- dev - lists.frrouting.org

Regarding FRR Pim Protocol Function
by Pankaj Garbyal 18 Sep '20

18 Sep '20

Hello Sir/Madam, I am using FRRRouting Release 5.1 for PIM Protocol support in my Switch. But I find that PIM Protocol is not acknowledging the multicast packets coming towards it. When i compared the same with FRR installed in Linux PC, i found that a new interface named "pimreg" is enabled by FRR but the same is not happening in FRR of my switch. Kindly provide me help to get the pimreg interface option in my switch through FRR. also provide some information on the role of "pimreg" to run the PIM Protocol at FRR. Attached here my quagga build file for your reference. Thank you in advance for your support. Regards, Pankaj Garbyal Mobile: +91-9873987203

2 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 17 Sep '20

17 Sep '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 6 of 6 defect(s) ** CID 1497010: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1497010: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 2853 in lib_interface_isis_mpls_holddown_modify() 2847 break; 2848 case NB_EV_APPLY: 2849 circuit = nb_running_get_entry(args->dnode, NULL, true); 2850 holddown = yang_dnode_get_uint16(args->dnode, NULL); 2851 2852 if (circuit->ldp_sync_info == NULL) >>> CID 1497010: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "isis" when calling "isis_ldp_sync_if_init". 2853 isis_ldp_sync_if_init(circuit, isis); 2854 ldp_sync_info = circuit->ldp_sync_info; 2855 2856 SET_FLAG(ldp_sync_info->flags, LDP_SYNC_FLAG_HOLDDOWN); 2857 ldp_sync_info->holddown = holddown; 2858 break; ** CID 1497009: (NULL_RETURNS) /isisd/isis_nb_config.c: 1921 in isis_instance_mpls_ldp_sync_holddown_modify() /isisd/isis_nb_config.c: 1924 in isis_instance_mpls_ldp_sync_holddown_modify() ________________________________________________________________________________________________________ *** CID 1497009: (NULL_RETURNS) /isisd/isis_nb_config.c: 1921 in isis_instance_mpls_ldp_sync_holddown_modify() 1915 case NB_EV_ABORT: 1916 break; 1917 case NB_EV_APPLY: 1918 holddown = yang_dnode_get_uint16(args->dnode, NULL); 1919 1920 if (holddown == LDP_IGP_SYNC_HOLDDOWN_DEFAULT) >>> CID 1497009: (NULL_RETURNS) >>> Dereferencing "isis", which is known to be "NULL". 1921 UNSET_FLAG(isis->ldp_sync_cmd.flags, 1922 LDP_SYNC_FLAG_HOLDDOWN); 1923 else 1924 SET_FLAG(isis->ldp_sync_cmd.flags, 1925 LDP_SYNC_FLAG_HOLDDOWN); 1926 isis->ldp_sync_cmd.holddown = holddown; /isisd/isis_nb_config.c: 1924 in isis_instance_mpls_ldp_sync_holddown_modify() 1918 holddown = yang_dnode_get_uint16(args->dnode, NULL); 1919 1920 if (holddown == LDP_IGP_SYNC_HOLDDOWN_DEFAULT) 1921 UNSET_FLAG(isis->ldp_sync_cmd.flags, 1922 LDP_SYNC_FLAG_HOLDDOWN); 1923 else >>> CID 1497009: (NULL_RETURNS) >>> Dereferencing "isis", which is known to be "NULL". 1924 SET_FLAG(isis->ldp_sync_cmd.flags, 1925 LDP_SYNC_FLAG_HOLDDOWN); 1926 isis->ldp_sync_cmd.holddown = holddown; 1927 1928 /* set holddown time on all ISIS interfaces */ 1929 FOR_ALL_INTERFACES (vrf, ifp) { ** CID 1497008: Memory - illegal accesses (USE_AFTER_FREE) /isisd/isis_nb_config.c: 90 in isis_instance_destroy() ________________________________________________________________________________________________________ *** CID 1497008: Memory - illegal accesses (USE_AFTER_FREE) /isisd/isis_nb_config.c: 90 in isis_instance_destroy() 84 if (args->event != NB_EV_APPLY) 85 return NB_OK; 86 area = nb_running_unset_entry(args->dnode); 87 isis_area_destroy(area); 88 89 /* remove ldp-sync config */ >>> CID 1497008: Memory - illegal accesses (USE_AFTER_FREE) >>> Dereferencing freed pointer "area". 90 if (area->isis->vrf_id == VRF_DEFAULT) 91 isis_ldp_sync_gbl_exit(true); 92 93 return NB_OK; 94 } 95 ** CID 1497007: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 2886 in lib_interface_isis_mpls_holddown_destroy() ________________________________________________________________________________________________________ *** CID 1497007: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 2886 in lib_interface_isis_mpls_holddown_destroy() 2880 break; 2881 case NB_EV_APPLY: 2882 circuit = nb_running_get_entry(args->dnode, NULL, true); 2883 ldp_sync_info = circuit->ldp_sync_info; 2884 UNSET_FLAG(ldp_sync_info->flags, LDP_SYNC_FLAG_HOLDDOWN); 2885 >>> CID 1497007: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "isis", which is known to be "NULL". 2886 if (CHECK_FLAG(isis->ldp_sync_cmd.flags, 2887 LDP_SYNC_FLAG_HOLDDOWN)) 2888 ldp_sync_info->holddown = isis->ldp_sync_cmd.holddown; 2889 else 2890 ldp_sync_info->holddown = LDP_IGP_SYNC_HOLDDOWN_DEFAULT; 2891 break; 2892 } 2893 return NB_OK; ** CID 1497006: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 1863 in isis_instance_mpls_ldp_sync_create() ________________________________________________________________________________________________________ *** CID 1497006: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 1863 in isis_instance_mpls_ldp_sync_create() 1857 case NB_EV_APPLY: 1858 /* register with opaque client to recv LDP-IGP Sync msgs */ 1859 zclient_register_opaque(zclient, LDP_IGP_SYNC_IF_STATE_UPDATE); 1860 zclient_register_opaque(zclient, LDP_IGP_SYNC_ANNOUNCE_UPDATE); 1861 zclient_register_opaque(zclient, LDP_IGP_SYNC_HELLO_UPDATE); 1862 >>> CID 1497006: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "isis", which is known to be "NULL". 1863 if (!CHECK_FLAG(isis->ldp_sync_cmd.flags, 1864 LDP_SYNC_FLAG_ENABLE)) { 1865 SET_FLAG(isis->ldp_sync_cmd.flags, 1866 LDP_SYNC_FLAG_ENABLE); 1867 1868 /* turn on LDP-IGP Sync on all ptop ISIS interfaces */ ** CID 1497005: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1497005: Null pointer dereferences (NULL_RETURNS) /isisd/isis_nb_config.c: 2793 in lib_interface_isis_mpls_ldp_sync_modify() 2787 break; 2788 case NB_EV_APPLY: 2789 circuit = nb_running_get_entry(args->dnode, NULL, true); 2790 ldp_sync_enable = yang_dnode_get_bool(args->dnode, NULL); 2791 2792 if (circuit->ldp_sync_info == NULL) >>> CID 1497005: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "isis" when calling "isis_ldp_sync_if_init". 2793 isis_ldp_sync_if_init(circuit, isis); 2794 ldp_sync_info = circuit->ldp_sync_info; 2795 2796 if (ldp_sync_enable) { 2797 /* enable LDP-SYNC on an interface 2798 * if ptop interface send message to LDP to get state ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 10 Sep '20

