSACOUNT: 1171 return SNMP_INTEGER(oi->lsdb->count); 1172 case OSPFv3IFLINKLSACKSUMSUM: 1173 sum = 0; 1174 for (ALL_LSDB(oi->lsdb, lsa, lsanext)) >>> CID 1497789: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1175 sum += ntohs(lsa->header->checksum); 1176 return SNMP_INTEGER(sum); 1177 case OSPFv3IFDEMANDNBRPROBE: 1178 case OSPFv3IFDEMANDNBRPROBERETRANSLIMIT: 1179 case OSPFv3IFDEMANDNBRPROBEINTERVAL: 1180 case OSPFv3IFTEDISABLED: ** CID 1497788: (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 768 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 758 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 737 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 719 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 723 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 758 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 768 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 727 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 719 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 737 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 747 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 727 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 723 in ospf6_neighbor_show_detail() /ospf6d/ospf6_neighbor.c: 747 in ospf6_neighbor_show_detail() ________________________________________________________________________________________________________ *** CID 1497788: (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 768 in ospf6_neighbor_show_detail() 762 timersub(&on->thread_send_lsack->u.sands, &now, &res); 763 timerstring(&res, duration, sizeof(duration)); 764 vty_out(vty, " %d Pending LSAs for LSAck in Time %s [thread %s]\n", 765 on->lsack_list->count, duration, 766 (on->thread_send_lsack ? "on" : "off")); 767 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 768 vty_out(vty, " %s\n", lsa->name); 769 770 ospf6_bfd_show_info(vty, on->bfd_info, 0); 771 } 772 773 DEFUN (show_ipv6_ospf6_neighbor, /ospf6d/ospf6_neighbor.c: 758 in ospf6_neighbor_show_detail() 752 timerstring(&res, duration, sizeof(duration)); 753 vty_out(vty, 754 " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", 755 on->lsupdate_list->count, duration, 756 (on->thread_send_lsupdate ? "on" : "off")); 757 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 758 vty_out(vty, " %s\n", lsa->name); 759 760 timerclear(&res); 761 if (on->thread_send_lsack) 762 timersub(&on->thread_send_lsack->u.sands, &now, &res); 763 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 737 in ospf6_neighbor_show_detail() 731 timersub(&on->thread_send_dbdesc->u.sands, &now, &res); 732 timerstring(&res, duration, sizeof(duration)); 733 vty_out(vty, " %d Pending LSAs for DbDesc in Time %s [thread %s]\n", 734 on->dbdesc_list->count, duration, 735 (on->thread_send_dbdesc ? "on" : "off")); 736 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 737 vty_out(vty, " %s\n", lsa->name); 738 739 timerclear(&res); 740 if (on->thread_send_lsreq) 741 timersub(&on->thread_send_lsreq->u.sands, &now, &res); 742 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 719 in ospf6_neighbor_show_detail() 713 (CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT) ? "Master" 714 : "Slave"), 715 (unsigned long)ntohl(on->dbdesc_seqnum)); 716 717 vty_out(vty, " Summary-List: %d LSAs\n", on->summary_list->count); 718 for (ALL_LSDB(on->summary_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 719 vty_out(vty, " %s\n", lsa->name); 720 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) 723 vty_out(vty, " %s\n", lsa->name); 724 /ospf6d/ospf6_neighbor.c: 723 in ospf6_neighbor_show_detail() 717 vty_out(vty, " Summary-List: %d LSAs\n", on->summary_list->count); 718 for (ALL_LSDB(on->summary_list, lsa, lsanext)) 719 vty_out(vty, " %s\n", lsa->name); 720 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 723 vty_out(vty, " %s\n", lsa->name); 724 725 vty_out(vty, " Retrans-List: %d LSAs\n", on->retrans_list->count); 726 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) 727 vty_out(vty, " %s\n", lsa->name); 728 /ospf6d/ospf6_neighbor.c: 758 in ospf6_neighbor_show_detail() 752 timerstring(&res, duration, sizeof(duration)); 753 vty_out(vty, 754 " %d Pending LSAs for LSUpdate in Time %s [thread %s]\n", 755 on->lsupdate_list->count, duration, 756 (on->thread_send_lsupdate ? "on" : "off")); 757 for (ALL_LSDB(on->lsupdate_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 758 vty_out(vty, " %s\n", lsa->name); 759 760 timerclear(&res); 761 if (on->thread_send_lsack) 762 timersub(&on->thread_send_lsack->u.sands, &now, &res); 763 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 768 in ospf6_neighbor_show_detail() 762 timersub(&on->thread_send_lsack->u.sands, &now, &res); 763 timerstring(&res, duration, sizeof(duration)); 764 vty_out(vty, " %d Pending LSAs for LSAck in Time %s [thread %s]\n", 765 on->lsack_list->count, duration, 766 (on->thread_send_lsack ? "on" : "off")); 767 for (ALL_LSDB(on->lsack_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 768 vty_out(vty, " %s\n", lsa->name); 769 770 ospf6_bfd_show_info(vty, on->bfd_info, 0); 771 } 772 773 DEFUN (show_ipv6_ospf6_neighbor, /ospf6d/ospf6_neighbor.c: 727 in ospf6_neighbor_show_detail() 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) 723 vty_out(vty, " %s\n", lsa->name); 724 725 vty_out(vty, " Retrans-List: %d LSAs\n", on->retrans_list->count); 726 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 727 vty_out(vty, " %s\n", lsa->name); 728 729 timerclear(&res); 730 if (on->thread_send_dbdesc) 731 timersub(&on->thread_send_dbdesc->u.sands, &now, &res); 732 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 719 in ospf6_neighbor_show_detail() 713 (CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT) ? "Master" 714 : "Slave"), 715 (unsigned long)ntohl(on->dbdesc_seqnum)); 716 717 vty_out(vty, " Summary-List: %d LSAs\n", on->summary_list->count); 718 for (ALL_LSDB(on->summary_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 719 vty_out(vty, " %s\n", lsa->name); 720 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) 723 vty_out(vty, " %s\n", lsa->name); 724 /ospf6d/ospf6_neighbor.c: 737 in ospf6_neighbor_show_detail() 731 timersub(&on->thread_send_dbdesc->u.sands, &now, &res); 732 timerstring(&res, duration, sizeof(duration)); 733 vty_out(vty, " %d Pending LSAs for DbDesc in Time %s [thread %s]\n", 734 on->dbdesc_list->count, duration, 735 (on->thread_send_dbdesc ? "on" : "off")); 736 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 737 vty_out(vty, " %s\n", lsa->name); 738 