- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 10 Jan '24

10 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1575507: Null pointer dereferences (REVERSE_INULL) /lib/yang.c: 1146 in yang_lyd_trim_xpath() ________________________________________________________________________________________________________ *** CID 1575507: Null pointer dereferences (REVERSE_INULL) /lib/yang.c: 1146 in yang_lyd_trim_xpath() 1140 if (remove[i] == *root) 1141 *root = (*root)->next; 1142 lyd_free_tree(remove[i]); 1143 } 1144 darr_free(remove); 1145 >>> CID 1575507: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "set" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1146 if (set) 1147 ly_set_free(set, NULL); 1148 1149 return LY_SUCCESS; 1150 #endif 1151 } ** CID 1575506: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/yang.c: 279 in yang_resolve_snode_xpath() ________________________________________________________________________________________________________ *** CID 1575506: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/yang.c: 279 in yang_resolve_snode_xpath() 273 if (!set->count) { 274 ly_set_free(set, NULL); 275 return LY_ENOTFOUND; 276 } 277 278 *simple = false; >>> CID 1575506: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "(int)(set->count - 1) <= 2147483647" is always true regardless of the values of its operands. This occurs as the logical second operand of "&&". 279 darr_ensure_i(*snodes, set->count - 1); 280 memcpy(*snodes, set->snodes, set->count * sizeof(set->snodes[0])); 281 ly_set_free(set, NULL); 282 return LY_SUCCESS; 283 } 284 ** CID 1575505: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/northbound.c: 184 in nb_nodes_find() ________________________________________________________________________________________________________ *** CID 1575505: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/northbound.c: 184 in nb_nodes_find() 178 uint i; 179 180 err = yang_resolve_snode_xpath(ly_native_ctx, xpath, &snodes, &simple); 181 if (err) 182 return NULL; 183 >>> CID 1575505: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "(int)(((snodes == NULL) ? 0 : (ssize_t)((struct darr_metadata *)snodes - 1)->len) - 1) <= 2147483647" is always true regardless of the values of its operands. This occurs as the logical second operand of "&&". 184 darr_ensure_i(nb_nodes, darr_lasti(snodes)); 185 darr_foreach_i (snodes, i) 186 nb_nodes[i] = snodes[i]->priv; 187 darr_free(snodes); 188 return nb_nodes; 189 } ** CID 1575504: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1575504: Insecure data handling (TAINTED_SCALAR) /mgmtd/mgmt_fe_adapter.c: 1103 in fe_adapter_send_tree_data() 1097 1098 if (!tree) { 1099 empty = yang_dnode_new(ly_native_ctx, false); 1100 tree = empty; 1101 } 1102 >>> CID 1575504: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "*buf" to "yang_print_tree_append", which uses it as an offset. 1103 ret = yang_print_tree_append(&buf, tree, result_type, 1104 (LYD_PRINT_WD_EXPLICIT | 1105 LYD_PRINT_WITHSIBLINGS)); 1106 /* buf may have been reallocated and moved */ 1107 msg = (typeof(msg))buf; 1108 (void)msg; /* suppress clang-SA unused warning on safety code */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 02 Jan '24

02 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1575079: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_dplane.c: 5950 in dplane_srv6_encap_srcaddr_set() ________________________________________________________________________________________________________ *** CID 1575079: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_dplane.c: 5950 in dplane_srv6_encap_srcaddr_set() 5944 if (ret == AOK) 5945 result = ZEBRA_DPLANE_REQUEST_QUEUED; 5946 else { 5947 atomic_fetch_add_explicit(&zdplane_info 5948 .dg_srv6_encap_srcaddr_set_errors, 5949 1, memory_order_relaxed); >>> CID 1575079: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "ctx" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 5950 if (ctx) 5951 dplane_ctx_free(&ctx); 5952 } 5953 return result; 5954 } 5955 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 29 Dec '23