10 Sep '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 5 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 5 of 5 defect(s) ** CID 1496950: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496950: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_route.c: 4403 in bgp_soft_reconfig_table() 4397 if (pi) 4398 memcpy(&evpn, &pi->attr->evpn_overlay, 4399 sizeof(evpn)); 4400 else 4401 memset(&evpn, 0, sizeof(evpn)); 4402 >>> CID 1496950: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "label_pnt" to "bgp_update", which dereferences it. 4403 ret = bgp_update(peer, bgp_dest_get_prefix(dest), 4404 ain->addpath_rx_id, ain->attr, afi, 4405 safi, ZEBRA_ROUTE_BGP, 4406 BGP_ROUTE_NORMAL, prd, label_pnt, 4407 num_labels, 1, &evpn); 4408 ** CID 1496949: Null pointer dereferences (REVERSE_INULL) /isisd/isis_cli.c: 329 in ip6_router_isis_magic() ________________________________________________________________________________________________________ *** CID 1496949: Null pointer dereferences (REVERSE_INULL) /isisd/isis_cli.c: 329 in ip6_router_isis_magic() 323 NB_OP_MODIFY, "true"); 324 nb_cli_enqueue_change(vty, "./frr-isisd:isis/circuit-type", 325 NB_OP_MODIFY, circ_type); 326 } 327 328 /* check if the interface is a loopback and if so set it as passive */ >>> CID 1496949: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "ifp" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 329 if (ifp && if_is_loopback(ifp)) 330 nb_cli_enqueue_change(vty, "./frr-isisd:isis/passive", 331 NB_OP_MODIFY, "true"); 332 333 return nb_cli_apply_changes(vty, NULL); 334 } ** CID 1496948: Null pointer dereferences (REVERSE_INULL) /isisd/isis_cli.c: 238 in ip_router_isis_magic() ________________________________________________________________________________________________________ *** CID 1496948: Null pointer dereferences (REVERSE_INULL) /isisd/isis_cli.c: 238 in ip_router_isis_magic() 232 NB_OP_MODIFY, "true"); 233 nb_cli_enqueue_change(vty, "./frr-isisd:isis/circuit-type", 234 NB_OP_MODIFY, circ_type); 235 } 236 237 /* check if the interface is a loopback and if so set it as passive */ >>> CID 1496948: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "ifp" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 238 if (ifp && if_is_loopback(ifp)) 239 nb_cli_enqueue_change(vty, "./frr-isisd:isis/passive", 240 NB_OP_MODIFY, "true"); 241 242 return nb_cli_apply_changes(vty, NULL); 243 } ** CID 1496947: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496947: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_rpki.c: 445 in revalidate_bgp_node() 439 uint32_t num_labels = 0; 440 441 if (path && path->extra) { 442 label = path->extra->label; 443 num_labels = path->extra->num_labels; 444 } >>> CID 1496947: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "label" to "bgp_update", which dereferences it. 445 ret = bgp_update(ain->peer, bgp_dest_get_prefix(bgp_dest), 446 ain->addpath_rx_id, ain->attr, afi, safi, 447 ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL, NULL, label, 448 num_labels, 1, NULL); 449 450 if (ret < 0) ** CID 1496946: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496946: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_mac.c: 213 in bgp_process_mac_rescan_table() 207 peer->host, pfx_buf); 208 } 209 continue; 210 } 211 212 memcpy(&evpn, &pi->attr->evpn_overlay, sizeof(evpn)); >>> CID 1496946: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "label_pnt" to "bgp_update", which dereferences it. 213 int32_t ret = bgp_update(peer, p, 214 pi->addpath_rx_id, 215 pi->attr, AFI_L2VPN, SAFI_EVPN, 216 ZEBRA_ROUTE_BGP, 217 BGP_ROUTE_NORMAL, &prd, 218 label_pnt, num_labels, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Using of sub interfaces for vxlan/evpn communication
by Cyril MATTIUZZI 07 Sep '20