739 timerclear(&res); 740 if (on->thread_send_lsreq) 741 timersub(&on->thread_send_lsreq->u.sands, &now, &res); 742 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 747 in ospf6_neighbor_show_detail() 741 timersub(&on->thread_send_lsreq->u.sands, &now, &res); 742 timerstring(&res, duration, sizeof(duration)); 743 vty_out(vty, " %d Pending LSAs for LSReq in Time %s [thread %s]\n", 744 on->request_list->count, duration, 745 (on->thread_send_lsreq ? "on" : "off")); 746 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 747 vty_out(vty, " %s\n", lsa->name); 748 749 timerclear(&res); 750 if (on->thread_send_lsupdate) 751 timersub(&on->thread_send_lsupdate->u.sands, &now, &res); 752 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 727 in ospf6_neighbor_show_detail() 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) 723 vty_out(vty, " %s\n", lsa->name); 724 725 vty_out(vty, " Retrans-List: %d LSAs\n", on->retrans_list->count); 726 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 727 vty_out(vty, " %s\n", lsa->name); 728 729 timerclear(&res); 730 if (on->thread_send_dbdesc) 731 timersub(&on->thread_send_dbdesc->u.sands, &now, &res); 732 timerstring(&res, duration, sizeof(duration)); /ospf6d/ospf6_neighbor.c: 723 in ospf6_neighbor_show_detail() 717 vty_out(vty, " Summary-List: %d LSAs\n", on->summary_list->count); 718 for (ALL_LSDB(on->summary_list, lsa, lsanext)) 719 vty_out(vty, " %s\n", lsa->name); 720 721 vty_out(vty, " Request-List: %d LSAs\n", on->request_list->count); 722 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 723 vty_out(vty, " %s\n", lsa->name); 724 725 vty_out(vty, " Retrans-List: %d LSAs\n", on->retrans_list->count); 726 for (ALL_LSDB(on->retrans_list, lsa, lsanext)) 727 vty_out(vty, " %s\n", lsa->name); 728 /ospf6d/ospf6_neighbor.c: 747 in ospf6_neighbor_show_detail() 741 timersub(&on->thread_send_lsreq->u.sands, &now, &res); 742 timerstring(&res, duration, sizeof(duration)); 743 vty_out(vty, " %d Pending LSAs for LSReq in Time %s [thread %s]\n", 744 on->request_list->count, duration, 745 (on->thread_send_lsreq ? "on" : "off")); 746 for (ALL_LSDB(on->request_list, lsa, lsanext)) >>> CID 1497788: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 747 vty_out(vty, " %s\n", lsa->name); 748 749 timerclear(&res); 750 if (on->thread_send_lsupdate) 751 timersub(&on->thread_send_lsupdate->u.sands, &now, &res); 752 timerstring(&res, duration, sizeof(duration)); ** CID 1497787: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() ________________________________________________________________________________________________________ *** CID 1497787: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() 1941 > ospf6_packet_max(on->ospf6_if)) { 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; >>> CID 1497787: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1947 e->type = lsa->header->type; 1948 e->id = lsa->header->id; 1949 e->adv_router = lsa->header->adv_router; 1950 p += sizeof(struct ospf6_lsreq_entry); 1951 last_req = lsa; 1952 } /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() 1936 /* set Request entries in lsreq */ 1937 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 1938 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 1939 /* MTU check */ 1940 if (p - sendbuf + sizeof(struct ospf6_lsreq_entry) 1941 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1497787: (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_lsa_unlock" frees pointer "lsa" which has already been freed. 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; 1947 e->type = lsa->header->type; /ospf6d/ospf6_message.c: 1947 in ospf6_lsreq_send() 1941 > ospf6_packet_max(on->ospf6_if)) { 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; >>> CID 1497787: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 1947 e->type = lsa->header->type; 1948 e->id = lsa->header->id; 1949 e->adv_router = lsa->header->adv_router; 1950 p += sizeof(struct ospf6_lsreq_entry); 1951 last_req = lsa; 1952 } /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() 1936 /* set Request entries in lsreq */ 1937 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 1938 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 1939 /* MTU check */ 1940 if (p - sendbuf + sizeof(struct ospf6_lsreq_entry) 1941 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1497787: (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_lsa_unlock" frees pointer "lsa" which has already been freed. 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; 1947 e->type = lsa->header->type; /ospf6d/ospf6_message.c: 1942 in ospf6_lsreq_send() 1936 /* set Request entries in lsreq */ 1937 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 1938 for (ALL_LSDB(on->request_list, lsa, lsanext)) { 1939 /* MTU check */ 1940 if (p - sendbuf + sizeof(struct ospf6_lsreq_entry) 1941 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1497787: (USE_AFTER_FREE) >>> Passing freed pointer "lsa" as an argument to "ospf6_lsdb_lsa_unlock". 1942 ospf6_lsdb_lsa_unlock(lsa); 1943 break; 1944 } 1945 1946 e = (struct ospf6_lsreq_entry *)p; 1947 e->type = lsa->header->type; ** CID 1497786: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1497786: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1837 in ospf6_dbdesc_send() 1831 dbdesc->seqnum = htonl(on->dbdesc_seqnum); 1832 1833 /* if this is not initial one, set LSA headers in dbdesc */ 1834 p = (uint8_t *)((caddr_t)dbdesc + sizeof(struct ospf6_dbdesc)); 1835 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 1836 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1497786: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 1837 ospf6_lsa_age_update_to_send(lsa, 1838 on->ospf6_if->transdelay); 1839 1840 /* MTU check */ 1841 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 1842 > ospf6_packet_max(on->ospf6_if)) { /ospf6d/ospf6_message.c: 1837 in ospf6_dbdesc_send() 1831 dbdesc->seqnum = htonl(on->dbdesc_seqnum); 1832 1833 /* if this is not initial one, set LSA headers in dbdesc */ 1834 p = (uint8_t *)((caddr_t)dbdesc + sizeof(struct ospf6_dbdesc)); 1835 if (!CHECK_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT)) { 1836 for (ALL_LSDB(on->dbdesc_list, lsa, lsanext)) { >>> CID 1497786: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 1837 ospf6_lsa_age_update_to_send(lsa, 1838 on->ospf6_if->transdelay); 1839 1840 /* MTU check */ 1841 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 1842 > ospf6_packet_max(on->ospf6_if)) { ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 09 Oct '20