29 Dec '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 5 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 5 of 5 defect(s) ** CID 1574981: Null pointer dereferences (REVERSE_INULL) /lib/northbound.c: 2334 in nb_oper_data_iterate() ________________________________________________________________________________________________________ *** CID 1574981: Null pointer dereferences (REVERSE_INULL) /lib/northbound.c: 2334 in nb_oper_data_iterate() 2328 else 2329 ret = nb_oper_data_iter_node(nb_node->snode, xpath, list_entry, 2330 &list_keys, translator, true, 2331 flags, cb, arg, dnode); 2332 2333 list_delete(&list_dnodes); >>> CID 1574981: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "dnode" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 2334 if (dnode) { 2335 while (lyd_parent(dnode)) 2336 dnode = lyd_parent(dnode); 2337 2338 if (tree && ret == NB_OK) 2339 *tree = dnode; ** CID 1574980: Null pointer dereferences (FORWARD_NULL) /mgmtd/mgmt_txn.c: 1292 in txn_get_tree_data_done() ________________________________________________________________________________________________________ *** CID 1574980: Null pointer dereferences (FORWARD_NULL) /mgmtd/mgmt_txn.c: 1292 in txn_get_tree_data_done() 1286 get_tree->partial_error, false); 1287 1288 /* we're done with the request */ 1289 mgmt_txn_req_free(&txn_req); 1290 1291 if (ret) { >>> CID 1574980: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "txn_req". 1292 MGMTD_TXN_ERR("Error saving the results of GETTREE for txn-id %" PRIu64 1293 " req_id %" PRIu64 " to requested type %u", 1294 txn->txn_id, txn_req->req_id, 1295 get_tree->result_type); 1296 1297 (void)mgmt_fe_adapter_txn_error(txn->txn_id, txn_req->req_id, ** CID 1574979: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1574979: Insecure data handling (TAINTED_SCALAR) /lib/mgmt_msg.c: 114 in mgmt_msg_read() 108 * Message was longer than what was left and we have no 109 * available space to read more in. B/c mcount == 0 the 110 * message starts at the beginning of the stream so 111 * therefor the stream is too small to fit the message.. 112 * Resize the stream to fit. 113 */ >>> CID 1574979: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "mhdr->len" to "stream_new", which uses it as an allocation size. 114 news = stream_new(mhdr->len); 115 stream_put(news, mhdr, left); 116 stream_set_endp(news, left); 117 stream_free(ms->ins); 118 ms->ins = news; 119 } ** CID 1574978: Possible Control flow issues (DEADCODE) /mgmtd/mgmt_txn.c: 531 in mgmt_txn_req_free() ________________________________________________________________________________________________________ *** CID 1574978: Possible Control flow issues (DEADCODE) /mgmtd/mgmt_txn.c: 531 in mgmt_txn_req_free() 525 case MGMTD_TXN_GETTREE_TIMEOUT: 526 case MGMTD_TXN_CLEANUP: 527 break; 528 } 529 530 if ((*txn_req)->pending_be_proc && pending_list) { >>> CID 1574978: Possible Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "mgmt_txn_reqs_del(pending_l...". 531 mgmt_txn_reqs_del(pending_list, *txn_req); 532 MGMTD_TXN_DBG("Removed req-id: %" PRIu64 533 " from pending-list (left:%zu)", 534 (*txn_req)->req_id, 535 mgmt_txn_reqs_count(pending_list)); 536 } else if (req_list) { ** CID 1574977: Control flow issues (DEADCODE) /lib/vty.c: 3660 in vty_mgmt_get_data_result_notified() ________________________________________________________________________________________________________ *** CID 1574977: Control flow issues (DEADCODE) /lib/vty.c: 3660 in vty_mgmt_get_data_result_notified() 3654 for (indx = 0; indx < num_data; indx++) { 3655 vty_out(vty, " \"%s\": \"%s\"\n", yang_data[indx]->xpath, 3656 yang_data[indx]->value->encoded_str_val); 3657 } 3658 if (next_key < 0) { 3659 vty_out(vty, "]\n"); >>> CID 1574977: Control flow issues (DEADCODE) >>> Execution cannot reach the expression "1" inside this statement: "vty_mgmt_resume_response(vt...". 3660 vty_mgmt_resume_response(vty, 3661 success ? CMD_SUCCESS : CMD_WARNING); 3662 } 3663 3664 return 0; 3665 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 07 Dec '23