07 Sep '20

I am trying to use vxlan with bgp / evpn: No problem with using vlan. However, as soon as several vlan comes on the same interface, nothing happens anymore, because my bridge is no longer on the interface but on the sub interface. Is it possible to perform interface trunking on FRR so that 2 vlans can be used on the same link? (example : using vlans 123, 130, 199 = ens10.123 ; ens10.130 ; ens10.199) [https://user-images.githubusercontent.com/70760763/92245330-832d3480-eec4-1…] I am available for any additional information Best regards.

1 0

FRR Slack is sponsored!
by Donald Sharp 27 Aug '20

27 Aug '20

All - VyOS( https://www.vyos.io/ ) has graciously decided to sponsor our slack. This will allow all of us to go back and read the 500k+ messages that have accumulated over the last couple of years as well as have some more interesting integrations with other applications in the future. I would like to take a second and thank the VyOS team for this support of our Community! thanks! donald

3 2

Northbound weekly meeting
by Santosh P K 27 Aug '20

27 Aug '20

1 0

Northbound weekly meeting
by Santosh P K 27 Aug '20

27 Aug '20

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 27 Aug '20

27 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 9 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 8 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 9 of 9 defect(s) ** CID 1496729: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 266 in ecommunity_dup() /bgpd/bgp_ecommunity.c: 268 in ecommunity_dup() ________________________________________________________________________________________________________ *** CID 1496729: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 266 in ecommunity_dup() 260 struct ecommunity *new; 261 262 new = XCALLOC(MTYPE_ECOMMUNITY, sizeof(struct ecommunity)); 263 new->size = ecom->size; 264 new->unit_size = ecom->unit_size; 265 if (new->size) { >>> CID 1496729: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 266 new->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 267 ecom->size * ecom->unit_size); 268 memcpy(new->val, ecom->val, ecom->size * ecom->unit_size); 269 } else 270 new->val = NULL; 271 return new; /bgpd/bgp_ecommunity.c: 268 in ecommunity_dup() 262 new = XCALLOC(MTYPE_ECOMMUNITY, sizeof(struct ecommunity)); 263 new->size = ecom->size; 264 new->unit_size = ecom->unit_size; 265 if (new->size) { 266 new->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 267 ecom->size * ecom->unit_size); >>> CID 1496729: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 268 memcpy(new->val, ecom->val, ecom->size * ecom->unit_size); 269 } else 270 new->val = NULL; 271 return new; 272 } 273 ** CID 1496728: Resource leaks (RESOURCE_LEAK) /pimd/pim_igmp.c: 1016 in pim_igmp_sock_add() ________________________________________________________________________________________________________ *** CID 1496728: Resource leaks (RESOURCE_LEAK) /pimd/pim_igmp.c: 1016 in pim_igmp_sock_add() 1010 sin.sin_family = AF_INET; 1011 sin.sin_addr = ifaddr; 1012 sin.sin_port = 0; 1013 if (bind(fd, (struct sockaddr *) &sin, sizeof(sin)) != 0) { 1014 zlog_warn("Could not bind IGMP socket for %s on %s", 1015 inet_ntoa(ifaddr), ifp->name); >>> CID 1496728: Resource leaks (RESOURCE_LEAK) >>> Handle variable "fd" going out of scope leaks the handle. 1016 return 0; 1017 } 1018 1019 igmp = igmp_sock_new(fd, ifaddr, ifp, mtrace_only); 1020 1021 igmp_read_on(igmp); ** CID 1496727: (FORWARD_NULL) /bgpd/bgp_zebra.c: 2377 in bgp_encode_pbr_rule_action() /bgpd/bgp_zebra.c: 2408 in bgp_encode_pbr_rule_action() ________________________________________________________________________________________________________ *** CID 1496727: (FORWARD_NULL) /bgpd/bgp_zebra.c: 2377 in bgp_encode_pbr_rule_action() 2371 * - FS PBR entries based on iprule 2372 * the latter may contain default routing information injected by FS 2373 */ 2374 if (pbr) 2375 stream_putl(s, pbr->unique); 2376 else >>> CID 1496727: (FORWARD_NULL) >>> Dereferencing null pointer "pbra". 2377 stream_putl(s, pbra->unique); 2378 if (pbr && pbr->flags & MATCH_IP_SRC_SET) 2379 memcpy(&pfx, &(pbr->src), sizeof(struct prefix)); 2380 else { 2381 memset(&pfx, 0, sizeof(pfx)); 2382 pfx.family = fam; /bgpd/bgp_zebra.c: 2408 in bgp_encode_pbr_rule_action() 2402 /* if pbr present, fwmark is not used */ 2403 if (pbr) 2404 stream_putl(s, 0); 2405 else 2406 stream_putl(s, pbra->fwmark); /* fwmark */ 2407 >>> CID 1496727: (FORWARD_NULL) >>> Dereferencing null pointer "pbra". 