- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 10 Sep '20

10 Sep '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 5 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 5 of 5 defect(s) ** CID 1496950: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496950: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_route.c: 4403 in bgp_soft_reconfig_table() 4397 if (pi) 4398 memcpy(&evpn, &pi->attr->evpn_overlay, 4399 sizeof(evpn)); 4400 else 4401 memset(&evpn, 0, sizeof(evpn)); 4402 >>> CID 1496950: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "label_pnt" to "bgp_update", which dereferences it. 4403 ret = bgp_update(peer, bgp_dest_get_prefix(dest), 4404 ain->addpath_rx_id, ain->attr, afi, 4405 safi, ZEBRA_ROUTE_BGP, 4406 BGP_ROUTE_NORMAL, prd, label_pnt, 4407 num_labels, 1, &evpn); 4408 ** CID 1496949: Null pointer dereferences (REVERSE_INULL) /isisd/isis_cli.c: 329 in ip6_router_isis_magic() ________________________________________________________________________________________________________ *** CID 1496949: Null pointer dereferences (REVERSE_INULL) /isisd/isis_cli.c: 329 in ip6_router_isis_magic() 323 NB_OP_MODIFY, "true"); 324 nb_cli_enqueue_change(vty, "./frr-isisd:isis/circuit-type", 325 NB_OP_MODIFY, circ_type); 326 } 327 328 /* check if the interface is a loopback and if so set it as passive */ >>> CID 1496949: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "ifp" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 329 if (ifp && if_is_loopback(ifp)) 330 nb_cli_enqueue_change(vty, "./frr-isisd:isis/passive", 331 NB_OP_MODIFY, "true"); 332 333 return nb_cli_apply_changes(vty, NULL); 334 } ** CID 1496948: Null pointer dereferences (REVERSE_INULL) /isisd/isis_cli.c: 238 in ip_router_isis_magic() ________________________________________________________________________________________________________ *** CID 1496948: Null pointer dereferences (REVERSE_INULL) /isisd/isis_cli.c: 238 in ip_router_isis_magic() 232 NB_OP_MODIFY, "true"); 233 nb_cli_enqueue_change(vty, "./frr-isisd:isis/circuit-type", 234 NB_OP_MODIFY, circ_type); 235 } 236 237 /* check if the interface is a loopback and if so set it as passive */ >>> CID 1496948: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "ifp" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 238 if (ifp && if_is_loopback(ifp)) 239 nb_cli_enqueue_change(vty, "./frr-isisd:isis/passive", 240 NB_OP_MODIFY, "true"); 241 242 return nb_cli_apply_changes(vty, NULL); 243 } ** CID 1496947: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496947: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_rpki.c: 445 in revalidate_bgp_node() 439 uint32_t num_labels = 0; 440 441 if (path && path->extra) { 442 label = path->extra->label; 443 num_labels = path->extra->num_labels; 444 } >>> CID 1496947: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "label" to "bgp_update", which dereferences it. 445 ret = bgp_update(ain->peer, bgp_dest_get_prefix(bgp_dest), 446 ain->addpath_rx_id, ain->attr, afi, safi, 447 ZEBRA_ROUTE_BGP, BGP_ROUTE_NORMAL, NULL, label, 448 num_labels, 1, NULL); 449 450 if (ret < 0) ** CID 1496946: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496946: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_mac.c: 213 in bgp_process_mac_rescan_table() 207 peer->host, pfx_buf); 208 } 209 continue; 210 } 211 212 memcpy(&evpn, &pi->attr->evpn_overlay, sizeof(evpn)); >>> CID 1496946: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "label_pnt" to "bgp_update", which dereferences it. 213 int32_t ret = bgp_update(peer, p, 214 pi->addpath_rx_id, 215 pi->attr, AFI_L2VPN, SAFI_EVPN, 216 ZEBRA_ROUTE_BGP, 217 BGP_ROUTE_NORMAL, &prd, 218 label_pnt, num_labels, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Using of sub interfaces for vxlan/evpn communication
by Cyril MATTIUZZI 07 Sep '20

07 Sep '20

I am trying to use vxlan with bgp / evpn: No problem with using vlan. However, as soon as several vlan comes on the same interface, nothing happens anymore, because my bridge is no longer on the interface but on the sub interface. Is it possible to perform interface trunking on FRR so that 2 vlans can be used on the same link? (example : using vlans 123, 130, 199 = ens10.123 ; ens10.130 ; ens10.199) [https://user-images.githubusercontent.com/70760763/92245330-832d3480-eec4-1…] I am available for any additional information Best regards.

1 0

FRR Slack is sponsored!
by Donald Sharp 27 Aug '20

27 Aug '20

All - VyOS( https://www.vyos.io/ ) has graciously decided to sponsor our slack. This will allow all of us to go back and read the 500k+ messages that have accumulated over the last couple of years as well as have some more interesting integrations with other applications in the future. I would like to take a second and thank the VyOS team for this support of our Community! thanks! donald

