- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 15 Apr '20

15 Apr '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 5 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1492630: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1492630: Memory - corruptions (OVERRUN) /zebra/rule_netlink.c: 358 in netlink_request_rules() 352 memset(&req, 0, sizeof(req)); 353 req.n.nlmsg_type = type; 354 req.n.nlmsg_flags = NLM_F_ROOT | NLM_F_MATCH | NLM_F_REQUEST; 355 req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct fib_rule_hdr)); 356 req.frh.family = family; 357 >>> CID 1492630: Memory - corruptions (OVERRUN) >>> Overrunning struct type nlmsghdr of 16 bytes by passing it to a function which accesses it at byte offset 27 using argument "req.n.nlmsg_len" (which evaluates to 28). 358 return netlink_request(&zns->netlink_cmd, &req.n); 359 } 360 361 /* 362 * Get to know existing PBR rules in the kernel - typically called at startup. 363 */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/ls/click?upn=nJaKvJSIH-2FPAfmty-2BK5tYpPkl…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 13 Apr '20

13 Apr '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 19 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 16 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 19 of 19 defect(s) ** CID 1492577: Control flow issues (DEADCODE) /zebra/zebra_nhg.c: 1478 in zebra_nhg_rib_find_nhe() ________________________________________________________________________________________________________ *** CID 1492577: Control flow issues (DEADCODE) /zebra/zebra_nhg.c: 1478 in zebra_nhg_rib_find_nhe() 1472 flog_err(EC_ZEBRA_TABLE_LOOKUP_FAILED, 1473 "No nexthop passed to %s", __func__); 1474 return NULL; 1475 } 1476 1477 if (IS_ZEBRA_DEBUG_NHG_DETAIL) >>> CID 1492577: Control flow issues (DEADCODE) >>> Execution cannot reach the expression "0U" inside this statement: "zlog_debug("%s: rt_nhe %p (...". 1478 zlog_debug("%s: rt_nhe %p (%u)", 1479 __func__, rt_nhe, 1480 rt_nhe ? rt_nhe->id : 0); 1481 1482 zebra_nhe_find(&nhe, rt_nhe, NULL, rt_afi); 1483 ** CID 1492576: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_nhg.c: 492 in nhg_compare_nexthops() ________________________________________________________________________________________________________ *** CID 1492576: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_nhg.c: 492 in nhg_compare_nexthops() 486 * -> 1.1.2.1 dummy2 (inactive) 487 * 488 * Without checking each individual one, they would hash to 489 * the same group and both have 1.1.1.1 dummy1 marked inactive. 490 * 491 */ >>> CID 1492576: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "nh1". 492 if (CHECK_FLAG(nh1->flags, NEXTHOP_FLAG_ACTIVE) 493 != CHECK_FLAG(nh2->flags, NEXTHOP_FLAG_ACTIVE)) 494 return false; 495 496 if (!nexthop_same(nh1, nh2)) 497 return false; ** CID 1492575: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_dplane.c: 1584 in dplane_ctx_route_init() ________________________________________________________________________________________________________ *** CID 1492575: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_dplane.c: 1584 in dplane_ctx_route_init() 1578 /* Extract ns info - can't use pointers to 'core' structs */ 1579 zvrf = vrf_info_lookup(re->vrf_id); 1580 zns = zvrf->zns; 1581 dplane_ctx_ns_init(ctx, zns, (op == DPLANE_OP_ROUTE_UPDATE)); 1582 1583 #ifdef HAVE_NETLINK >>> CID 1492575: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "re->nhe" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1584 if (re->nhe) { 1585 struct nhg_hash_entry *nhe = zebra_nhg_resolve(re->nhe); 1586 1587 ctx->u.rinfo.nhe.id = nhe->id; 1588 /* 1589 * Check if the nhe is installed/queued before doing anything ** CID 1492574: (REVERSE_INULL) /zebra/zebra_nhg.c: 1577 in zebra_nhg_free() /zebra/zebra_nhg.c: 1572 in zebra_nhg_free() ________________________________________________________________________________________________________ *** CID 1492574: (REVERSE_INULL) /zebra/zebra_nhg.c: 1577 in zebra_nhg_free() 1571 __func__, nhe, 1572 (nhe ? nhe->id : 0), 1573 (nhe ? nhe->refcnt : 0)); 1574 else 1575 zlog_debug("%s: nhe %p (%u), refcnt %d, NH %pNHv", 1576 __func__, nhe, >>> CID 1492574: (REVERSE_INULL) >>> Null-checking "nhe" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1577 (nhe ? nhe->id : 0), 1578 (nhe ? nhe->refcnt : 0), 1579 nhe->nhg.nexthop); 1580 } 1581 1582 if (nhe->refcnt) /zebra/zebra_nhg.c: 1572 in zebra_nhg_free() 1566 { 1567 if (IS_ZEBRA_DEBUG_NHG_DETAIL) { 1568 /* Group or singleton? */ 1569 if (nhe->nhg.nexthop && nhe->nhg.nexthop->next) 1570 zlog_debug("%s: nhe %p (%u), refcnt %d", 1571 __func__, nhe, >>> CID 1492574: (REVERSE_INULL) >>> Null-checking "nhe" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1572 (nhe ? nhe->id : 0), 1573 (nhe ? nhe->refcnt : 0)); 1574 else 1575 zlog_debug("%s: nhe %p (%u), refcnt %d, NH %pNHv", 1576 __func__, nhe, 1577 (nhe ? nhe->id : 0), ** CID 1492573: Incorrect expression (COPY_PASTE_ERROR) /zebra/zebra_nhg.c: 1948 in nexthop_active() ________________________________________________________________________________________________________ *** CID 1492573: Incorrect expression (COPY_PASTE_ERROR) /zebra/zebra_nhg.c: 1948 in nexthop_active() 1942 nexthop_set_resolved(afi, newhop, nexthop); 1943 resolved = 1; 1944 } 1945 if (resolved) 1946 re->nexthop_mtu = match->mtu; 1947 >>> CID 1492573: Incorrect expression (COPY_PASTE_ERROR) >>> "zebra_debug_rib" in "zebra_debug_rib & 2UL" looks like a copy-paste error. 