09 Oct '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 5 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1497769: Control flow issues (DEADCODE) /bgpd/bgp_vty.c: 1229 in router_bgp() ________________________________________________________________________________________________________ *** CID 1497769: Control flow issues (DEADCODE) /bgpd/bgp_vty.c: 1229 in router_bgp() 1223 return CMD_WARNING_CONFIG_FAILED; 1224 } 1225 /* unset the auto created flag as the user config is now present 1226 */ 1227 UNSET_FLAG(bgp->vrf_flags, BGP_VRF_AUTO); 1228 >>> CID 1497769: Control flow issues (DEADCODE) >>> Execution cannot reach the expression "name" inside this statement: "snprintf(base_xpath, 1024UL...". 1229 snprintf(base_xpath, sizeof(base_xpath), FRR_BGP_GLOBAL_XPATH, 1230 "frr-bgp:bgp", "bgp", name ? name : VRF_DEFAULT_NAME); 1231 1232 nb_cli_enqueue_change(vty, ".", NB_OP_CREATE, NULL); 1233 snprintf(as_str, 12, "%d", bgp->as); 1234 nb_cli_enqueue_change(vty, "./global/local-as", NB_OP_MODIFY, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

FRR 2020 Annual TSC Election - Call for TSC Nominations...
by Alistair Woodman 06 Oct '20