3 2

Northbound weekly meeting
by Santosh P K 27 Aug '20

27 Aug '20

1 0

Northbound weekly meeting
by Santosh P K 27 Aug '20

27 Aug '20

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 27 Aug '20

27 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 9 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 8 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 9 of 9 defect(s) ** CID 1496729: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 266 in ecommunity_dup() /bgpd/bgp_ecommunity.c: 268 in ecommunity_dup() ________________________________________________________________________________________________________ *** CID 1496729: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 266 in ecommunity_dup() 260 struct ecommunity *new; 261 262 new = XCALLOC(MTYPE_ECOMMUNITY, sizeof(struct ecommunity)); 263 new->size = ecom->size; 264 new->unit_size = ecom->unit_size; 265 if (new->size) { >>> CID 1496729: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 266 new->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 267 ecom->size * ecom->unit_size); 268 memcpy(new->val, ecom->val, ecom->size * ecom->unit_size); 269 } else 270 new->val = NULL; 271 return new; /bgpd/bgp_ecommunity.c: 268 in ecommunity_dup() 262 new = XCALLOC(MTYPE_ECOMMUNITY, sizeof(struct ecommunity)); 263 new->size = ecom->size; 264 new->unit_size = ecom->unit_size; 265 if (new->size) { 266 new->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 267 ecom->size * ecom->unit_size); >>> CID 1496729: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 268 memcpy(new->val, ecom->val, ecom->size * ecom->unit_size); 269 } else 270 new->val = NULL; 271 return new; 272 } 273 ** CID 1496728: Resource leaks (RESOURCE_LEAK) /pimd/pim_igmp.c: 1016 in pim_igmp_sock_add() ________________________________________________________________________________________________________ *** CID 1496728: Resource leaks (RESOURCE_LEAK) /pimd/pim_igmp.c: 1016 in pim_igmp_sock_add() 1010 sin.sin_family = AF_INET; 1011 sin.sin_addr = ifaddr; 1012 sin.sin_port = 0; 1013 if (bind(fd, (struct sockaddr *) &sin, sizeof(sin)) != 0) { 1014 zlog_warn("Could not bind IGMP socket for %s on %s", 1015 inet_ntoa(ifaddr), ifp->name); >>> CID 1496728: Resource leaks (RESOURCE_LEAK) >>> Handle variable "fd" going out of scope leaks the handle. 1016 return 0; 1017 } 1018 1019 igmp = igmp_sock_new(fd, ifaddr, ifp, mtrace_only); 1020 1021 igmp_read_on(igmp); ** CID 1496727: (FORWARD_NULL) /bgpd/bgp_zebra.c: 2377 in bgp_encode_pbr_rule_action() /bgpd/bgp_zebra.c: 2408 in bgp_encode_pbr_rule_action() ________________________________________________________________________________________________________ *** CID 1496727: (FORWARD_NULL) /bgpd/bgp_zebra.c: 2377 in bgp_encode_pbr_rule_action() 2371 * - FS PBR entries based on iprule 2372 * the latter may contain default routing information injected by FS 2373 */ 2374 if (pbr) 2375 stream_putl(s, pbr->unique); 2376 else >>> CID 1496727: (FORWARD_NULL) >>> Dereferencing null pointer "pbra". 2377 stream_putl(s, pbra->unique); 2378 if (pbr && pbr->flags & MATCH_IP_SRC_SET) 2379 memcpy(&pfx, &(pbr->src), sizeof(struct prefix)); 2380 else { 2381 memset(&pfx, 0, sizeof(pfx)); 2382 pfx.family = fam; /bgpd/bgp_zebra.c: 2408 in bgp_encode_pbr_rule_action() 2402 /* if pbr present, fwmark is not used */ 2403 if (pbr) 2404 stream_putl(s, 0); 2405 else 2406 stream_putl(s, pbra->fwmark); /* fwmark */ 2407 >>> CID 1496727: (FORWARD_NULL) >>> Dereferencing null pointer "pbra". 2408 stream_putl(s, pbra->table_id); 2409 2410 stream_putl(s, 0); /* ifindex unused */ 2411 } 2412 2413 static void bgp_encode_pbr_ipset_match(struct stream *s, ** CID 1496726: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1234 in ecommunity_strip() ________________________________________________________________________________________________________ *** CID 1496726: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1234 in ecommunity_strip() 1228 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); 1229 ecom->size = 0; 1230 return true; 1231 } 1232 1233 /* Strip matching ext community(ies). */ >>> CID 1496726: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - found) * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - found) * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1234 new = XMALLOC(MTYPE_ECOMMUNITY_VAL, 1235 (ecom->size - found) * ecom->unit_size); 1236 q = new; 1237 for (c = 0, p = ecom->val; c < ecom->size; c++, p += ecom->unit_size) { 1238 if (!(p[0] == type && p[1] == subtype)) { 1239 memcpy(q, p, ecom->unit_size); ** CID 1496725: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 294 in ecommunity_merge() /bgpd/bgp_ecommunity.c: 289 in ecommunity_merge() /bgpd/bgp_ecommunity.c: 299 in ecommunity_merge() ________________________________________________________________________________________________________ *** CID 1496725: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 294 in ecommunity_merge() 288 ecom1->val = 289 XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom1->val, 290 (ecom1->size + ecom2->size) * 291 ecom1->unit_size); 292 else 293 ecom1->val = >>> CID 1496725: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom1->size + ecom2->size) * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom1->size + ecom2->size) * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 294 XMALLOC(MTYPE_ECOMMUNITY_VAL, 295 (ecom1->size + ecom2->size) * 296 ecom1->unit_size); 297 298 memcpy(ecom1->val + (ecom1->size * ecom1->unit_size), ecom2->val, 299 ecom2->size * ecom1->unit_size); /bgpd/bgp_ecommunity.c: 289 in ecommunity_merge() 283 /* Merge two Extended Communities Attribute structure. */ 284 struct ecommunity *ecommunity_merge(struct ecommunity *ecom1, 285 struct ecommunity *ecom2) 286 { 287 if (ecom1->val) 288 ecom1->val = >>> CID 1496725: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom1->size + ecom2->size) * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom1->size + ecom2->size) * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 289 XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom1->val, 290 (ecom1->size + ecom2->size) * 291 ecom1->unit_size); 292 else 293 ecom1->val = 294 XMALLOC(MTYPE_ECOMMUNITY_VAL, /bgpd/bgp_ecommunity.c: 299 in ecommunity_merge() 293 ecom1->val = 294 XMALLOC(MTYPE_ECOMMUNITY_VAL, 295 (ecom1->size + ecom2->size) * 296 ecom1->unit_size); 297 298 memcpy(ecom1->val + (ecom1->size * ecom1->unit_size), ecom2->val, >>> CID 1496725: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom2->size * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom2->size * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 299 ecom2->size * ecom1->unit_size); 300 ecom1->size += ecom2->size; 301 302 return ecom1; 303 } 304 ** CID 1496724: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1275 in ecommunity_del_val() /bgpd/bgp_ecommunity.c: 1273 in ecommunity_del_val() /bgpd/bgp_ecommunity.c: 1279 in ecommunity_del_val() ________________________________________________________________________________________________________ *** CID 1496724: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 1275 in ecommunity_del_val() 1269 return false; 1270 1271 /* Delete the selected value */ 1272 ecom->size--; 1273 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1274 if (c != 0) >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "c * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "c * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1275 memcpy(p, ecom->val, c * ecom->unit_size); 1276 if ((ecom->size - c) != 0) 1277 memcpy(p + (c)*ecom->unit_size, 1278 ecom->val + (c + 1) * ecom->unit_size, 1279 (ecom->size - c) * ecom->unit_size); 1280 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); /bgpd/bgp_ecommunity.c: 1273 in ecommunity_del_val() 1267 } 1268 if (found == 0) 1269 return false; 1270 1271 /* Delete the selected value */ 1272 ecom->size--; >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1273 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1274 if (c != 0) 1275 memcpy(p, ecom->val, c * ecom->unit_size); 1276 if ((ecom->size - c) != 0) 1277 memcpy(p + (c)*ecom->unit_size, 1278 ecom->val + (c + 1) * ecom->unit_size, /bgpd/bgp_ecommunity.c: 1279 in ecommunity_del_val() 1273 p = XMALLOC(MTYPE_ECOMMUNITY_VAL, ecom->size * ecom->unit_size); 1274 if (c != 0) 1275 memcpy(p, ecom->val, c * ecom->unit_size); 1276 if ((ecom->size - c) != 0) 1277 memcpy(p + (c)*ecom->unit_size, 1278 ecom->val + (c + 1) * ecom->unit_size, >>> CID 1496724: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom->unit_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - c) * ecom->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - c) * ecom->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 1279 (ecom->size - c) * ecom->unit_size); 1280 XFREE(MTYPE_ECOMMUNITY_VAL, ecom->val); 1281 ecom->val = p; 1282 return true; 1283 } 1284 ** CID 1496723: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 162 in ecommunity_add_val_internal() /bgpd/bgp_ecommunity.c: 156 in ecommunity_add_val_internal() /bgpd/bgp_ecommunity.c: 104 in ecommunity_add_val_internal() ________________________________________________________________________________________________________ *** CID 1496723: (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 162 in ecommunity_add_val_internal() 156 ecom->val = XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom->val, 157 ecom_length_size(ecom, ecom_size)); 158 159 160 memmove(ecom->val + ((ins_idx + 1) * ecom_size), 161 ecom->val + (ins_idx * ecom_size), >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "(ecom->size - 1 - ins_idx) * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "(ecom->size - 1 - ins_idx) * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 162 (ecom->size - 1 - ins_idx) * ecom_size); 163 memcpy(ecom->val + (ins_idx * ecom_size), 164 eval, ecom_size); 165 166 return true; 167 } /bgpd/bgp_ecommunity.c: 156 in ecommunity_add_val_internal() 150 151 if (ins_idx == -1) 152 ins_idx = c; 153 154 /* Add the value to the structure with numerical sorting. */ 155 ecom->size++; >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 156 ecom->val = XREALLOC(MTYPE_ECOMMUNITY_VAL, ecom->val, 157 ecom_length_size(ecom, ecom_size)); 158 159 160 memmove(ecom->val + ((ins_idx + 1) * ecom_size), 161 ecom->val + (ins_idx * ecom_size), /bgpd/bgp_ecommunity.c: 104 in ecommunity_add_val_internal() 98 const struct ecommunity_val_ipv6 *eval6 = 99 (struct ecommunity_val_ipv6 *)eval; 100 101 /* When this is fist value, just add it. */ 102 if (ecom->val == NULL) { 103 ecom->size = 1; >>> CID 1496723: (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom_size" with type "uint8_t" (8 bits, unsigned) is promoted in "ecom->size * ecom_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom->size * ecom_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 104 ecom->val = XMALLOC(MTYPE_ECOMMUNITY_VAL, 105 ecom_length_size(ecom, ecom_size)); 106 memcpy(ecom->val, eval, ecom_size); 107 return true; 108 } 109 ** CID 1496722: Incorrect expression (USELESS_CALL) ________________________________________________________________________________________________________ *** CID 1496722: Incorrect expression (USELESS_CALL) /bgpd/bgp_flowspec_vty.c: 276 in route_vty_out_flowspec() 270 char timebuf[BGP_UPTIME_LEN]; 271 struct bgp_dest *dest = NULL; 272 273 if (path) 274 dest = path->net; 275 if (dest) >>> CID 1496722: Incorrect expression (USELESS_CALL) >>> Calling "bgp_dest_get_bgp_table_info(dest)" is only useful for its return value, which is ignored. 276 bgp_dest_get_bgp_table_info(dest); 277 if (p == NULL || p->family != AF_FLOWSPEC) 278 return; 279 if (json_paths) { 280 if (display == NLRI_STRING_FORMAT_JSON) 281 json_nlri_path = json_object_new_object(); ** CID 1496721: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 367 in ecommunity_cmp() ________________________________________________________________________________________________________ *** CID 1496721: Integer handling issues (SIGN_EXTENSION) /bgpd/bgp_ecommunity.c: 367 in ecommunity_cmp() 361 return false; 362 363 if (ecom1->unit_size != ecom2->unit_size) 364 return false; 365 366 return (ecom1->size == ecom2->size >>> CID 1496721: Integer handling issues (SIGN_EXTENSION) >>> Suspicious implicit sign extension: "ecom1->unit_size" with type "uint8_t const" (8 bits, unsigned) is promoted in "ecom1->size * ecom1->unit_size" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "ecom1->size * ecom1->unit_size" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. 367 && memcmp(ecom1->val, ecom2->val, ecom1->size * 368 ecom1->unit_size) == 0); 369 } 370 371 /* Initialize Extended Comminities related hash. */ 372 void ecommunity_init(void) ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 26 Aug '20