1948 if (!resolved && IS_ZEBRA_DEBUG_RIB_DETAILED) 1949 zlog_debug( 1950 " %s: Recursion failed to find", 1951 __func__); 1952 return resolved; 1953 } else if (re->type == ZEBRA_ROUTE_STATIC) { ** CID 1491788: Control flow issues (DEADCODE) /nhrpd/nhrp_vty.c: 626 in show_ip_nhrp_cache() ________________________________________________________________________________________________________ *** CID 1491788: Control flow issues (DEADCODE) /nhrpd/nhrp_vty.c: 626 in show_ip_nhrp_cache() 620 sockunion2str(&c->cur.peer->vc->remote.nbma, 621 buf[1], sizeof(buf[1])); 622 else 623 snprintf(buf[1], sizeof(buf[1]), "-"); 624 625 if (json) { >>> CID 1491788: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "json = json_object_new_obje...". 626 json = json_object_new_object(); 627 json_object_string_add(json, "interface", c->ifp->name); 628 json_object_string_add(json, "type", 629 nhrp_cache_type_str[c->cur.type]); 630 json_object_string_add(json, "protocol", buf[0]); 631 json_object_string_add(json, "nbma", buf[1]); ** CID 1482185: (USE_AFTER_FREE) /isisd/isis_pdu.c: 399 in process_p2p_hello() /isisd/isis_pdu.c: 399 in process_p2p_hello() /isisd/isis_pdu.c: 399 in process_p2p_hello() /isisd/isis_pdu.c: 399 in process_p2p_hello() /isisd/isis_pdu.c: 399 in process_p2p_hello() /isisd/isis_pdu.c: 399 in process_p2p_hello() /isisd/isis_pdu.c: 399 in process_p2p_hello() ________________________________________________________________________________________________________ *** CID 1482185: (USE_AFTER_FREE) /isisd/isis_pdu.c: 399 in process_p2p_hello() 393 } 394 } else { 395 /* down - area mismatch */ 396 isis_adj_state_change(adj, ISIS_ADJ_DOWN, "Area Mismatch"); 397 } 398 >>> CID 1482185: (USE_AFTER_FREE) >>> Dereferencing freed pointer "adj". 399 if (adj->adj_state == ISIS_ADJ_UP && changed) { 400 lsp_regenerate_schedule(adj->circuit->area, 401 isis_adj_usage2levels(adj->adj_usage), 402 0); 403 } 404 /isisd/isis_pdu.c: 399 in process_p2p_hello() 393 } 394 } else { 395 /* down - area mismatch */ 396 isis_adj_state_change(adj, ISIS_ADJ_DOWN, "Area Mismatch"); 397 } 398 >>> CID 1482185: (USE_AFTER_FREE) >>> Dereferencing freed pointer "adj". 399 if (adj->adj_state == ISIS_ADJ_UP && changed) { 400 lsp_regenerate_schedule(adj->circuit->area, 401 isis_adj_usage2levels(adj->adj_usage), 402 0); 403 } 404 /isisd/isis_pdu.c: 399 in process_p2p_hello() 393 } 394 } else { 395 /* down - area mismatch */ 396 isis_adj_state_change(adj, ISIS_ADJ_DOWN, "Area Mismatch"); 397 } 398 >>> CID 1482185: (USE_AFTER_FREE) >>> Dereferencing freed pointer "adj". 399 if (adj->adj_state == ISIS_ADJ_UP && changed) { 400 lsp_regenerate_schedule(adj->circuit->area, 401 isis_adj_usage2levels(adj->adj_usage), 402 0); 403 } 404 /isisd/isis_pdu.c: 399 in process_p2p_hello() 393 } 394 } else { 395 /* down - area mismatch */ 396 isis_adj_state_change(adj, ISIS_ADJ_DOWN, "Area Mismatch"); 397 } 398 >>> CID 1482185: (USE_AFTER_FREE) >>> Dereferencing freed pointer "adj". 399 if (adj->adj_state == ISIS_ADJ_UP && changed) { 400 lsp_regenerate_schedule(adj->circuit->area, 401 isis_adj_usage2levels(adj->adj_usage), 402 0); 403 } 404 /isisd/isis_pdu.c: 399 in process_p2p_hello() 393 } 394 } else { 395 /* down - area mismatch */ 396 isis_adj_state_change(adj, ISIS_ADJ_DOWN, "Area Mismatch"); 397 } 398 >>> CID 1482185: (USE_AFTER_FREE) >>> Dereferencing freed pointer "adj". 399 if (adj->adj_state == ISIS_ADJ_UP && changed) { 400 lsp_regenerate_schedule(adj->circuit->area, 401 isis_adj_usage2levels(adj->adj_usage), 402 0); 403 } 404 /isisd/isis_pdu.c: 399 in process_p2p_hello() 393 } 394 } else { 395 /* down - area mismatch */ 396 isis_adj_state_change(adj, ISIS_ADJ_DOWN, "Area Mismatch"); 397 } 398 >>> CID 1482185: (USE_AFTER_FREE) >>> Dereferencing freed pointer "adj". 399 if (adj->adj_state == ISIS_ADJ_UP && changed) { 400 lsp_regenerate_schedule(adj->circuit->area, 401 isis_adj_usage2levels(adj->adj_usage), 402 0); 403 } 404 /isisd/isis_pdu.c: 399 in process_p2p_hello() 393 } 394 } else { 395 /* down - area mismatch */ 396 isis_adj_state_change(adj, ISIS_ADJ_DOWN, "Area Mismatch"); 397 } 398 >>> CID 1482185: (USE_AFTER_FREE) >>> Dereferencing freed pointer "adj". 399 if (adj->adj_state == ISIS_ADJ_UP && changed) { 400 lsp_regenerate_schedule(adj->circuit->area, 401 isis_adj_usage2levels(adj->adj_usage), 402 0); 403 } 404 ** CID 1482173: (STRING_NULL) /watchfrr/watchfrr.c: 646 in handle_read() /watchfrr/watchfrr.c: 634 in handle_read() ________________________________________________________________________________________________________ *** CID 1482173: (STRING_NULL) /watchfrr/watchfrr.c: 646 in handle_read() 640 641 /* We are expecting an echo response: is there any chance that the 642 response would not be returned entirely in the first read? That 643 seems inconceivable... */ 644 if ((rc != sizeof(resp)) || memcmp(buf, resp, sizeof(resp))) { 645 char why[100 + sizeof(buf)]; >>> CID 1482173: (STRING_NULL) >>> Passing unterminated string "buf" to "snprintf". 646 snprintf(why, sizeof(why), 647 "read returned bad echo response of %d bytes " 648 "(expecting %u): %.*s", 649 (int)rc, (unsigned int)sizeof(resp), (int)rc, buf); 650 daemon_down(dmn, why); 651 return 0; /watchfrr/watchfrr.c: 634 in handle_read() 628 if (rc == 0) { 629 daemon_down(dmn, "read returned EOF"); 630 return 0; 631 } 632 if (!dmn->echo_sent.tv_sec) { 633 char why[sizeof(buf) + 100]; >>> CID 1482173: (STRING_NULL) >>> Passing unterminated string "buf" to "snprintf". 634 snprintf(why, sizeof(why), 635 "unexpected read returns %d bytes: %.