06 Oct '20

All, This email kicks off the FRR annual TSC election process. Please unicast me your nominations for TSC candidates. Process: 1) Present TSC members are automatically re-nominated. 2) I will unicast each candidate to confirm that they are actually willing to serve. 3) Voting will start in 2 weeks 4) Voting will close in 3 weeks /a

1 1

Regarding representation as FRR maintainer
by Abhijit Chaudhary 29 Sep '20

29 Sep '20

Dear All, I want to bring to your consideration that Niral has a long term commitment to contribute to FRRouting. Our team has been contributing to the FRR community, and I can assure you that our contribution would increase over time. We ensure to mention that our NOS uses FRRouting in all our external presentations. As the FRR Maintainer election would happen next month, I would appreciate it if the community can consider a representation from Niral in the FRR Maintainer list. I had a discussion with Kaushik and he is keen to take up the responsibility and dedicate time for FRR maintenance. Kindly let us know your thoughts regarding it. Best, - Abhijit +91-9886179612 <http://www.niralnetworks.com/> Building Curated, Open, Disaggregated Networking for 5G and Beyond According to DSCI report, A NASSCOM Initiative, Niral Networks is a key 5G technology player from India <https://www.nasscom.in/sites/default/files/TechSagar_Wireless_and_Networkin…>

2 2

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 22 Sep '20

22 Sep '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1497109: Error handling issues (CHECKED_RETURN) /lib/northbound.c: 125 in nb_node_new_cb() ________________________________________________________________________________________________________ *** CID 1497109: Error handling issues (CHECKED_RETURN) /lib/northbound.c: 125 in nb_node_new_cb() 119 nb_node->parent_list = sparent_list->priv; 120 121 /* Set flags. */ 122 if (CHECK_FLAG(snode->nodetype, LYS_CONTAINER | LYS_LIST)) { 123 bool config_only = true; 124 >>> CID 1497109: Error handling issues (CHECKED_RETURN) >>> Calling "yang_snodes_iterate_subtree" without checking return value (as is done elsewhere 4 out of 5 times). 125 yang_snodes_iterate_subtree(snode, NULL, 126 nb_node_check_config_only, 0, 127 &config_only); 128 if (config_only) 129 SET_FLAG(nb_node->flags, F_NB_NODE_CONFIG_ONLY); 130 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 18 Sep '20