26 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 58 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 58 defect(s) ** CID 1496712: Incorrect expression (IDENTICAL_BRANCHES) /ospfd/ospf_ext.c: 589 in ospf_ext_link_delete_adj_sid() ________________________________________________________________________________________________________ *** CID 1496712: Incorrect expression (IDENTICAL_BRANCHES) /ospfd/ospf_ext.c: 589 in ospf_ext_link_delete_adj_sid() 583 { 584 /* Process only (LAN)Adjacency-SID Type */ 585 if (exti->stype != ADJ_SID && exti->stype != LAN_ADJ_SID) 586 return; 587 588 /* Release Primary & Backup Labels from Label Manager */ >>> CID 1496712: Incorrect expression (IDENTICAL_BRANCHES) >>> The same code is executed regardless of whether "exti->stype == ADJ_SID" is true, because the 'then' and 'else' branches are identical. Should one of the branches be modified, or the entire 'if' statement replaced? 589 if (exti->stype == ADJ_SID) { 590 ospf_sr_local_block_release_label(exti->adj_sid[0].value); 591 ospf_sr_local_block_release_label(exti->adj_sid[1].value); 592 } else { 593 ospf_sr_local_block_release_label(exti->adj_sid[0].value); 594 ospf_sr_local_block_release_label(exti->adj_sid[1].value); ** CID 1496711: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496711: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2319 in no_sr_node_msd() 2313 OspfSR.msd = 0; 2314 if (OspfSR.self != NULL) 2315 OspfSR.self->msd = 0; 2316 2317 /* Set Router Information parameters if SR is UP */ 2318 if (OspfSR.status == SR_UP) >>> CID 1496711: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2319 ospf_router_info_update_sr(true, OspfSR.self); 2320 2321 return CMD_SUCCESS; 2322 } 2323 2324 DEFUN (sr_prefix_sid, ** CID 1496710: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496710: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2078 in update_srgb() 2072 OspfSR.srgb.reserved = true; 2073 2074 osr_debug("SR(%s): Got new SRGB [%u/%u]", __func__, OspfSR.srgb.start, 2075 OspfSR.srgb.start + OspfSR.srgb.size - 1); 2076 2077 /* SRGB is reserved, set Router Information parameters */ >>> CID 1496710: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2078 ospf_router_info_update_sr(true, OspfSR.self); 2079 2080 /* and update NHLFE entries */ 2081 hash_iterate(OspfSR.neighbors, 2082 (void (*)(struct hash_bucket *, void *))update_in_nhlfe, 2083 NULL); ** CID 1496709: Control flow issues (DEADCODE) /bgpd/bgp_vty.c: 12806 in bgp_show_all_instances_neighbors_vty() ________________________________________________________________________________________________________ *** CID 1496709: Control flow issues (DEADCODE) /bgpd/bgp_vty.c: 12806 in bgp_show_all_instances_neighbors_vty() 12800 json = NULL; 12801 } 12802 12803 if (use_json) { 12804 vty_out(vty, "}\n"); 12805 if (json) >>> CID 1496709: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "json_object_free(json);". 12806 json_object_free(json); 12807 } 12808 else if (!nbr_output) 12809 vty_out(vty, "%% BGP instance not found\n"); 12810 } 12811 ** CID 1496708: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496708: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2254 in no_sr_local_label_range() 2248 2249 /* SRLB is reserved, Update Self SR-Node and Router Information LSA */ 2250 if (OspfSR.self != NULL) { 2251 OspfSR.self->srlb.lower_bound = DEFAULT_SRLB_LABEL; 2252 OspfSR.self->srlb.range_size = DEFAULT_SRLB_SIZE; 2253 } >>> CID 1496708: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2254 ospf_router_info_update_sr(true, OspfSR.self); 2255 2256 /* and update (LAN)-Adjacency SID */ 2257 ospf_ext_link_srlb_update(); 2258 2259 return CMD_SUCCESS; ** CID 1496707: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496707: Null pointer dereferences (FORWARD_NULL) /ospfd/ospf_sr.c: 2295 in sr_node_msd() 2289 OspfSR.msd = msd; 2290 if (OspfSR.self != NULL) 2291 OspfSR.self->msd = msd; 2292 2293 /* Set Router Information parameters if SR is UP */ 2294 if (OspfSR.status == SR_UP) >>> CID 1496707: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "OspfSR.self" to "ospf_router_info_update_sr", which dereferences it. 2295 ospf_router_info_update_sr(true, OspfSR.self); 2296 2297 return CMD_SUCCESS; 2298 } 2299 2300 DEFUN (no_sr_node_msd, ** CID 1496706: Performance inefficiencies (PASS_BY_VALUE) /ospfd/ospf_ri.c: 576 in is_mandated_params_set() ________________________________________________________________________________________________________ *** CID 1496706: Performance inefficiencies (PASS_BY_VALUE) /ospfd/ospf_ri.c: 576 in is_mandated_params_set() 570 | PCE_CAP_ADDITIVE | PCE_CAP_MULTIPLE_REQ; 571 set_pce_cap_flag(cap, &ori->pce_info); 572 573 return; 574 } 575 >>> CID 1496706: Performance inefficiencies (PASS_BY_VALUE) >>> Passing parameter ori of type "struct ospf_router_info" (size 136 bytes) by value. 576 static int is_mandated_params_set(struct ospf_router_info ori) 577 { 578 int rc = 0; 579 580 if (ntohs(ori.router_cap.header.type) == 0) 581 return rc; ** CID 1496643: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496643: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_evpn_mh.c: 362 in zebra_evpn_es_evi_show_vni() 356 vty_out(vty, "%-8s %-30s %-4s\n", "VNI", "ESI", "Type"); 357 } 358 } else { 359 if (!uj) 360 vty_out(vty, "VNI %d doesn't exist\n", vni); 361 } >>> CID 1496643: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "zevpn" to "zebra_evpn_es_evi_show_one_evpn", which dereferences it. 362 zebra_evpn_es_evi_show_one_evpn(zevpn, vty, json, detail); 363 } 364 365 /* Initialize the ES tables maintained per-L2_VNI */ 366 void zebra_evpn_evpn_es_init(zebra_evpn_t *zevpn) 367 { ** CID 1496642: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496642: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_route.c: 3073 in bgp_filtered_routes_count() 3067 3068 for (dest = bgp_table_top(table); dest; dest = bgp_route_next(dest)) { 3069 for (ain = dest->adj_in; ain; ain = ain->next) { 3070 const struct prefix *rn_p = bgp_dest_get_prefix(dest); 3071 struct attr attr = {}; 3072 >>> CID 1496642: Null pointer dereferences (FORWARD_NULL) >>> Passing "&attr" to "bgp_input_filter", which dereferences null "attr.aspath". 