*s", (int)rc, 636 (int)rc, buf); 637 daemon_down(dmn, why); 638 return 0; 639 } ** CID 1482161: (TAINTED_SCALAR) /ospf6d/ospf6_spf.c: 1031 in ospf6_create_single_router_lsa() /ospf6d/ospf6_spf.c: 1061 in ospf6_create_single_router_lsa() ________________________________________________________________________________________________________ *** CID 1482161: (TAINTED_SCALAR) /ospf6d/ospf6_spf.c: 1011 in ospf6_create_single_router_lsa() 1005 zlog_debug("%s: adv_router %s not found in LSDB.", 1006 __func__, ifbuf); 1007 return NULL; 1008 } 1009 1010 /* Allocate memory for this LSA */ >>> CID 1482161: (TAINTED_SCALAR) >>> Passing tainted variable "total_lsa_length" to a tainted sink. 1011 new_header = XMALLOC(MTYPE_OSPF6_LSA_HEADER, total_lsa_length); 1012 1013 /* LSA information structure */ 1014 lsa = XCALLOC(MTYPE_OSPF6_LSA, sizeof(struct ospf6_lsa)); 1015 1016 lsa->header = (struct ospf6_lsa_header *)new_header; /ospf6d/ospf6_spf.c: 1031 in ospf6_create_single_router_lsa() 1025 * a valid pointer. 1026 */ 1027 assert(rtr_lsa); 1028 if (!OSPF6_LSA_IS_MAXAGE(rtr_lsa)) { 1029 /* Append first Link State ID LSA */ 1030 lsa_header = rtr_lsa->header; >>> CID 1482161: (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(lsa_header->length)" to a tainted sink. 1031 memcpy(new_header, lsa_header, ntohs(lsa_header->length)); 1032 /* Assign new lsa length as aggregated length. */ 1033 ((struct ospf6_lsa_header *)new_header)->length = 1034 htons(total_lsa_length); 1035 new_header += ntohs(lsa_header->length); 1036 num_lsa--; /ospf6d/ospf6_spf.c: 1061 in ospf6_create_single_router_lsa() 1055 __func__, rtr_lsa->name, 1056 ntohs(lsa_header->length), ifbuf); 1057 } 1058 1059 /* Append Next Link State ID LSA */ 1060 lsa_header = rtr_lsa->header; >>> CID 1482161: (TAINTED_SCALAR) >>> Passing tainted variable "ntohs(lsa_header->length) - lsa_length" to a tainted sink. 1061 memcpy(new_header, (OSPF6_LSA_HEADER_END(rtr_lsa->header) + 4), 1062 (ntohs(lsa_header->length) - lsa_length)); 1063 new_header += (ntohs(lsa_header->length) - lsa_length); 1064 num_lsa--; 1065 1066 rtr_lsa = ospf6_lsdb_next(end, rtr_lsa); ** CID 1479711: Error handling issues (CHECKED_RETURN) /pimd/pim_zebra.c: 650 in igmp_source_forward_start() ________________________________________________________________________________________________________ *** CID 1479711: Error handling issues (CHECKED_RETURN) /pimd/pim_zebra.c: 650 in igmp_source_forward_start() 644 grp.u.prefix4 = sg.grp; 645 646 up = pim_upstream_find(pim, &sg); 647 if (up) { 648 memcpy(&nexthop, &up->rpf.source_nexthop, 649 sizeof(struct pim_nexthop)); >>> CID 1479711: Error handling issues (CHECKED_RETURN) >>> Calling "pim_ecmp_nexthop_lookup" without checking return value (as is done elsewhere 8 out of 9 times). 650 pim_ecmp_nexthop_lookup(pim, &nexthop, &src, 651 &grp, 0); 652 if (nexthop.interface) 653 input_iface_vif_index = 654 pim_if_find_vifindex_by_ifindex( 655 pim, ** CID 1479155: Uninitialized variables (UNINIT) ________________________________________________________________________________________________________ *** CID 1479155: Uninitialized variables (UNINIT) /pimd/pim_cmd.c: 8110 in pim_test_sg_keepalive_magic() 8104 8105 if (!pim) { 8106 vty_out(vty, "%% Unable to find pim instance\n"); 8107 return CMD_WARNING; 8108 } 8109 >>> CID 1479155: Uninitialized variables (UNINIT) >>> Using uninitialized value "sg". Field "sg.family" is uninitialized when calling "pim_upstream_find". 8110 up = pim_upstream_find(pim, &sg); 8111 if (!up) { 8112 vty_out(vty, "%% Unable to find %s specified\n", 8113 pim_str_sg_dump(&sg)); 8114 return CMD_WARNING; 8115 } ** CID 1479142: Memory - illegal accesses (OVERRUN) /zebra/zebra_rib.c: 2098 in rib_meta_queue_add() ________________________________________________________________________________________________________ *** CID 1479142: Memory - illegal accesses (OVERRUN) /zebra/zebra_rib.c: 2098 in rib_meta_queue_add() 2092 "rn %p is already queued in sub-queue %u", 2093 (void *)rn, qindex); 2094 return -1; 2095 } 2096 2097 SET_FLAG(rib_dest_from_rnode(rn)->flags, RIB_ROUTE_QUEUED(qindex)); >>> CID 1479142: Memory - illegal accesses (OVERRUN) >>> Overrunning array "mq->subq" of 6 8-byte elements at element index 6 (byte offset 55) using index "qindex" (which evaluates to 6). 2098 listnode_add(mq->subq[qindex], rn); 2099 route_lock_node(rn); 2100 mq->size++; 2101 2102 if (IS_ZEBRA_DEBUG_RIB_DETAILED) 2103 rnode_debug(rn, re->vrf_id, "queued rn %p into sub-queue %u", ** CID 1475948: Security best practices violations (DC.WEAK_CRYPTO) /watchfrr/watchfrr.c: 889 in phase_check() ________________________________________________________________________________________________________ *** CID 1475948: Security best practices violations (DC.WEAK_CRYPTO) /watchfrr/watchfrr.c: 889 in phase_check() 883 return; 884 885 /* startup complete, everything out of INIT */ 886 gs.phase = PHASE_NONE; 887 for (dmn = gs.daemons; dmn; dmn = dmn->next) 888 if (dmn->state == DAEMON_DOWN) { >>> CID 1475948: Security best practices violations (DC.WEAK_CRYPTO) >>> "random" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 889 SET_WAKEUP_DOWN(dmn); 890 try_restart(dmn); 891 } 892 break; 893 case PHASE_STOPS_PENDING: 894 if (gs.numpids) ** CID 1475944: Security best practices violations (DC.WEAK_CRYPTO) /watchfrr/watchfrr.c: 581 in restart_done() ________________________________________________________________________________________________________ *** CID 1475944: Security best practices violations (DC.WEAK_CRYPTO) /watchfrr/watchfrr.c: 581 in restart_done() 575 dmn->name, state_str[dmn->state]); 576 return; 577 } 578 if (dmn->t_wakeup) 579 THREAD_OFF(dmn->t_wakeup); 580 if (try_connect(dmn) < 0) >>> CID 1475944: Security best practices violations (DC.WEAK_CRYPTO) >>> "random" should not be used for security-related applications, because linear congruential algorithms are too easy to break. 