18 Sep '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1465475: (RESOURCE_LEAK) /zebra/zebra_netns_id.c: 190 in zebra_ns_id_get() /zebra/zebra_netns_id.c: 227 in zebra_ns_id_get() ________________________________________________________________________________________________________ *** CID 1465475: (RESOURCE_LEAK) /zebra/zebra_netns_id.c: 190 in zebra_ns_id_get() 184 sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); 185 if (sock < 0) { 186 flog_err_sys(EC_LIB_SOCKET, "netlink( %u) socket() error: %s", 187 sock, safe_strerror(errno)); 188 if (fd_param == -1) 189 close(fd); >>> CID 1465475: (RESOURCE_LEAK) >>> Handle variable "fd" going out of scope leaks the handle. 190 return NS_UNKNOWN; 191 } 192 memset(&snl, 0, sizeof(snl)); 193 snl.nl_family = AF_NETLINK; 194 snl.nl_groups = RTNLGRP_NSID; 195 snl.nl_pid = 0; /* AUTO PID */ /zebra/zebra_netns_id.c: 227 in zebra_ns_id_get() 221 222 ret = send_receive(sock, nlh, seq, buf); 223 if (ret < 0) { 224 close(sock); 225 if (fd_param == -1) 226 close(fd); >>> CID 1465475: (RESOURCE_LEAK) >>> Handle variable "fd" going out of scope leaks the handle. 227 return NS_UNKNOWN; 228 } 229 nlh = (struct nlmsghdr *)buf; 230 231 /* message to analyse : NEWNSID response */ 232 ret = 0; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Regarding FRR Pim Protocol Function
by Pankaj Garbyal 18 Sep '20

18 Sep '20

Hello Sir/Madam, I am using FRRRouting Release 5.1 for PIM Protocol support in my Switch. But I find that PIM Protocol is not acknowledging the multicast packets coming towards it. When i compared the same with FRR installed in Linux PC, i found that a new interface named "pimreg" is enabled by FRR but the same is not happening in FRR of my switch. Kindly provide me help to get the pimreg interface option in my switch through FRR. also provide some information on the role of "pimreg" to run the PIM Protocol at FRR. Attached here my quagga build file for your reference. Thank you in advance for your support. Regards, Pankaj Garbyal Mobile: +91-9873987203