2408 stream_putl(s, pbra->table_id); 2409 2410 stream_putl(s, 0); /* ifindex unused */ 2411 } 2412 2413 static void bgp_encode_pbr_ipset_match(struct stream *s, ** CID 1496726: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1234 in ecommunity_strip() ________________________________________________________________________________________________________ *** CID 1496726: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1234 in ecommunity_strip() 1228 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); 1229 ecom->size = 0; 1230 return true; 1231 } 1232 1233 /* Strip matching ext community(ies). */ >>> CID 1496726: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - found) * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - found) * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1234 new = XMALLOC(MTYPE_ECOMMUNITY_VAL, 1235 (ecom->size - found) * ecom->unit_size); 1236 q = new; 1237 for (c = 0, p = ecom->val; c < ecom->size; c++, p += ecom->unit_size) { 1238 if (!(p[0] == type && p[1] == subtype)) { 1239 memcpy(q, p, ecom->unit_size); ** CID 1496725: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 294 in ecommunity_merge() /bgpd/bgp_ecommunity.c: 289 in ecommunity_merge() /bgpd/bgp_ecommunity.c: 299 in ecommunity_merge() ________________________________________________________________________________________________________ *** CID 1496725: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 294 in ecommunity_merge() 288 ecom1->val = 289 XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom1->val, 290 (ecom1->size + ecom2->size) * 291 ecom1->unit_size); 292 else 293 ecom1->val = >>> CID 1496725: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom1->size + ecom2->size) * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom1->size + ecom2->size) * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 294 XMALLOC(MTYPE_ECOMMUNITY_VAL, 295 (ecom1->size + ecom2->size) * 296 ecom1->unit_size); 297 298 memcpy(ecom1->val + (ecom1->size * ecom1->unit_size), ecom2->val, 299 ecom2->size * ecom1->unit_size); /bgpd/bgp_ecommunity.c: 289 in ecommunity_merge() 283 /* Merge two Extended Communities Attribute structure. */ 284 struct ecommunity *ecommunity_merge(struct ecommunity *ecom1, 285 struct ecommunity *ecom2) 286 { 287 if (ecom1->val) 288 ecom1->val = >>> CID 1496725: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom1->size + ecom2->size) * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom1->size + ecom2->size) * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 289 XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom1->val, 290 (ecom1->size + ecom2->size) * 291 ecom1->unit_size); 292 else 293 ecom1->val = 294 XMALLOC(MTYPE_ECOMMUNITY_VAL, /bgpd/bgp_ecommunity.c: 299 in ecommunity_merge() 293 ecom1->val = 294 XMALLOC(MTYPE_ECOMMUNITY_VAL, 295 (ecom1->size + ecom2->size) * 296 ecom1->unit_size); 297 298 memcpy(ecom1->val + (ecom1->size * ecom1->unit_size), ecom2->val, >>> CID 1496725: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom2->size * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom2->size * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 299 ecom2->size * ecom1->unit_size); 300 ecom1->size += ecom2->size; 301 302 return ecom1; 303 } 304 ** CID 1496724: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1275 in ecommunity_del_val() /bgpd/bgp_ecommunity.c: 1273 in ecommunity_del_val() /bgpd/bgp_ecommunity.c: 1279 in ecommunity_del_val() ________________________________________________________________________________________________________ *** CID 1496724: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1275 in ecommunity_del_val() 1269 return false; 1270 1271 /* Delete the selected value */ 1272 ecom->size--; 1273 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1274 if (c != 0) >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "c * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "c * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1275 memcpy(p, ecom->val, c * ecom->unit_size); 1276 if ((ecom->size - c) != 0) 1277 memcpy(p + (c)*ecom->unit_size, 1278 ecom->val + (c + 1) * ecom->unit_size, 1279 (ecom->size - c) * ecom->unit_size); 1280 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); /bgpd/bgp_ecommunity.c: 1273 in ecommunity_del_val() 1267 } 1268 if (found == 0) 1269 return false; 1270 1271 /* Delete the selected value */ 1272 