581 SET_WAKEUP_DOWN(dmn); 582 } 583 584 static void daemon_down(struct daemon *dmn, const char *why) 585 { 586 if (IS_UP(dmn) || (dmn->state == DAEMON_INIT)) ** CID 1420264: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1420264: Null pointer dereferences (NULL_RETURNS) /pimd/pim_nht.c: 791 in pim_parse_nexthop_update() 785 nexthop->gate.ipv4 = 786 pnc->rpf.rpf_addr.u.prefix4; 787 break; 788 case NEXTHOP_TYPE_IPV6_IFINDEX: 789 ifp1 = if_lookup_by_index(nexthop->ifindex, 790 pim->vrf_id); >>> CID 1420264: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "ifp1" when calling "pim_neighbor_find_if". 791 nbr = pim_neighbor_find_if(ifp1); 792 /* Overwrite with Nbr address as NH addr */ 793 if (nbr) 794 nexthop->gate.ipv4 = nbr->source_addr; 795 else { 796 // Mark nexthop address to 0 until PIM ** CID 1302468: Memory - corruptions (ARRAY_VS_SINGLETON) ________________________________________________________________________________________________________ *** CID 1302468: Memory - corruptions (ARRAY_VS_SINGLETON) /zebra/zebra_snmp.c: 371 in get_fwtable_route_node() 365 /* For exact: search matching entry in rib table. */ 366 367 if (exact) { 368 if (policy) /* Not supported (yet?) */ 369 return; 370 for (*np = route_top(table); *np; *np = route_next(*np)) { >>> CID 1302468: Memory - corruptions (ARRAY_VS_SINGLETON) >>> Passing "&(*np)->p.u.prefix" to function "in_addr_cmp" which uses it as an array. This might corrupt or misinterpret adjacent memory locations. 371 if (!in_addr_cmp(&(*np)->p.u.prefix, 372 (uint8_t *)&dest)) { 373 RNODE_FOREACH_RE (*np, *re) { 374 if (!in_addr_cmp((uint8_t *)&(*re)->nhe 375 ->nhg.nexthop 376 ->gate.ipv4, ** CID 1302467: (ARRAY_VS_SINGLETON) ________________________________________________________________________________________________________ *** CID 1302467: (ARRAY_VS_SINGLETON) /zebra/zebra_snmp.c: 271 in check_replace() 265 *re = re2; 266 return; 267 } 268 269 if (in_addr_cmp(&(*np)->p.u.prefix, &np2->p.u.prefix) < 0) 270 return; >>> CID 1302467: (ARRAY_VS_SINGLETON) >>> Passing "&np2->p.u.prefix" to function "in_addr_cmp" which uses it as an array. This might corrupt or misinterpret adjacent memory locations. 271 if (in_addr_cmp(&(*np)->p.u.prefix, &np2->p.u.prefix) > 0) { 272 *np = np2; 273 *re = re2; 274 return; 275 } 276 /zebra/zebra_snmp.c: 269 in check_replace() 263 if (!*np) { 264 *np = np2; 265 *re = re2; 266 return; 267 } 268 >>> CID 1302467: (ARRAY_VS_SINGLETON) >>> Passing "&np2->p.u.prefix" to function "in_addr_cmp" which uses it as an array. This might corrupt or misinterpret adjacent memory locations. 269 if (in_addr_cmp(&(*np)->p.u.prefix, &np2->p.u.prefix) < 0) 270 return; 271 if (in_addr_cmp(&(*np)->p.u.prefix, &np2->p.u.prefix) > 0) { 272 *np = np2; 273 *re = re2; 274 return; ** CID 1302466: (ARRAY_VS_SINGLETON) ________________________________________________________________________________________________________ *** CID 1302466: (ARRAY_VS_SINGLETON) /zebra/zebra_snmp.c: 397 in get_fwtable_route_node() 391 /* Check destination first */ 392 if (in_addr_cmp(&np2->p.u.prefix, (uint8_t *)&dest) > 0) 393 RNODE_FOREACH_RE (np2, re2) { 394 check_replace(np2, re2, np, re); 395 } 396 >>> CID 1302466: (ARRAY_VS_SINGLETON) >>> Passing "&np2->p.u.prefix" to function "in_addr_cmp" which uses it as an array. This might corrupt or misinterpret adjacent memory locations. 397 if (in_addr_cmp(&np2->p.u.prefix, (uint8_t *)&dest) 398 == 0) { /* have to look at each re individually */ 399 RNODE_FOREACH_RE (np2, re2) { 400 int proto2, policy2; 401 402 proto2 = proto_trans(re2->type); /zebra/zebra_snmp.c: 392 in get_fwtable_route_node() 386 387 /* Search next best entry */ 388 389 for (np2 = route_top(table); np2; np2 = route_next(np2)) { 390 391 /* Check destination first */ >>> CID 1302466: (ARRAY_VS_SINGLETON) >>> Passing "&np2->p.u.prefix" to function "in_addr_cmp" which uses it as an array. This might corrupt or misinterpret adjacent memory locations. 392 if (in_addr_cmp(&np2->p.u.prefix, (uint8_t *)&dest) > 0) 393 RNODE_FOREACH_RE (np2, re2) { 394 check_replace(np2, re2, np, re); 395 } 396 397 if (in_addr_cmp(&np2->p.u.prefix, (uint8_t *)&dest) ** CID 1302465: (ARRAY_VS_SINGLETON) ________________________________________________________________________________________________________ *** CID 1302465: (ARRAY_VS_SINGLETON) /zebra/zebra_snmp.c: 269 in check_replace() 263 if (!*np) { 264 *np = np2; 265 *re = re2; 266 return; 267 } 268 >>> CID 1302465: (ARRAY_VS_SINGLETON) >>> Passing "&(*np)->p.u.prefix" to function "in_addr_cmp" which uses it as an array. This might corrupt or misinterpret adjacent memory locations. 269 if (in_addr_cmp(&(*np)->p.u.prefix, &np2->p.u.prefix) < 0) 270 return; 271 if (in_addr_cmp(&(*np)->p.u.prefix, &np2->p.u.prefix) > 0) { 272 *np = np2; 273 *re = re2; 274 return; /zebra/zebra_snmp.c: 271 in check_replace() 265 *re = re2; 266 return; 267 } 268 269 if (in_addr_cmp(&(*np)->p.u.prefix, &np2->p.u.prefix) < 0) 270 return; >>> CID 1302465: (ARRAY_VS_SINGLETON) >>> Passing "&(*np)->p.u.prefix" to function "in_addr_cmp" which uses it as an array. This might corrupt or misinterpret adjacent memory locations. 271 if (in_addr_cmp(&(*np)->p.u.prefix, &np2->p.u.prefix) > 0) { 272 *np = np2; 273 *re = re2; 274 return; 275 } 276 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/ls/click?upn=nJaKvJSIH-2FPAfmty-2BK5tYpPkl…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 07 Apr '20