3073 if (bgp_input_filter(peer, rn_p, &attr, afi, safi) 3074 == FILTER_DENY) 3075 filtered = true; 3076 3077 if (bgp_input_modifier( 3078 peer, rn_p, &attr, afi, safi, ** CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) /zebra/zebra_evpn_mh.c: 1690 in zebra_evpn_es_cleanup() 1684 struct zebra_evpn_es *es; 1685 struct zebra_evpn_es *es_next; 1686 1687 RB_FOREACH_SAFE(es, zebra_es_rb_head, 1688 &zmh_info->es_rb_tree, es_next) { 1689 zebra_evpn_local_es_del(es); >>> CID 1496617: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "zebra_evpn_remote_es_flush" dereferences freed pointer "es". 1690 zebra_evpn_remote_es_flush(es); 1691 } 1692 } 1693 1694 /* Only certain types of access ports can be setup as an Ethernet Segment */ 1695 bool zebra_evpn_is_if_es_capable(struct zebra_if *zif) ** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 486 in seqnumber_mismatch() 480 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 481 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 482 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 483 484 ospf6_lsdb_remove_all(on->summary_list); 485 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 486 for (ALL_LSDB(on->retrans_list, lsa)) { 487 ospf6_decrement_retrans_count(lsa); 488 ospf6_lsdb_remove(lsa, on->retrans_list); 489 } 490 491 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2306 in ospf6_lsack_send_neighbor() 2300 2301 memset(sendbuf, 0, iobuflen); 2302 oh = (struct ospf6_header *)sendbuf; 2303 2304 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2305 >>> CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2306 for (ALL_LSDB(on->lsack_list, lsa)) { 2307 /* MTU check */ 2308 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2309 > ospf6_packet_max(on->ospf6_if)) { 2310 /* if we run out of packet size/space here, 2311 better to try again soon. */ ** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2223 in ospf6_lsupdate_send_interface() 2217 lsupdate = (struct ospf6_lsupdate *)((caddr_t)oh 2218 + sizeof(struct ospf6_header)); 2219 2220 p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 2221 lsa_cnt = 0; 2222 >>> CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2223 for (ALL_LSDB(oi->lsupdate_list, lsa)) { 2224 /* MTU check */ 2225 if ((p - sendbuf + ((unsigned int)OSPF6_LSA_SIZE(lsa->header))) 2226 > ospf6_packet_max(oi)) { 2227 if (lsa_cnt) { 2228 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; ** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 306 in ospf6_lsdb_remove_all() 300 { 301 struct ospf6_lsa *lsa; 302 303 if (lsdb == NULL) 304 return; 305 >>> CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 306 for (ALL_LSDB(lsdb, lsa)) 307 ospf6_lsdb_remove(lsa, lsdb); 308 } 309 310 void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa) 311 { ** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 125 in ospf6_neighbor_delete() 119 void ospf6_neighbor_delete(struct ospf6_neighbor *on) 120 { 121 struct ospf6_lsa *lsa; 122 123 ospf6_lsdb_remove_all(on->summary_list); 124 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 125 for (ALL_LSDB(on->retrans_list, lsa)) { 126 ospf6_decrement_retrans_count(lsa); 127 ospf6_lsdb_remove(lsa, on->retrans_list); 128 } 129 130 ospf6_lsdb_remove_all(on->dbdesc_list); ** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1872 in ospf6_dbdesc_send_newone() 1866 ospf6_lsdb_remove_all(on->dbdesc_list); 1867 1868 /* move LSAs from summary_list to dbdesc_list (within neighbor 1869 structure) 1870 so that ospf6_send_dbdesc () can send those LSAs */ 1871 size = sizeof(struct ospf6_lsa_header) + sizeof(struct ospf6_dbdesc); >>> CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 1872 for (ALL_LSDB(on->summary_list, lsa)) { 1873 if (size + sizeof(struct ospf6_lsa_header) 1874 > ospf6_packet_max(on->ospf6_if)) { 1875 ospf6_lsdb_lsa_unlock(lsa); 1876 break; 1877 } ** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 523 in bad_lsreq() 517 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 518 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 519 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 520 521 ospf6_lsdb_remove_all(on->summary_list); 522 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 523 for (ALL_LSDB(on->retrans_list, lsa)) { 524 ospf6_decrement_retrans_count(lsa); 525 ospf6_lsdb_remove(lsa, on->retrans_list); 526 } 527 528 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 310 in negotiation_done() 304 if (IS_OSPF6_DEBUG_NEIGHBOR(EVENT)) 305 zlog_debug("Neighbor Event %s: *NegotiationDone*", on->name); 306 307 /* clear ls-list */ 308 ospf6_lsdb_remove_all(on->summary_list); 309 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 310 for (ALL_LSDB(on->retrans_list, lsa)) { 311 ospf6_decrement_retrans_count(lsa); 312 ospf6_lsdb_remove(lsa, on->retrans_list); 313 } 314 315 /* Interface scoped LSAs */ ** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 324 in ospf6_lsdb_maxage_remover() 318 319 int ospf6_lsdb_maxage_remover(struct ospf6_lsdb *lsdb) 320 { 321 int reschedule = 0; 322 struct ospf6_lsa *lsa; 323 >>> CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 324 for (ALL_LSDB(lsdb, lsa)) { 325 if (!OSPF6_LSA_IS_MAXAGE(lsa)) 326 continue; 327 if (lsa->retrans_count != 0) { 328 reschedule = 1; 329 continue; ** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2385 in ospf6_lsack_send_interface() 2379 2380 memset(sendbuf, 0, iobuflen); 2381 oh = (struct ospf6_header *)sendbuf; 2382 2383 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2384 >>> CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2385 for (ALL_LSDB(oi->lsack_list, lsa)) { 2386 /* MTU check */ 2387 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2388 > ospf6_packet_max(oi)) { 2389 /* if we run out of packet size/space here, 2390 better to try again soon. */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 21 Aug '20