07 Dec '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1574320: Memory - illegal accesses (USE_AFTER_FREE) /zebra/zebra_rib.c: 1454 in rib_process() ________________________________________________________________________________________________________ *** CID 1574320: Memory - illegal accesses (USE_AFTER_FREE) /zebra/zebra_rib.c: 1454 in rib_process() 1448 /* 1449 * If zebra has a new_selected and a proto_re_changed 1450 * entry that was not the old selected and the protocol 1451 * is different, zebra should notify the upper level 1452 * protocol that the sent down entry was not selected 1453 */ >>> CID 1574320: Memory - illegal accesses (USE_AFTER_FREE) >>> Dereferencing freed pointer "proto_re_changed". 1454 if (new_selected && proto_re_changed && 1455 proto_re_changed != old_selected && 1456 new_selected->type != proto_re_changed->type) { 1457 struct rib_table_info *info = srcdest_rnode_table_info(rn); 1458 1459 zsend_route_notify_owner(rn, proto_re_changed, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

FRR 9.0.1 and 8.5.3 Releases
by Jafar Al-Gharaibeh 28 Nov '23

28 Nov '23

Dear FRR Community, We are pleased to announce FRR 9.0.1 and FRR 8.5.3 bug fix releases. For release notes please visit: https://frrouting.org/release/ https://github.com/FRRouting/frr/releases Security updates: https://frrouting.org/security Cheers, The FRR Development Team!

1 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 14 Nov '23

14 Nov '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1571038: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1571038: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_bmp.c: 351 in bmp_per_peer_hdr() 345 /* set router-id but for LOC-RIB INSTANCE (RFC 9069) put the instance 346 * router-id if available or 0 347 */ 348 struct in_addr *bgp_id = 349 !is_locrib ? &peer->remote_id : bgp ? &bgp->router_id : NULL; 350 >>> CID 1571038: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bgp_id" to "stream_put_in_addr", which dereferences it. 351 stream_put_in_addr(s, bgp_id); 352 353 /* Timestamp */ 354 if (tv) { 355 stream_putl(s, tv->tv_sec); 356 stream_putl(s, tv->tv_usec); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 11 Nov '23