07 Apr '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 16 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 28 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 16 of 16 defect(s) ** CID 1492504: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /bgpd/bgp_routemap.c: 2588 in route_set_ecommunity_lb() ________________________________________________________________________________________________________ *** CID 1492504: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /bgpd/bgp_routemap.c: 2588 in route_set_ecommunity_lb() 2582 } else if (rels->lb_type == RMAP_ECOMM_LB_SET_NUM_MPATH) { 2583 2584 /* process this only for the best path. */ 2585 if (!CHECK_FLAG(path->flags, BGP_PATH_SELECTED)) 2586 return RMAP_OKAY; 2587 >>> CID 1492504: Integer handling issues (OVERFLOW_BEFORE_WIDEN) >>> Potentially overflowing expression "peer->bgp->lb_ref_bw * 1000U" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "_uint64_t" (64 bits, unsigned). 2588 bw_bytes = ((uint64_t)(peer->bgp->lb_ref_bw * 1000 * 1000))/8; 2589 mpath_count = bgp_path_info_mpath_count(path) + 1; 2590 bw_bytes *= mpath_count; 2591 } 2592 2593 encode_lb_extcomm(as, bw_bytes, rels->non_trans, &lb_eval); ** CID 1492503: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /bgpd/bgp_routemap.c: 2572 in route_set_ecommunity_lb() ________________________________________________________________________________________________________ *** CID 1492503: Integer handling issues (OVERFLOW_BEFORE_WIDEN) /bgpd/bgp_routemap.c: 2572 in route_set_ecommunity_lb() 2566 if (!peer || !peer->bgp) 2567 return RMAP_ERROR; 2568 2569 /* Build link bandwidth extended community */ 2570 as = (peer->bgp->as > BGP_AS_MAX) ? BGP_AS_TRANS : peer->bgp->as; 2571 if (rels->lb_type == RMAP_ECOMM_LB_SET_VALUE) { >>> CID 1492503: Integer handling issues (OVERFLOW_BEFORE_WIDEN) >>> Potentially overflowing expression "rels->bw * 1000U" with type "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "_uint64_t" (64 bits, unsigned). 2572 bw_bytes = ((uint64_t)(rels->bw * 1000 * 1000))/8; 2573 } else if (rels->lb_type == RMAP_ECOMM_LB_SET_CUMUL) { 2574 /* process this only for the best path. */ 2575 if (!CHECK_FLAG(path->flags, BGP_PATH_SELECTED)) 2576 return RMAP_OKAY; 2577 ** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 494 in seqnumber_mismatch() 488 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MSBIT); 489 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_MBIT); 490 SET_FLAG(on->dbdesc_bits, OSPF6_DBDESC_IBIT); 491 492 ospf6_lsdb_remove_all(on->summary_list); 493 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486267: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 494 for (ALL_LSDB(on->retrans_list, lsa)) { 495 ospf6_decrement_retrans_count(lsa); 496 ospf6_lsdb_remove(lsa, on->retrans_list); 497 } 498 499 THREAD_OFF(on->thread_send_dbdesc); ** CID 1486266: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486266: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2343 in ospf6_lsack_send_neighbor() 2337 p = (uint8_t *)((caddr_t)oh 2338 + sizeof(struct ospf6_header)); 2339 lsa_cnt = 0; 2340 } 2341 } 2342 >>> CID 1486266: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2343 ospf6_lsa_age_update_to_send(lsa, on->ospf6_if->transdelay); 2344 memcpy(p, lsa->header, sizeof(struct ospf6_lsa_header)); 2345 p += sizeof(struct ospf6_lsa_header); 2346 2347 assert(lsa->lock == 1); 2348 ospf6_lsdb_remove(lsa, on->lsack_list); /ospf6d/ospf6_message.c: 2343 in ospf6_lsack_send_neighbor() 2337 p = (uint8_t *)((caddr_t)oh 2338 + sizeof(struct ospf6_header)); 2339 lsa_cnt = 0; 2340 } 2341 } 2342 >>> CID 1486266: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2343 ospf6_lsa_age_update_to_send(lsa, on->ospf6_if->transdelay); 2344 memcpy(p, lsa->header, sizeof(struct ospf6_lsa_header)); 2345 p += sizeof(struct ospf6_lsa_header); 2346 2347 assert(lsa->lock == 1); 2348 ospf6_lsdb_remove(lsa, on->lsack_list); ** CID 1486265: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2235 in ospf6_lsupdate_send_interface() /ospf6d/ospf6_message.c: 2235 in ospf6_lsupdate_send_interface() ________________________________________________________________________________________________________ *** CID 1486265: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2235 in ospf6_lsupdate_send_interface() 2229 lsa_cnt = 0; 2230 2231 for (iterend = ospf6_lsdb_head(oi->lsupdate_list, 0, 0, 0, &lsa); lsa; 2232 lsa = lsa_next) { 2233 lsa_next = ospf6_lsdb_next(iterend, lsa); 2234 /* MTU check */ >>> CID 1486265: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2235 if ((p - sendbuf + ((unsigned int)OSPF6_LSA_SIZE(lsa->header))) 2236 > ospf6_packet_max(oi)) { 2237 if (lsa_cnt) { 2238 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; 2239 oh->length = htons(p - sendbuf); 2240 lsupdate->lsa_number = htonl(lsa_cnt); /ospf6d/ospf6_message.c: 2235 in ospf6_lsupdate_send_interface() 2229 lsa_cnt = 0; 2230 2231 for (iterend = ospf6_lsdb_head(oi->lsupdate_list, 0, 0, 0, &lsa); lsa; 2232 lsa = lsa_next) { 2233 lsa_next = ospf6_lsdb_next(iterend, lsa); 2234 /* MTU check */ >>> CID 1486265: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2235 if ((p - sendbuf + ((unsigned int)OSPF6_LSA_SIZE(lsa->header))) 2236 > ospf6_packet_max(oi)) { 2237 if (lsa_cnt) { 2238 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; 2239 oh->length = htons(p - sendbuf); 2240 lsupdate->lsa_number = htonl(lsa_cnt); ** CID 1486264: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486264: (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 310 in ospf6_lsdb_remove_all() 304 if (lsdb == NULL) 305 return; 306 307 for (iterend = ospf6_lsdb_head(lsdb, 0, 0, 0, &lsa); lsa; 308 lsa = lsa_next) { 309 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486264: (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_remove" dereferences freed pointer "lsa". 310 ospf6_lsdb_remove(lsa, lsdb); 311 } 312 } 313 314 void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa) 315 { /ospf6d/ospf6_lsdb.c: 310 in ospf6_lsdb_remove_all() 304 if (lsdb == NULL) 305 return; 306 307 for (iterend = ospf6_lsdb_head(lsdb, 0, 0, 0, &lsa); lsa; 308 lsa = lsa_next) { 309 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486264: (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_remove" dereferences freed pointer "lsa". 310 ospf6_lsdb_remove(lsa, lsdb); 311 } 312 } 313 314 void ospf6_lsdb_lsa_unlock(struct ospf6_lsa *lsa) 315 { ** CID 1486263: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486263: (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 130 in ospf6_neighbor_delete() 124 ospf6_lsdb_remove_all(on->summary_list); 125 ospf6_lsdb_remove_all(on->request_list); 126 127 for (iterend = ospf6_lsdb_head(on->retrans_list, 0, 0, 0, &lsa); lsa; 128 lsa = lsa_next) { 129 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486263: (USE_AFTER_FREE) >>> Calling "ospf6_decrement_retrans_count" dereferences freed pointer "lsa". 