21 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 56 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1496687: Error handling issues (CHECKED_RETURN) /vrrpd/vrrp_packet.c: 95 in vrrp_pkt_checksum() ________________________________________________________________________________________________________ *** CID 1496687: Error handling issues (CHECKED_RETURN) /vrrpd/vrrp_packet.c: 95 in vrrp_pkt_checksum() 89 ph.next_hdr = IPPROTO_VRRP; 90 chksum = in_cksum_with_ph6(&ph, pkt, pktsize); 91 } else if (!v6 && ((pkt->hdr.vertype >> 4) == 3)) { 92 struct ipv4_ph ph = {}; 93 94 ph.src = src->ipaddr_v4; >>> CID 1496687: Error handling issues (CHECKED_RETURN) >>> Calling "inet_pton" without checking return value (as is done elsewhere 15 out of 16 times). 95 inet_pton(AF_INET, VRRP_MCASTV4_GROUP_STR, &ph.dst); 96 ph.proto = IPPROTO_VRRP; 97 ph.len = htons(pktsize); 98 chksum = in_cksum_with_ph4(&ph, pkt, pktsize); 99 } else if (!v6 && ((pkt->hdr.vertype >> 4) == 2)) { 100 chksum = in_cksum(pkt, pktsize); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

BGP-LS Design
by Abhijit Chaudhary 18 Aug '20

18 Aug '20

Dear Olivier, Thanks Olivier for sharing the BGP-LS source code. The team at Niral had reviewed the code, RFC and came up with a high level design. Dear All, Kindly find the BGP-LS design - https://github.com/Niral-Networks/docs/blob/master/FRR-BGP-LS-Design.pdf. We can discuss it during the Telco call tomorrow. Best, - Abhijit +91-9886179612 <http://www.niralnetworks.com/> Building Curated, Open, Disaggregated Networking for 5G and Beyond According to DSCI report, A NASSCOM Initiative, Niral Networks is a key 5G technology player from India <https://www.nasscom.in/sites/default/files/TechSagar_Wireless_and_Networkin…> ---------------------------------------------------------------------- >> >> Message: 1 >> Date: Fri, 24 Jul 2020 18:19:14 +0200 >> From: <olivier.dugeon(a)orange.com> >> To: dev <dev(a)lists.frrouting.org> >> Cc: CRISTIAN ALVARO ALBA ARRIETA <cristian.alba.a(a)uni.pe> >> Subject: [dev] Telco meeting status >> Message-ID: <cf9a4877-20ee-fda0-217f-b291615176a5(a)orange.com> >> Content-Type: text/plain; charset="utf-8" >> >> Dear all, >> >> Following the last Telco meeting, I updated the Wiki page to reflect our >> new usage >> of GitHub Project management facilities: >> https://github.com/FRRouting/frr/wiki/FRR-Telco-SP-projects >> >> Regarding BGP-LS, there is already a #Telco channel on Slack with very >> few discussions. >> So, I propose to use this #Telco channel to discuss on-going development >> around BGP-LS. >> >> Cristain (in Cc:) started its internship within Orange one month ago. >> He'll join >> Slack soon. Cristian started to backport our old BGP-LS code to FRR. >> Please, interact >> with him through Slack to discuss how to organise the work and progress. >> >> As mentioned, I'll start 3 weeks vacations this evening. So, fill free to >> maintain or >> cancel the next Telco meeting in 2 weeks. Allistair will manage it. >> >> Finally, I'll push a preview of Link State PR as WIP. Look at the doxygen >> doc within >> link_state.h for details and usage. >> >> Enjoy your summer. >> >> Regards >> >> Olivier >> >>