ecom->size--; >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1273 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1274 if (c != 0) 1275 memcpy(p, ecom->val, c * ecom->unit_size); 1276 if ((ecom->size - c) != 0) 1277 memcpy(p + (c)*ecom->unit_size, 1278 ecom->val + (c + 1) * ecom->unit_size, /bgpd/bgp_ecommunity.c: 1279 in ecommunity_del_val() 1273 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1274 if (c != 0) 1275 memcpy(p, ecom->val, c * ecom->unit_size); 1276 if ((ecom->size - c) != 0) 1277 memcpy(p + (c)*ecom->unit_size, 1278 ecom->val + (c + 1) * ecom->unit_size, >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - c) * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - c) * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1279 (ecom->size - c) * ecom->unit_size); 1280 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); 1281 ecom->val = p; 1282 return true; 1283 } 1284 ** CID 1496723: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 162 in ecommunity_add_val_internal() /bgpd/bgp_ecommunity.c: 156 in ecommunity_add_val_internal() /bgpd/bgp_ecommunity.c: 104 in ecommunity_add_val_internal() ________________________________________________________________________________________________________ *** CID 1496723: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 162 in ecommunity_add_val_internal() 156 ecom->val = XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom->val, 157 ecom_length_size(ecom, ecom_size)); 158 159 160 memmove(ecom->val + ((ins_idx + 1) * ecom_size), 161 ecom->val + (ins_idx * ecom_size), >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - 1 - ins_idx) * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - 1 - ins_idx) * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 162 (ecom->size - 1 - ins_idx) * ecom_size); 163 memcpy(ecom->val + (ins_idx * ecom_size), 164 eval, ecom_size); 165 166 return true; 167 } /bgpd/bgp_ecommunity.c: 156 in ecommunity_add_val_internal() 150 151 if (ins_idx == -1) 152 ins_idx = c; 153 154 /* Add the value to the structure with numerical sorting. */ 155 ecom->size++; >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 156 ecom->val = XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom->val, 157 ecom_length_size(ecom, ecom_size)); 158 159 160 memmove(ecom->val + ((ins_idx + 1) * ecom_size), 161 ecom->val + (ins_idx * ecom_size), /bgpd/bgp_ecommunity.c: 104 in ecommunity_add_val_internal() 98 const struct ecommunity_val_ipv6 *eval6 = 99 (struct ecommunity_val_ipv6 *)eval; 100 101 /* When this is fist value, just add it. */ 102 if (ecom->val == NULL) { 103 ecom->size = 1; >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 104 ecom->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 105 ecom_length_size(ecom, ecom_size)); 106 memcpy(ecom->val, eval, ecom_size); 107 return true; 108 } 109 ** CID 1496722: Incorrect expression (USELESS_CALL) ________________________________________________________________________________________________________ *** CID 1496722: Incorrect expression (USELESS_CALL) /bgpd/bgp_flowspec_vty.c: 276 in route_vty_out_flowspec() 270 char timebuf[BGP_UPTIME_LEN]; 271 struct bgp_dest *dest = NULL; 272 273 if (path) 274 dest = path->net; 275 if (dest) >>> CID 1496722: Incorrect expression (USELESS_CALL) >>> Calling "bgp_dest_get_bgp_table_info(dest)" is only useful for its return value, which is ignored. 276 bgp_dest_get_bgp_table_info(dest); 277 if (p == NULL || p->family != AF_FLOWSPEC) 278 return; 279 if (json_paths) { 280 if (display == NLRI_STRING_FORMAT_JSON) 281 json_nlri_path = json_object_new_object(); ** CID 1496721: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 367 in ecommunity_cmp() ________________________________________________________________________________________________________ *** CID 1496721: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 367 in ecommunity_cmp() 361 return false; 362 363 if (ecom1->unit_size != ecom2->unit_size) 364 return false; 365 366 return (ecom1->size == ecom2->size >>> CID 1496721: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t const" (8 bits, unsigned) is promoted in "ecom1->size * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom1->size * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 367 && memcmp(ecom1->val, ecom2->val, ecom1->size * 368 ecom1->unit_size) == 0); 369 } 370 371 /* Initialize Extended Comminities related hash. */ 372 void ecommunity_init(void) ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 26 Aug '20