11 Nov '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1570969: (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 534 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 575 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 514 in bgp4v2PathAttrLookup() ________________________________________________________________________________________________________ *** CID 1570969: (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 534 in bgp4v2PathAttrLookup() 528 /* Set OID offset for prefix type */ 529 offset = name + namelen; 530 offsetlen = *length - namelen; 531 len = offsetlen; 532 533 if (offsetlen == 0) { >>> CID 1570969: (OVERRUN) >>> Overrunning array "bgp->rib" of 4 64-byte elements at element index 4 (byte offset 319) using index "afi" (which evaluates to 4). 534 dest = bgp_table_top(bgp->rib[afi][SAFI_UNICAST]); 535 safi = SAFI_UNICAST; 536 } else { 537 538 /* bgp4V2NlriAfi is already get */ 539 /* it is comming from the name parameter */ /bgpd/bgp_snmp_bgp4v2.c: 575 in bgp4v2PathAttrLookup() 569 addr->prefixlen = afi_len * 8; 570 571 offset++; 572 offsetlen--; 573 574 /* get node */ >>> CID 1570969: (OVERRUN) >>> Overrunning array "bgp->rib" of 4 64-byte elements at element index 4 (byte offset 319) using index "afi" (which evaluates to 4). 575 dest = bgp_node_get(bgp->rib[afi][safi], addr); 576 } 577 578 if (!dest) 579 return NULL; 580 /bgpd/bgp_snmp_bgp4v2.c: 514 in bgp4v2PathAttrLookup() 508 else 509 oid2in6_addr(offset, &su.sin6.sin6_addr); 510 511 /* bgp4V2NlriIndex currently ignored */ 512 513 /* Lookup node */ >>> CID 1570969: (OVERRUN) >>> Overrunning array "bgp->rib" of 4 64-byte elements at element index 4 (byte offset 319) using index "afi" (which evaluates to 4). 514 dest = bgp_node_lookup(bgp->rib[afi][safi], addr); 515 if (dest) { 516 for (path = bgp_dest_get_bgp_path_info(dest); path; 517 path = path->next) 518 if (sockunion_same(&path->peer->connection->su, 519 &su)) ** CID 1570968: Memory - corruptions (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 605 in bgp4v2PathAttrLookup() ________________________________________________________________________________________________________ *** CID 1570968: Memory - corruptions (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 605 in bgp4v2PathAttrLookup() 599 } else { 600 /* default case start with ipv4*/ 601 if (afi == AFI_IP) 602 family = AF_INET; 603 else 604 family = AF_INET6; >>> CID 1570968: Memory - corruptions (OVERRUN) >>> Overrunning struct type in_addr of 4 bytes by passing it to a function which accesses it at byte offset 15 using argument "16UL". 605 memset(&paddr.ip._v4_addr, 0, sizeof(paddr.ip)); 606 } 607 608 do { 609 min = NULL; 610 min_family = 0; ** CID 1570967: (SIZEOF_MISMATCH) /bgpd/bgp_snmp_bgp4v2.c: 702 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 483 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 561 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 695 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 682 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 487 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 677 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 556 in bgp4v2PathAttrLookup() ________________________________________________________________________________________________________ *** CID 1570967: (SIZEOF_MISMATCH) /bgpd/bgp_snmp_bgp4v2.c: 702 in bgp4v2PathAttrLookup() 696 addr->u.prefix4 = rn_p->u.prefix4; 697 } else { 698 *offset = IANA_AFI_IPV6; 699 offset++; 700 oid_copy_in6_addr( 701 offset, &min->peer->connection->su.sin6.sin6_addr); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 702 offset += IN6_ADDR_SIZE; 703 addr->u.prefix6 = rn_p->u.prefix6; 704 } 705 706 /* Encode bgp4V2NlriIndex*/ 707 /bgpd/bgp_snmp_bgp4v2.c: 483 in bgp4v2PathAttrLookup() 477 offset++; 478 479 /* get bgp4V2NlriPrefix */ 480 if (prefix_type == IANA_AFI_IPV4) { 481 oid2in_addr(offset, IN_ADDR_SIZE, &addr->u.prefix4); 482 addr->family = AF_INET; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 483 offset += IN_ADDR_SIZE; 484 } else if (prefix_type == IANA_AFI_IPV6) { 485 oid2in6_addr(offset, &addr->u.prefix6); 486 addr->family = AF_INET6; 487 offset += IN6_ADDR_SIZE; 488 } /bgpd/bgp_snmp_bgp4v2.c: 561 in bgp4v2PathAttrLookup() 555 addr->family = AF_INET; 556 offset += IN_ADDR_SIZE; 557 offsetlen -= IN_ADDR_SIZE; 558 } else if (prefix_type == IANA_AFI_IPV6) { 559 oid2in6_addr(offset, &addr->u.prefix6); 560 addr->family = AF_INET6; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 561 offset += IN6_ADDR_SIZE; 562 offsetlen -= IN6_ADDR_SIZE; 563 } 564 565 /* get bgp4V2NlriPrefixLen */ 566 if (offsetlen > 0) /bgpd/bgp_snmp_bgp4v2.c: 695 in bgp4v2PathAttrLookup() 689 /* Encode bgp4V2PeerRemoteAddr */ 690 if (min_family == AF_INET) { 691 *offset = IANA_AFI_IPV4; 692 offset++; 693 oid_copy_in_addr(offset, 694 &min->peer->connection->su.sin.sin_addr); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 695 offset += IN_ADDR_SIZE; 696 addr->u.prefix4 = rn_p->u.prefix4; 697 } else { 698 *offset = IANA_AFI_IPV6; 699 offset++; 700 oid_copy_in6_addr( /bgpd/bgp_snmp_bgp4v2.c: 682 in bgp4v2PathAttrLookup() 676 oid_copy_in_addr(offset, &rn_p->u.prefix4); 677 offset += IN_ADDR_SIZE; 678 } else { 679 *offset = IANA_AFI_IPV6; 680 offset++; 681 oid_copy_in6_addr(offset, &rn_p->u.prefix6); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 682 offset += IN6_ADDR_SIZE; 683 } 684 /* encode bgp4V2NlriPrefixLen into index*/ 685 *offset = rn_p->prefixlen; 686 offset++; 687 /bgpd/bgp_snmp_bgp4v2.c: 487 in bgp4v2PathAttrLookup() 481 oid2in_addr(offset, IN_ADDR_SIZE, &addr->u.prefix4); 482 addr->family = AF_INET; 483 offset += IN_ADDR_SIZE; 484 } else if (prefix_type == IANA_AFI_IPV6) { 485 oid2in6_addr(offset, &addr->u.prefix6); 486 addr->family = AF_INET6; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 487 offset += IN6_ADDR_SIZE; 488 } 489 490 /* get bgp4V2NlriPrefixLen */ 491 addr->prefixlen = *offset; 492 offset++; /bgpd/bgp_snmp_bgp4v2.c: 677 in bgp4v2PathAttrLookup() 671 /* encode bgp4V2NlriPrefixType into index*/ 672 /* encode bgp4V2NlriPrefix into index */ 673 if (rn_p->family == AF_INET) { 674 *offset = IANA_AFI_IPV4; 675 offset++; 676 oid_copy_in_addr(offset, &rn_p->u.prefix4); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 677 offset += IN_ADDR_SIZE; 678 } else { 679 *offset = IANA_AFI_IPV6; 680 offset++; 681 oid_copy_in6_addr(offset, &rn_p->u.prefix6); 682 offset += IN6_ADDR_SIZE; /bgpd/bgp_snmp_bgp4v2.c: 556 in bgp4v2PathAttrLookup() 550 prefix_type = *offset; 551 offset++; 552 /* get bgp4V2NlriPrefix */ 553 if (prefix_type == IANA_AFI_IPV4) { 554 oid2in_addr(offset, IN_ADDR_SIZE, &addr->u.prefix4); 555 addr->family = AF_INET; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 556 offset += IN_ADDR_SIZE; 557 offsetlen -= IN_ADDR_SIZE; 558 } else if (prefix_type == IANA_AFI_IPV6) { 559 oid2in6_addr(offset, &addr->u.prefix6); 560 addr->family = AF_INET6; 561 offset += IN6_ADDR_SIZE; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 08 Nov '23