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 15 Aug '20

15 Aug '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 16 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 15 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 16 of 16 defect(s) ** CID 1496644: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_evpn_neigh.c: 722 in zebra_evpn_proc_sync_neigh_update() ________________________________________________________________________________________________________ *** CID 1496644: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_evpn_neigh.c: 722 in zebra_evpn_proc_sync_neigh_update() 716 if (old_bgp_ready) { 717 zebra_evpn_neigh_send_del_to_client( 718 zevpn->vni, &n->ip, &n->emac, n->flags, 719 n->state, false /*force*/); 720 old_bgp_ready = false; 721 } >>> CID 1496644: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "n->mac" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 722 if (n->mac) 723 zebra_evpn_local_neigh_deref_mac( 724 n, false /*send_mac_update*/); 725 } 726 /* clear old fwd info */ 727 n->rem_seq = 0; ** CID 1496643: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1496643: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_evpn_mh.c: 362 in zebra_evpn_es_evi_show_vni() 356 vty_out(vty, "%-8s %-30s %-4s\n", "VNI", "ESI", "Type"); 357 } 358 } else { 359 if (!uj) 360 vty_out(vty, "VNI %d doesn't exist\n", vni); 361 } >>> CID 1496643: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "zevpn" to "zebra_evpn_es_evi_show_one_evpn", which dereferences it. 362 zebra_evpn_es_evi_show_one_evpn(zevpn, vty, json, detail); 363 } 364 365 /* Initialize the ES tables maintained per-L2_VNI */ 366 void zebra_evpn_evpn_es_init(zebra_evpn_t *zevpn) 367 { ** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 486 in seqnumber_mismatch() 480 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 481 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 482 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 483 484 ospf6_lsdb_remove_all(on->summary_list); 485 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 486 for (ALL_LSDB(on->retrans_list, lsa)) { 487 ospf6_decrement_retrans_count(lsa); 488 ospf6_lsdb_remove(lsa, on->retrans_list); 489 } 490 491 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2306 in ospf6_lsack_send_neighbor() 2300 2301 memset(sendbuf, 0, iobuflen); 2302 oh = (struct ospf6_header *)sendbuf; 2303 2304 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2305 >>> CID 1486266: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2306 for (ALL_LSDB(on->lsack_list, lsa)) { 2307 /* MTU check */ 2308 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2309 > ospf6_packet_max(on->ospf6_if)) { 2310 /* if we run out of packet size/space here, 2311 better to try again soon. */ ** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2223 in ospf6_lsupdate_send_interface() 2217 lsupdate = (struct ospf6_lsupdate *)((caddr_t)oh 2218 + sizeof(struct ospf6_header)); 2219 2220 p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 2221 lsa_cnt = 0; 2222 >>> CID 1486265: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2223 for (ALL_LSDB(oi->lsupdate_list, lsa)) { 2224 /* MTU check */ 2225 if ((p - sendbuf + ((unsigned int)OSPF6_LSA_SIZE(lsa->header))) 2226 > ospf6_packet_max(oi)) { 2227 if (lsa_cnt) { 2228 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; ** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 306 in ospf6_lsdb_remove_all() 300 { 301 struct ospf6_lsa *lsa; 302 303 if (lsdb == NULL) 304 return; 305 >>> CID 1486264: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 306 for (ALL_LSDB(lsdb, lsa)) 307 ospf6_lsdb_remove(lsa, lsdb); 308 } 309 310 void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa) 311 { ** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 125 in ospf6_neighbor_delete() 119 void ospf6_neighbor_delete(struct ospf6_neighbor *on) 120 { 121 struct ospf6_lsa *lsa; 122 123 ospf6_lsdb_remove_all(on->summary_list); 124 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486263: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 125 for (ALL_LSDB(on->retrans_list, lsa)) { 126 ospf6_decrement_retrans_count(lsa); 127 ospf6_lsdb_remove(lsa, on->retrans_list); 128 } 129 130 ospf6_lsdb_remove_all(on->dbdesc_list); ** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1872 in ospf6_dbdesc_send_newone() 1866 ospf6_lsdb_remove_all(on->dbdesc_list); 1867 1868 /* move LSAs from summary_list to dbdesc_list (within neighbor 1869 structure) 1870 so that ospf6_send_dbdesc () can send those LSAs */ 1871 size = sizeof(struct