26 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 58 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 58 defect(s) ** CID 1496712: Incorrect expression (IDENTICAL_BRANCHES) /ospfd/ospf_ext.c: 589 in ospf_ext_link_delete_adj_sid() ________________________________________________________________________________________________________ *** CID 1496712: Incorrect expression (IDENTICAL_BRANCHES) /ospfd/ospf_ext.c: 589 in ospf_ext_link_delete_adj_sid() 583 { 584 /* Process only (LAN)Adjacency-SID Type */ 585 if (exti->stype != ADJ_SID && exti->stype != LAN_ADJ_SID) 586 return; 587 588 /* Release Primary & Backup Labels from Label Manager */ >>> CID 1496712: Incorrect expression (IDENTICAL_BRANCHES) >>> The same code is executed regardless of whether "exti->stype == ADJ_SID" is true, because the 'then' and 'else' branches are identical. Should one of the branches be modified, or the entire 'if' statement replaced? 589 if (exti->stype == ADJ_SID) { 590 ospf_sr_local_block_release_label(exti->adj_sid[0].value); 591 ospf_sr_local_block_release_label(exti->adj_sid[1].value); 592 } else { 593 ospf_sr_local_block_release_label(exti->adj_sid[0].value); 594 ospf_sr_local_block_release_label(exti->adj_sid[1].value); ** CID 1496711: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496711: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2319 in no_sr_node_msd() 2313 OspfSR.msd = 0; 2314 if (OspfSR.self != NULL) 2315 OspfSR.self->msd = 0; 2316 2317 /* Set Router Information parameters if SR is UP */ 2318 if (OspfSR.status == SR_UP) >>> CID 1496711: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2319 ospf_router_info_update_sr(true, OspfSR.self); 2320 2321 return CMD_SUCCESS; 2322 } 2323 2324 DEFUN (sr_prefix_sid, ** CID 1496710: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496710: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2078 in update_srgb() 2072 OspfSR.srgb.reserved = true; 2073 2074 osr_debug("SR(%s): Got new SRGB [%u/%u]", __func__, OspfSR.srgb.start, 2075 OspfSR.srgb.start + OspfSR.srgb.size - 1); 2076 2077 /* SRGB is reserved, set Router Information parameters */ >>> CID 1496710: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2078 ospf_router_info_update_sr(true, OspfSR.self); 2079 2080 /* and update NHLFE entries */ 2081 hash_iterate(OspfSR.neighbors, 2082 (void (*)(struct hash_bucket *, void *))update_in_nhlfe, 2083 NULL); ** CID 1496709: Control flow issues (DEADCODE) /bgpd/bgp_vty.c: 12806 in bgp_show_all_instances_neighbors_vty() ________________________________________________________________________________________________________ *** CID 1496709: Control flow issues (DEADCODE) /bgpd/bgp_vty.c: 12806 in bgp_show_all_instances_neighbors_vty() 12800 json = NULL; 12801 } 12802 12803 if (use_json) { 12804 vty_out(vty, "}\n"); 12805 if (json) >>> CID 1496709: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "json_object_free(json);". 12806 json_object_free(json); 12807 } 12808 else if (!nbr_output) 12809 vty_out(vty, "%% BGP instance not found\n"); 12810 } 12811 ** CID 1496708: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496708: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2254 in no_sr_local_label_range() 2248 2249 /* SRLB is reserved, Update Self SR-Node and Router Information LSA */ 2250 if (OspfSR.self != NULL) { 2251 OspfSR.self->srlb.lower_bound = DEFAULT_SRLB_LABEL; 2252 OspfSR.self->srlb.range_size = DEFAULT_SRLB_SIZE; 2253 } >>> CID 1496708: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2254 ospf_router_info_update_sr(true, OspfSR.self); 2255 2256 /* and update (LAN)-Adjacency SID */ 2257 ospf_ext_link_srlb_update(); 2258 2259 return CMD_SUCCESS; ** CID 1496707: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496707: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2295 in sr_node_msd() 2289 OspfSR.msd = msd; 2290 if (OspfSR.self != NULL) 2291 OspfSR.self->msd = msd; 2292 2293 /* Set Router Information parameters if SR is UP */ 2294 if (OspfSR.status == SR_UP) >>> CID 1496707: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2295 ospf_router_info_update_sr(true, OspfSR.self); 2296 2297 return CMD_SUCCESS; 2298 } 2299 2300 DEFUN (no_sr_node_msd, ** CID 1496706: Performance inefficiencies (PASS_BY_VALUE) /ospfd/ospf_ri.c: 576 in is_mandated_params_set() ________________________________________________________________________________________________________ *** CID 1496706: Performance inefficiencies (PASS_BY_VALUE) /ospfd/ospf_ri.c: 576 in is_mandated_params_set() 570 | PCE_CAP_ADDITIVE | PCE_CAP_MULTIPLE_REQ; 571 set_pce_cap_flag(cap, &ori->pce_info); 572 573 return; 574 } 575 >>> CID 1496706: Performance inefficiencies (PASS_BY_VALUE) >>> Passing parameter ori of type "struct ospf_router_info" (size 136 bytes) by value. 