130 ospf6_decrement_retrans_count(lsa); 131 ospf6_lsdb_remove(lsa, on->retrans_list); 132 } 133 134 ospf6_lsdb_remove_all(on->dbdesc_list); 135 ospf6_lsdb_remove_all(on->lsupdate_list); /ospf6d/ospf6_neighbor.c: 130 in ospf6_neighbor_delete() 124 ospf6_lsdb_remove_all(on->summary_list); 125 ospf6_lsdb_remove_all(on->request_list); 126 127 for (iterend = ospf6_lsdb_head(on->retrans_list, 0, 0, 0, &lsa); lsa; 128 lsa = lsa_next) { 129 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486263: (USE_AFTER_FREE) >>> Calling "ospf6_decrement_retrans_count" dereferences freed pointer "lsa". 130 ospf6_decrement_retrans_count(lsa); 131 ospf6_lsdb_remove(lsa, on->retrans_list); 132 } 133 134 ospf6_lsdb_remove_all(on->dbdesc_list); 135 ospf6_lsdb_remove_all(on->lsupdate_list); ** CID 1486262: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1879 in ospf6_dbdesc_send_newone() ________________________________________________________________________________________________________ *** CID 1486262: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1883 in ospf6_dbdesc_send_newone() 1877 if (size + sizeof(struct ospf6_lsa_header) 1878 > ospf6_packet_max(on->ospf6_if)) { 1879 ospf6_lsdb_lsa_unlock(lsa); 1880 break; 1881 } 1882 >>> CID 1486262: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_copy" dereferences freed pointer "lsa". 1883 ospf6_lsdb_add(ospf6_lsa_copy(lsa), on->dbdesc_list); 1884 ospf6_lsdb_remove(lsa, on->summary_list); 1885 size += sizeof(struct ospf6_lsa_header); 1886 } 1887 1888 if (on->summary_list->count == 0) /ospf6d/ospf6_message.c: 1879 in ospf6_dbdesc_send_newone() 1873 1874 for (iterend = ospf6_lsdb_head(on->summary_list, 0, 0, 0, &lsa); lsa; 1875 lsa = lsa_next) { 1876 lsa_next = ospf6_lsdb_next(iterend, lsa); 1877 if (size + sizeof(struct ospf6_lsa_header) 1878 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1486262: (USE_AFTER_FREE) >>> Passing freed pointer "lsa" as an argument to "ospf6_lsdb_lsa_unlock". 1879 ospf6_lsdb_lsa_unlock(lsa); 1880 break; 1881 } 1882 1883 ospf6_lsdb_add(ospf6_lsa_copy(lsa), on->dbdesc_list); 1884 ospf6_lsdb_remove(lsa, on->summary_list); /ospf6d/ospf6_message.c: 1879 in ospf6_dbdesc_send_newone() 1873 1874 for (iterend = ospf6_lsdb_head(on->summary_list, 0, 0, 0, &lsa); lsa; 1875 lsa = lsa_next) { 1876 lsa_next = ospf6_lsdb_next(iterend, lsa); 1877 if (size + sizeof(struct ospf6_lsa_header) 1878 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1486262: (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_lsa_unlock" frees pointer "lsa" which has already been freed. 1879 ospf6_lsdb_lsa_unlock(lsa); 1880 break; 1881 } 1882 1883 ospf6_lsdb_add(ospf6_lsa_copy(lsa), on->dbdesc_list); 1884 ospf6_lsdb_remove(lsa, on->summary_list); /ospf6d/ospf6_message.c: 1883 in ospf6_dbdesc_send_newone() 1877 if (size + sizeof(struct ospf6_lsa_header) 1878 > ospf6_packet_max(on->ospf6_if)) { 1879 ospf6_lsdb_lsa_unlock(lsa); 1880 break; 1881 } 1882 >>> CID 1486262: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_copy" dereferences freed pointer "lsa". 1883 ospf6_lsdb_add(ospf6_lsa_copy(lsa), on->dbdesc_list); 1884 ospf6_lsdb_remove(lsa, on->summary_list); 1885 size += sizeof(struct ospf6_lsa_header); 1886 } 1887 1888 if (on->summary_list->count == 0) /ospf6d/ospf6_message.c: 1879 in ospf6_dbdesc_send_newone() 1873 1874 for (iterend = ospf6_lsdb_head(on->summary_list, 0, 0, 0, &lsa); lsa; 1875 lsa = lsa_next) { 1876 lsa_next = ospf6_lsdb_next(iterend, lsa); 1877 if (size + sizeof(struct ospf6_lsa_header) 1878 > ospf6_packet_max(on->ospf6_if)) { >>> CID 1486262: (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_lsa_unlock" frees pointer "lsa" which has already been freed. 1879 ospf6_lsdb_lsa_unlock(lsa); 1880 break; 1881 } 1882 1883 ospf6_lsdb_add(ospf6_lsa_copy(lsa), on->dbdesc_list); 1884 ospf6_lsdb_remove(lsa, on->summary_list); ** CID 1486261: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486261: (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 536 in bad_lsreq() 530 ospf6_lsdb_remove_all(on->summary_list); 531 ospf6_lsdb_remove_all(on->request_list); 532 533 for (iterend = ospf6_lsdb_head(on->retrans_list, 0, 0, 0, &lsa); lsa; 534 lsa = lsa_next) { 535 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486261: (USE_AFTER_FREE) >>> Calling "ospf6_decrement_retrans_count" dereferences freed pointer "lsa". 536 ospf6_decrement_retrans_count(lsa); 537 ospf6_lsdb_remove(lsa, on->retrans_list); 538 } 539 540 THREAD_OFF(on->thread_send_dbdesc); 541 on->dbdesc_seqnum++; /* Incr seqnum as per RFC2328, sec 10.3 */ /ospf6d/ospf6_neighbor.c: 536 in bad_lsreq() 530 ospf6_lsdb_remove_all(on->summary_list); 531 ospf6_lsdb_remove_all(on->request_list); 532 533 for (iterend = ospf6_lsdb_head(on->retrans_list, 0, 0, 0, &lsa); lsa; 534 lsa = lsa_next) { 535 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486261: (USE_AFTER_FREE) >>> Calling "ospf6_decrement_retrans_count" dereferences freed pointer "lsa". 536 ospf6_decrement_retrans_count(lsa); 537 ospf6_lsdb_remove(lsa, on->retrans_list); 538 } 539 540 THREAD_OFF(on->thread_send_dbdesc); 541 on->dbdesc_seqnum++; /* Incr seqnum as per RFC2328, sec 10.3 */ ** CID 1486260: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486260: (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 319 in negotiation_done() 313 ospf6_lsdb_remove_all(on->summary_list); 314 ospf6_lsdb_remove_all(on->request_list); 315 316 for (iterend = ospf6_lsdb_head(on->retrans_list, 0, 0, 0, &lsa); lsa; 317 lsa = lsa_next) { 318 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486260: (USE_AFTER_FREE) >>> Calling "ospf6_decrement_retrans_count" dereferences freed pointer "lsa". 319 ospf6_decrement_retrans_count(lsa); 320 ospf6_lsdb_remove(lsa, on->retrans_list); 321 } 322 323 /* Interface scoped LSAs */ 324 for (ALL_LSDB(on->ospf6_if->lsdb, lsa)) { /ospf6d/ospf6_neighbor.c: 319 in negotiation_done() 313 ospf6_lsdb_remove_all(on->summary_list); 314 ospf6_lsdb_remove_all(on->request_list); 315 316 for (iterend = ospf6_lsdb_head(on->retrans_list, 0, 0, 0, &lsa); lsa; 317 lsa = lsa_next) { 318 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486260: (USE_AFTER_FREE) >>> Calling "ospf6_decrement_retrans_count" dereferences freed pointer "lsa". 319 ospf6_decrement_retrans_count(lsa); 320 ospf6_lsdb_remove(lsa, on->retrans_list); 321 } 322 323 /* Interface scoped LSAs */ 324 for (ALL_LSDB(on->ospf6_if->lsdb, lsa)) { ** CID 1486259: (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 332 in ospf6_lsdb_maxage_remover() /ospf6d/ospf6_lsdb.c: 332 in ospf6_lsdb_maxage_remover() ________________________________________________________________________________________________________ *** CID 1486259: (USE_AFTER_FREE) /ospf6d/ospf6_lsdb.c: 332 in ospf6_lsdb_maxage_remover() 326 struct ospf6_lsa *lsa, *lsa_next; 327 const struct route_node *iterend; 328 329 for (iterend = ospf6_lsdb_head(lsdb, 0, 0, 0, &lsa); lsa; 330 lsa = lsa_next) { 331 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486259: (USE_AFTER_FREE) >>> Passing freed pointer "lsa" as an argument to "ospf6_lsa_age_current". 