ospf6_lsa_header) + sizeof(struct ospf6_dbdesc); >>> CID 1486262: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 1872 for (ALL_LSDB(on->summary_list, lsa)) { 1873 if (size + sizeof(struct ospf6_lsa_header) 1874 > ospf6_packet_max(on->ospf6_if)) { 1875 ospf6_lsdb_lsa_unlock(lsa); 1876 break; 1877 } ** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 523 in bad_lsreq() 517 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 518 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 519 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 520 521 ospf6_lsdb_remove_all(on->summary_list); 522 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486261: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 523 for (ALL_LSDB(on->retrans_list, lsa)) { 524 ospf6_decrement_retrans_count(lsa); 525 ospf6_lsdb_remove(lsa, on->retrans_list); 526 } 527 528 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 310 in negotiation_done() 304 if (IS_OSPF6_DEBUG_NEIGHBOR(EVENT)) 305 zlog_debug("Neighbor Event %s: *NegotiationDone*", on->name); 306 307 /* clear ls-list */ 308 ospf6_lsdb_remove_all(on->summary_list); 309 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486260: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 310 for (ALL_LSDB(on->retrans_list, lsa)) { 311 ospf6_decrement_retrans_count(lsa); 312 ospf6_lsdb_remove(lsa, on->retrans_list); 313 } 314 315 /* Interface scoped LSAs */ ** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 324 in ospf6_lsdb_maxage_remover() 318 319 int ospf6_lsdb_maxage_remover(struct ospf6_lsdb *lsdb) 320 { 321 int reschedule = 0; 322 struct ospf6_lsa *lsa; 323 >>> CID 1486259: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 324 for (ALL_LSDB(lsdb, lsa)) { 325 if (!OSPF6_LSA_IS_MAXAGE(lsa)) 326 continue; 327 if (lsa->retrans_count != 0) { 328 reschedule = 1; 329 continue; ** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2385 in ospf6_lsack_send_interface() 2379 2380 memset(sendbuf, 0, iobuflen); 2381 oh = (struct ospf6_header *)sendbuf; 2382 2383 p = (uint8_t *)((caddr_t)oh + sizeof(struct ospf6_header)); 2384 >>> CID 1486258: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2385 for (ALL_LSDB(oi->lsack_list, lsa)) { 2386 /* MTU check */ 2387 if (p - sendbuf + sizeof(struct ospf6_lsa_header) 2388 > ospf6_packet_max(oi)) { 2389 /* if we run out of packet size/space here, 2390 better to try again soon. */ ** CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2040 in ospf6_lsupdate_send_neighbor() 2034 2035 p = (uint8_t *)((caddr_t)lsupdate + sizeof(struct ospf6_lsupdate)); 2036 lsa_cnt = 0; 2037 2038 /* lsupdate_list lists those LSA which doesn't need to be 2039 retransmitted. remove those from the list */ >>> CID 1486256: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 2040 for (ALL_LSDB(on->lsupdate_list, lsa)) { 2041 /* MTU check */ 2042 if ((p - sendbuf + (unsigned int)OSPF6_LSA_SIZE(lsa->header)) 2043 > ospf6_packet_max(on->ospf6_if)) { 2044 if (lsa_cnt) { 2045 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; ** CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 558 in oneway_received() 552 ospf6_neighbor_state_change(OSPF6_NEIGHBOR_INIT, on, 553 OSPF6_NEIGHBOR_EVENT_ONEWAY_RCVD); 554 thread_add_event(master, neighbor_change, on->ospf6_if, 0, NULL); 555 556 ospf6_lsdb_remove_all(on->summary_list); 557 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486255: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 558 for (ALL_LSDB(on->retrans_list, lsa)) { 559 ospf6_decrement_retrans_count(lsa); 560 ospf6_lsdb_remove(lsa, on->retrans_list); 561 } 562 563 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 455 in adj_ok() 449 450 } else if (on->state >= OSPF6_NEIGHBOR_EXSTART && !need_adjacency(on)) { 451 ospf6_neighbor_state_change(OSPF6_NEIGHBOR_TWOWAY, on, 452 OSPF6_NEIGHBOR_EVENT_ADJ_OK); 453 ospf6_lsdb_remove_all(on->summary_list); 454 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 455 for (ALL_LSDB(on->retrans_list, lsa)) { 456 ospf6_decrement_retrans_count(lsa); 457 ospf6_lsdb_remove(lsa, on->retrans_list); 458 } 459 } 460 ** CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1950 in ospf6_lsreq_send() 1944 } 1945 1946 if (last_req != NULL) { 1947 if (on->last_ls_req != NULL) 1948 on->last_ls_req = ospf6_lsa_unlock(on->last_ls_req); 1949 >>> CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 1950 ospf6_lsa_lock(last_req); 1951 on->last_ls_req = last_req; 1952 } 1953 1954 oh->type = OSPF6_MESSAGE_TYPE_LSREQ; 1955 oh->length = htons(p - sendbuf); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0