2 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 17 Sep '20

17 Sep '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 6 of 6 defect(s) ** CID 1497010: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1497010: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 2853 in lib_interface_isis_mpls_holddown_modify() 2847 break; 2848 case NB_EV_APPLY: 2849 circuit = nb_running_get_entry(args->dnode, NULL, true); 2850 holddown = yang_dnode_get_uint16(args->dnode, NULL); 2851 2852 if (circuit->ldp_sync_info == NULL) >>> CID 1497010: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "isis" when calling "isis_ldp_sync_if_init". 2853 isis_ldp_sync_if_init(circuit, isis); 2854 ldp_sync_info = circuit->ldp_sync_info; 2855 2856 SET_FLAG(ldp_sync_info->flags, LDP_SYNC_FLAG_HOLDDOWN); 2857 ldp_sync_info->holddown = holddown; 2858 break; ** CID 1497009: (NULL_RETURNS) /isisd/isis_nb_config.c: 1921 in isis_instance_mpls_ldp_sync_holddown_modify() /isisd/isis_nb_config.c: 1924 in isis_instance_mpls_ldp_sync_holddown_modify() ________________________________________________________________________________________________________ *** CID 1497009: (NULL_RETURNS) /isisd/isis_nb_config.c: 1921 in isis_instance_mpls_ldp_sync_holddown_modify() 1915 case NB_EV_ABORT: 1916 break; 1917 case NB_EV_APPLY: 1918 holddown = yang_dnode_get_uint16(args->dnode, NULL); 1919 1920 if (holddown == LDP_IGP_SYNC_HOLDDOWN_DEFAULT) >>> CID 1497009: (NULL_RETURNS) >>> Dereferencing "isis", which is known to be "NULL". 1921 UNSET_FLAG(isis->ldp_sync_cmd.flags, 1922 LDP_SYNC_FLAG_HOLDDOWN); 1923 else 1924 SET_FLAG(isis->ldp_sync_cmd.flags, 1925 LDP_SYNC_FLAG_HOLDDOWN); 1926 isis->ldp_sync_cmd.holddown = holddown; /isisd/isis_nb_config.c: 1924 in isis_instance_mpls_ldp_sync_holddown_modify() 1918 holddown = yang_dnode_get_uint16(args->dnode, NULL); 1919 1920 if (holddown == LDP_IGP_SYNC_HOLDDOWN_DEFAULT) 1921 UNSET_FLAG(isis->ldp_sync_cmd.flags, 1922 LDP_SYNC_FLAG_HOLDDOWN); 1923 else >>> CID 1497009: (NULL_RETURNS) >>> Dereferencing "isis", which is known to be "NULL". 1924 SET_FLAG(isis->ldp_sync_cmd.flags, 1925 LDP_SYNC_FLAG_HOLDDOWN); 1926 isis->ldp_sync_cmd.holddown = holddown; 1927 1928 /* set holddown time on all ISIS interfaces */ 1929 FOR_ALL_INTERFACES (vrf, ifp) { ** CID 1497008: Memory - illegal accesses (USE_AFTER_FREE) /isisd/isis_nb_config.c: 90 in isis_instance_destroy() ________________________________________________________________________________________________________ *** CID 1497008: Memory - illegal accesses (USE_AFTER_FREE) /isisd/isis_nb_config.c: 90 in isis_instance_destroy() 84 if (args->event != NB_EV_APPLY) 85 return NB_OK; 86 area = nb_running_unset_entry(args->dnode); 87 isis_area_destroy(area); 88 89 /* remove ldp-sync config */ >>> CID 1497008: Memory - illegal accesses (USE_AFTER_FREE) >>> Dereferencing freed pointer "area". 90 if (area->isis->vrf_id == VRF_DEFAULT) 91 isis_ldp_sync_gbl_exit(true); 92 93 return NB_OK; 94 } 95 ** CID 1497007: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 2886 in lib_interface_isis_mpls_holddown_destroy() ________________________________________________________________________________________________________ *** CID 1497007: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 2886 in lib_interface_isis_mpls_holddown_destroy() 2880 break; 2881 case NB_EV_APPLY: 2882 circuit = nb_running_get_entry(args->dnode, NULL, true); 2883 ldp_sync_info = circuit->ldp_sync_info; 2884 UNSET_FLAG(ldp_sync_info->flags, LDP_SYNC_FLAG_HOLDDOWN); 2885 >>> CID 1497007: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "isis", which is known to be "NULL". 2886 if (CHECK_FLAG(isis->ldp_sync_cmd.flags, 2887 LDP_SYNC_FLAG_HOLDDOWN)) 2888 ldp_sync_info->holddown = isis->ldp_sync_cmd.holddown; 2889 else 2890 ldp_sync_info->holddown = LDP_IGP_SYNC_HOLDDOWN_DEFAULT; 2891 break; 2892 } 2893 return NB_OK; ** CID 1497006: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 1863 in isis_instance_mpls_ldp_sync_create() ________________________________________________________________________________________________________ *** CID 1497006: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 1863 in isis_instance_mpls_ldp_sync_create() 1857 case NB_EV_APPLY: 1858 /* register with opaque client to recv LDP-IGP Sync msgs */ 1859 zclient_register_opaque(zclient, LDP_IGP_SYNC_IF_STATE_UPDATE); 1860 zclient_register_opaque(zclient, LDP_IGP_SYNC_ANNOUNCE_UPDATE); 1861 zclient_register_opaque(zclient, LDP_IGP_SYNC_HELLO_UPDATE); 1862 >>> CID 1497006: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "isis", which is known to be "NULL". 1863 if (!CHECK_FLAG(isis->ldp_sync_cmd.flags, 1864 LDP_SYNC_FLAG_ENABLE)) { 1865 SET_FLAG(isis->ldp_sync_cmd.flags, 1866 LDP_SYNC_FLAG_ENABLE); 1867 1868 /* turn on LDP-IGP Sync on all ptop ISIS interfaces */ ** CID 1497005: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1497005: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 2793 in lib_interface_isis_mpls_ldp_sync_modify() 2787 break; 2788 case NB_EV_APPLY: 2789 circuit = nb_running_get_entry(args->dnode, NULL, true); 2790 ldp_sync_enable = yang_dnode_get_bool(args->dnode, NULL); 2791 2792 if (circuit->ldp_sync_info == NULL) >>> CID 1497005: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "isis" when calling "isis_ldp_sync_if_init". 2793 isis_ldp_sync_if_init(circuit, isis); 2794 ldp_sync_info = circuit->ldp_sync_info; 2795 2796 if (ldp_sync_enable) { 2797 /* enable LDP-SYNC on an interface 2798 * if ptop interface send message to LDP to get state ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0