332 if (!OSPF6_LSA_IS_MAXAGE(lsa)) 333 continue; 334 if (lsa->retrans_count != 0) { 335 reschedule = 1; 336 continue; 337 } /ospf6d/ospf6_lsdb.c: 332 in ospf6_lsdb_maxage_remover() 326 struct ospf6_lsa *lsa, *lsa_next; 327 const struct route_node *iterend; 328 329 for (iterend = ospf6_lsdb_head(lsdb, 0, 0, 0, &lsa); lsa; 330 lsa = lsa_next) { 331 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486259: (USE_AFTER_FREE) >>> Passing freed pointer "lsa" as an argument to "ospf6_lsa_age_current". 332 if (!OSPF6_LSA_IS_MAXAGE(lsa)) 333 continue; 334 if (lsa->retrans_count != 0) { 335 reschedule = 1; 336 continue; 337 } ** CID 1486258: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2411 in ospf6_lsack_send_interface() ________________________________________________________________________________________________________ *** CID 1486258: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2411 in ospf6_lsack_send_interface() 2405 /* if we run out of packet size/space here, 2406 better to try again soon. */ 2407 THREAD_OFF(oi->thread_send_lsack); 2408 thread_add_event(master, ospf6_lsack_send_interface, oi, 2409 0, &oi->thread_send_lsack); 2410 >>> CID 1486258: (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_lsa_unlock" frees pointer "lsa" which has already been freed. 2411 ospf6_lsdb_lsa_unlock(lsa); 2412 break; 2413 } 2414 2415 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2416 memcpy(p, lsa->header, sizeof(struct ospf6_lsa_header)); /ospf6d/ospf6_message.c: 2415 in ospf6_lsack_send_interface() 2409 0, &oi->thread_send_lsack); 2410 2411 ospf6_lsdb_lsa_unlock(lsa); 2412 break; 2413 } 2414 >>> CID 1486258: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2415 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2416 memcpy(p, lsa->header, sizeof(struct ospf6_lsa_header)); 2417 p += sizeof(struct ospf6_lsa_header); 2418 2419 assert(lsa->lock == 1); 2420 ospf6_lsdb_remove(lsa, oi->lsack_list); /ospf6d/ospf6_message.c: 2411 in ospf6_lsack_send_interface() 2405 /* if we run out of packet size/space here, 2406 better to try again soon. */ 2407 THREAD_OFF(oi->thread_send_lsack); 2408 thread_add_event(master, ospf6_lsack_send_interface, oi, 2409 0, &oi->thread_send_lsack); 2410 >>> CID 1486258: (USE_AFTER_FREE) >>> Passing freed pointer "lsa" as an argument to "ospf6_lsdb_lsa_unlock". 2411 ospf6_lsdb_lsa_unlock(lsa); 2412 break; 2413 } 2414 2415 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2416 memcpy(p, lsa->header, sizeof(struct ospf6_lsa_header)); /ospf6d/ospf6_message.c: 2415 in ospf6_lsack_send_interface() 2409 0, &oi->thread_send_lsack); 2410 2411 ospf6_lsdb_lsa_unlock(lsa); 2412 break; 2413 } 2414 >>> CID 1486258: (USE_AFTER_FREE) >>> Calling "ospf6_lsa_age_update_to_send" dereferences freed pointer "lsa". 2415 ospf6_lsa_age_update_to_send(lsa, oi->transdelay); 2416 memcpy(p, lsa->header, sizeof(struct ospf6_lsa_header)); 2417 p += sizeof(struct ospf6_lsa_header); 2418 2419 assert(lsa->lock == 1); 2420 ospf6_lsdb_remove(lsa, oi->lsack_list); ** CID 1486256: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2049 in ospf6_lsupdate_send_neighbor() /ospf6d/ospf6_message.c: 2049 in ospf6_lsupdate_send_neighbor() ________________________________________________________________________________________________________ *** CID 1486256: (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 2049 in ospf6_lsupdate_send_neighbor() 2043 /* lsupdate_list lists those LSA which doesn't need to be 2044 retransmitted. remove those from the list */ 2045 for (iterend = ospf6_lsdb_head(on->lsupdate_list, 0, 0, 0, &lsa); lsa; 2046 lsa = lsa_next) { 2047 lsa_next = ospf6_lsdb_next(iterend, lsa); 2048 /* MTU check */ >>> CID 1486256: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2049 if ((p - sendbuf + (unsigned int)OSPF6_LSA_SIZE(lsa->header)) 2050 > ospf6_packet_max(on->ospf6_if)) { 2051 if (lsa_cnt) { 2052 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; 2053 oh->length = htons(p - sendbuf); 2054 lsupdate->lsa_number = htonl(lsa_cnt); /ospf6d/ospf6_message.c: 2049 in ospf6_lsupdate_send_neighbor() 2043 /* lsupdate_list lists those LSA which doesn't need to be 2044 retransmitted. remove those from the list */ 2045 for (iterend = ospf6_lsdb_head(on->lsupdate_list, 0, 0, 0, &lsa); lsa; 2046 lsa = lsa_next) { 2047 lsa_next = ospf6_lsdb_next(iterend, lsa); 2048 /* MTU check */ >>> CID 1486256: (USE_AFTER_FREE) >>> Dereferencing freed pointer "lsa". 2049 if ((p - sendbuf + (unsigned int)OSPF6_LSA_SIZE(lsa->header)) 2050 > ospf6_packet_max(on->ospf6_if)) { 2051 if (lsa_cnt) { 2052 oh->type = OSPF6_MESSAGE_TYPE_LSUPDATE; 2053 oh->length = htons(p - sendbuf); 2054 lsupdate->lsa_number = htonl(lsa_cnt); ** CID 1486255: (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486255: (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 574 in oneway_received() 568 569 ospf6_lsdb_remove_all(on->summary_list); 570 ospf6_lsdb_remove_all(on->request_list); 571 for (iterend = ospf6_lsdb_head(on->retrans_list, 0, 0, 0, &lsa); lsa; 572 lsa = lsa_next) { 573 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486255: (USE_AFTER_FREE) >>> Calling "ospf6_decrement_retrans_count" dereferences freed pointer "lsa". 574 ospf6_decrement_retrans_count(lsa); 575 ospf6_lsdb_remove(lsa, on->retrans_list); 576 } 577 578 THREAD_OFF(on->thread_send_dbdesc); 579 THREAD_OFF(on->thread_send_lsreq); /ospf6d/ospf6_neighbor.c: 574 in oneway_received() 568 569 ospf6_lsdb_remove_all(on->summary_list); 570 ospf6_lsdb_remove_all(on->request_list); 571 for (iterend = ospf6_lsdb_head(on->retrans_list, 0, 0, 0, &lsa); lsa; 572 lsa = lsa_next) { 573 lsa_next = ospf6_lsdb_next(iterend, lsa); >>> CID 1486255: (USE_AFTER_FREE) >>> Calling "ospf6_decrement_retrans_count" dereferences freed pointer "lsa". 574 ospf6_decrement_retrans_count(lsa); 575 ospf6_lsdb_remove(lsa, on->retrans_list); 576 } 577 578 THREAD_OFF(on->thread_send_dbdesc); 579 THREAD_OFF(on->thread_send_lsreq); ** CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_neighbor.c: 463 in adj_ok() 457 458 } else if (on->state >= OSPF6_NEIGHBOR_EXSTART && !need_adjacency(on)) { 459 ospf6_neighbor_state_change(OSPF6_NEIGHBOR_TWOWAY, on, 460 OSPF6_NEIGHBOR_EVENT_ADJ_OK); 461 ospf6_lsdb_remove_all(on->summary_list); 462 ospf6_lsdb_remove_all(on->request_list); >>> CID 1486253: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsdb_next" dereferences freed pointer "lsa". 463 for (ALL_LSDB(on->retrans_list, lsa)) { 464 ospf6_decrement_retrans_count(lsa); 465 ospf6_lsdb_remove(lsa, on->retrans_list); 466 } 467 } 468 ** CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) ________________________________________________________________________________________________________ *** CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) /ospf6d/ospf6_message.c: 1954 in ospf6_lsreq_send() 1948 } 1949 1950 if (last_req != NULL) { 1951 if (on->last_ls_req != NULL) { 1952 ospf6_lsa_unlock(on->last_ls_req); 1953 } >>> CID 1221460: Memory - illegal accesses (USE_AFTER_FREE) >>> Calling "ospf6_lsa_lock" dereferences freed pointer "last_req". 1954 ospf6_lsa_lock(last_req); 1955 on->last_ls_req = last_req; 1956 } 1957 1958 oh->type = OSPF6_MESSAGE_TYPE_LSREQ; 1959 oh->length = htons(p - sendbuf); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/ls/click?upn=nJaKvJSIH-2FPAfmty-2BK5tYpPkl…