576 static int is_mandated_params_set(struct ospf_router_info ori) 577 { 578 int rc = 0; 579 580 if (ntohs(ori.router_cap.header.type) == 0) 581 return rc; ** CID 1496643: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496643: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_evpn_mh.c: 362 in zebra_evpn_es_evi_show_vni() 356 vty_out(vty, "%-8s %-30s %-4s\n", "VNI", "ESI", "Type"); 357 } 358 } else { 359 if (!uj) 360 vty_out(vty, "VNI %d doesn't exist\n", vni); 361 } >>> CID 1496643: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "zevpn" to "zebra_evpn_es_evi_show_one_evpn", which dereferences it. 362 zebra_evpn_es_evi_show_one_evpn(zevpn, vty, json, detail); 363 } 364 365 /* Initialize the ES tables maintained per-L2_VNI */ 366 void zebra_evpn_evpn_es_init(zebra_evpn_t *zevpn) 367 { ** CID 1496642: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496642: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_route.c: 3073 in bgp_filtered_routes_count() 3067 3068 for (dest = bgp_table_top(table); dest; dest = bgp_route_next(dest)) { 3069 for (ain = dest->adj_in; ain; ain = ain->next) { 3070 const struct prefix *rn_p = bgp_dest_get_prefix(dest); 3071 struct attr attr = {}; 3072 >>> CID 1496642: Null pointer dereferences (FORWARD_NULL) >>> Passing "&attr" to "bgp_input_filter", which dereferences null "attr.aspath". 3073 if (bgp_input_filter(peer, rn_p, &attr, afi, safi) 3074 == FILTER_DENY) 3075 filtered = true; 3076 3077 if (bgp_input_modifier( 3078 peer, rn_p, &attr, afi, safi, ** CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) /zebra/zebra_evpn_mh.c: 1690 in zebra_evpn_es_cleanup() 1684 struct zebra_evpn_es *es; 1685 struct zebra_evpn_es *es_next; 1686 1687 RB_FOREACH_SAFE(es, zebra_es_rb_head, 1688 &zmh_info->es_rb_tree, es_next) { 1689 zebra_evpn_local_es_del(es); >>> CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "zebra_evpn_remote_es_flush" dereferences freed pointer "es". 1690 zebra_evpn_remote_es_flush(es); 1691 } 1692 } 1693 1694 /* Only certain types of access ports can be setup as an Ethernet Segment */ 1695 bool zebra_evpn_is_if_es_capable(struct zebra_if *zif) ** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 486 in seqnumber_mismatch() 480 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 481 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 482 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 483 484 ospf6_lsdb_remove_all(on->summary_list); 485 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 486 for (ALL_LSDB(on->retrans_list, lsa)) { 487 ospf6_decrement_retrans_count(lsa); 488 ospf6_lsdb_remove(lsa, on->retrans_list); 489 } 490 491 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2306 in ospf6_lsack_send_neighbor() 2300 2301 memset(sendbuf, 0, iobuflen); 2302 oh = (struct ospf6_header *)sendbuf; 2303 2304 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2305 >>> CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2306 for (ALL_LSDB(on->lsack_list, lsa)) { 2307 /* MTU check */ 2308 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2309 > ospf6_packet_max(on->ospf6_if)) { 2310 /* if we run out of packet size/space here, 2311 better to try again soon. */ ** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2223 in ospf6_lsupdate_send_interface() 2217 lsupdate = (struct ospf6_lsupdate *)((caddr_t)oh 2218 + sizeof(struct ospf6_header)); 2219 2220 p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 2221 lsa_cnt = 0; 2222 >>> CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2223 for (ALL_LSDB(oi->lsupdate_list, lsa)) { 2224 /* MTU check */ 2225 if ((p - sendbuf + ((unsigned int)OSPF6_LSA_SIZE(lsa->header))) 2226 > ospf6_packet_max(oi)) { 2227 if (lsa_cnt) { 2228 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; ** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 306 in ospf6_lsdb_remove_all() 300 { 301 struct ospf6_lsa *lsa; 302 303 if (lsdb == NULL) 304 return; 305 >>> CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 306 for (ALL_LSDB(lsdb, lsa)) 307 ospf6_lsdb_remove(lsa, lsdb); 308 } 309 310 void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa) 311 { ** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 125 in ospf6_neighbor_delete() 119 void ospf6_neighbor_delete(struct ospf6_neighbor *on) 120 { 121 struct ospf6_lsa *lsa; 122 123 ospf6_lsdb_remove_all(on->summary_list); 124 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 125 for (ALL_LSDB(on->retrans_list, lsa)) { 126 ospf6_decrement_retrans_count(lsa); 127 ospf6_lsdb_remove(lsa, on->retrans_list); 128 } 129 130 ospf6_lsdb_remove_all(on->dbdesc_list); ** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1872 in ospf6_dbdesc_send_newone() 1866 ospf6_lsdb_remove_all(on->dbdesc_list); 1867 1868 /* move LSAs from summary_list to dbdesc_list (within neighbor 1869 structure) 1870 so that ospf6_send_dbdesc () can send those LSAs */ 1871 size = sizeof(struct ospf6_lsa_header) + sizeof(struct ospf6_dbdesc); >>> CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 1872 for (ALL_LSDB(on->summary_list, lsa)) { 1873 if (size + sizeof(struct ospf6_lsa_header) 1874 > ospf6_packet_max(on->ospf6_if)) { 1875 ospf6_lsdb_lsa_unlock(lsa); 1876 break; 1877 } ** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 523 in bad_lsreq() 517 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 518 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 519 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 520 521 ospf6_lsdb_remove_all(on->summary_list); 522 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 523 for (ALL_LSDB(on->retrans_list, lsa)) { 524 ospf6_decrement_retrans_count(lsa); 525 ospf6_lsdb_remove(lsa, on->retrans_list); 526 } 527 528 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 310 in negotiation_done() 304 if (IS_OSPF6_DEBUG_NEIGHBOR(EVENT)) 305 zlog_debug("Neighbor Event %s: *NegotiationDone*", on->name); 306 307 /* clear ls-list */ 308 ospf6_lsdb_remove_all(on->summary_list); 309 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 310 for (ALL_LSDB(on->retrans_list, lsa)) { 311 ospf6_decrement_retrans_count(lsa); 312 ospf6_lsdb_remove(lsa, on->retrans_list); 313 } 314 315 /* Interface scoped LSAs */ ** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 324 in ospf6_lsdb_maxage_remover() 318 319 int ospf6_lsdb_maxage_remover(struct ospf6_lsdb *lsdb) 320 { 321 int reschedule = 0; 322 struct ospf6_lsa *lsa; 323 >>> CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 324 for (ALL_LSDB(lsdb, lsa)) { 325 if (!OSPF6_LSA_IS_MAXAGE(lsa)) 326 continue; 327 if (lsa->retrans_count != 0) { 328 reschedule = 1; 329 continue; ** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2385 in ospf6_lsack_send_interface() 2379 2380 memset(sendbuf, 0, iobuflen); 2381 oh = (struct ospf6_header *)sendbuf; 2382 2383 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2384 >>> CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2385 for (ALL_LSDB(oi->lsack_list, lsa)) { 2386 /* MTU check */ 2387 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2388 > ospf6_packet_max(oi)) { 2389 /* if we run out of packet size/space here, 2390 better to try again soon. */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 21 Aug '20

21 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 56 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1496687: Error handling issues (CHECKED_RETURN) /vrrpd/vrrp_packet.c: 95 in vrrp_pkt_checksum() ________________________________________________________________________________________________________ *** CID 1496687: Error handling issues (CHECKED_RETURN) /vrrpd/vrrp_packet.c: 95 in vrrp_pkt_checksum() 89 ph.next_hdr = IPPROTO_VRRP; 90 chksum = in_cksum_with_ph6(&ph, pkt, pktsize); 91 } else if (!v6 && ((pkt->hdr.vertype >> 4) == 3)) { 92 struct ipv4_ph ph = {}; 93 94 ph.src = src->ipaddr_v4; >>> CID 1496687: Error handling issues (CHECKED_RETURN) >>> Calling "inet_pton" without checking return value (as is done elsewhere 15 out of 16 times). 95 inet_pton(AF_INET, VRRP_MCASTV4_GROUP_STR, &ph.dst); 96 ph.proto = IPPROTO_VRRP; 97 ph.len = htons(pktsize); 98 chksum = in_cksum_with_ph4(&ph, pkt, pktsize); 99 } else if (!v6 && ((pkt->hdr.vertype >> 4) == 2)) { 100 chksum = in_cksum(pkt, pktsize); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0