1 0

Telco meeting error
by olivier.dugeon＠orange.com 03 Apr '20

03 Apr '20

Dear all, I made an error with the Telco meeting invit while I would just forward it. Please ignore the modification to Friday. The Telco meeting is always schedule for the Wednesday from 16h - 17h Paris time (CEST) every 2 weeks and the next one is schedule for the 15th of April. Apologize for the inconvenience. Regards Olivier -- Orange logo <http://www.orange.com> Olivier Dugeon Orange Expert, Future Networks Open Source Referent Orange/IMT/OLN/WTC/IEE/iTeQ fixe : +33 2 96 07 28 80 mobile : +33 6 82 90 37 85 olivier.dugeon(a)orange.com <mailto:olivier.dugeon@orange.com> _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

FRR Telco meeting
by olivier.dugeon＠orange.com 03 Apr '20

03 Apr '20

When: Friday, April 03, 2020 3:00 PM-4:00 PM. (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna Where: BlueJean https://bluejeans.com/9192742159 *~*~*~*~*~*~*~*~*~* Hi all, This is the invite for the regular Telco's meeting. Note that I must shift it by one hour due to overlap with other personal regular meeting Regards Olivier _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 03 Apr '20

03 Apr '20

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1492482: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1492482: Memory - corruptions (OVERRUN) /zebra/zebra_rnh.c: 1048 in send_client() 1042 stream_putl(s, re->metric); 1043 num = 0; 1044 nump = stream_get_endp(s); 1045 stream_putc(s, 0); 1046 for (ALL_NEXTHOPS(re->nhe->nhg, nh)) 1047 if (rnh_nexthop_valid(re, nh)) { >>> CID 1492482: Memory - corruptions (OVERRUN) >>> Overrunning struct type zapi_nexthop of 112 bytes by passing it to a function which accesses it at byte offset 115. 1048 zapi_nexthop_from_nexthop(&znh, nh); 1049 zapi_nexthop_encode(s, &znh, 0 /* flags */); 1050 num++; 1051 } 1052 stream_putc_at(s, nump, num); 1053 } else { ** CID 1492481: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_vxlan.c: 10262 in zebra_evpn_pim_cfg_clean_up() ________________________________________________________________________________________________________ *** CID 1492481: Null pointer dereferences (NULL_RETURNS) /zebra/zebra_vxlan.c: 10262 in zebra_evpn_pim_cfg_clean_up() 10256 } 10257 10258 static int zebra_evpn_pim_cfg_clean_up(struct zserv *client) 10259 { 10260 struct zebra_vrf *zvrf = zebra_vrf_get_evpn(); 10261 >>> CID 1492481: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "zvrf", which is known to be "NULL". 10262 if (CHECK_FLAG(zvrf->flags, ZEBRA_PIM_SEND_VXLAN_SG)) { 10263 if (IS_ZEBRA_DEBUG_VXLAN) 10264 zlog_debug("VxLAN SG updates to PIM, stop"); 10265 UNSET_FLAG(zvrf->flags, ZEBRA_PIM_SEND_VXLAN_SG); 10266 } 10267 ** CID 1492480: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1492480: Memory - corruptions (OVERRUN) /pimd/pim_nht.c: 737 in pim_parse_nexthop_update() 731 struct zapi_route nhr; 732 733 if (!vrf) 734 return 0; 735 pim = vrf->info; 736 >>> CID 1492480: Memory - corruptions (OVERRUN) >>> Overrunning struct type zapi_route of 14456 bytes by passing it to a function which accesses it at byte offset 29815. 737 if (!zapi_nexthop_update_decode(zclient->ibuf, &nhr)) { 738 if (PIM_DEBUG_PIM_NHT) 739 zlog_debug( 740 "%s: Decode of nexthop update from zebra failed", 741 __func__); 742 return 0; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/ls/click?upn=nJaKvJSIH-2FPAfmty-2BK5tYpPkl…

1 0

RTT
by Sofia Salgueiro 03 Apr '20

03 Apr '20

Good afternoon, I've been using CORE with FRRouting and I've noticed that the PING rtt between two directly connected router devices is approximately 80 us, even if I change the bandwidth of the links. I've also noticed that this value seems to increase with the number of hops, eg. between 2 routers with 4 links the value doubles to approximately 160 us. So, I was wondering if maybe you could give me some insight on how the PING is emulated and, more specifically, why the rtt has this value? Best regards, Sofia Salgueiro

3 2

Router Simulation using Dockers
by Sofia Salgueiro 03 Apr '20

03 Apr '20

Hello, I'm currently working on my Master Thesis in Electrical and Computer Engineering at Instituto Superior Técnico, Lisbon, and was looking to use FRRouting to simulate routers using dockers. Is this possible and, if so, would you mind providing me with some information on this? Best regards, Sofia Salgueiro

5 5

Telco meeting 01/04 minutes
by olivier.dugeon＠orange.com 01 Apr '20

01 Apr '20

Dear all, Minutes are available in the wiki as usual, but pay attention as I created a new dedicated page for that. You'll find them from the Telco page https://github.com/FRRouting/frr/wiki/FRR-Telco-SP-projects or directly from the page https://github.com/FRRouting/frr/wiki/Telco-Meeting-Minutes During the call we (thanks Lou) start drawing a new version of Zebra threading model to handle smoothly Link State redistribution between daemons. Donald, Quentin, could you have a look and give us your feedback? I also change the order of the minutes (from latest to oldest one). As usual, don't hesitate to correct them if I miss something or made a mistake. Regards Olivier -- Orange logo <http://www.orange.com> Olivier Dugeon Orange Expert, Future Networks Open Source Referent Orange/IMT/OLN/WTC/IEE/iTeQ fixe : +33 2 96 07 28 80 mobile : +33 6 82 90 37 85 olivier.dugeon(a)orange.com <mailto:olivier.dugeon@orange.com> _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

Northbound discussion
by Santosh P K 29 Mar '20

29 Mar '20

Extending for 2 more months. Thanks Santosh P K

1 0