08 Nov '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1570951: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 2344 in mgmt_txn_notify_be_adapter_conn() ________________________________________________________________________________________________________ *** CID 1570951: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 2344 in mgmt_txn_notify_be_adapter_conn() 2338 * completed */ 2339 if (txn->type == MGMTD_TXN_TYPE_CONFIG) { 2340 cmtcfg_req = txn->commit_cfg_req 2341 ? &txn->commit_cfg_req->req 2342 .commit_cfg 2343 : NULL; >>> CID 1570951: Integer handling issues (BAD_SHIFT) >>> In expression "1ULL << adapter->id", shifting by a negative amount has undefined behavior. The shift amount, "adapter->id", is as little as -1. 2344 if (cmtcfg_req && IS_IDBIT_SET(cmtcfg_req->clients, 2345 adapter->id)) { 2346 mgmt_txn_send_commit_cfg_reply( 2347 txn, MGMTD_INTERNAL_ERROR, 2348 "Backend daemon disconnected while processing commit!"); 2349 } ** CID 1570950: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1344 in mgmt_txn_send_be_cfg_data() ________________________________________________________________________________________________________ *** CID 1570950: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1344 in mgmt_txn_send_be_cfg_data() 1338 struct mgmt_be_cfgreq cfg_req = { 0 }; 1339 size_t num_batches, indx; 1340 1341 assert(txn->type == MGMTD_TXN_TYPE_CONFIG && txn->commit_cfg_req); 1342 1343 cmtcfg_req = &txn->commit_cfg_req->req.commit_cfg; >>> CID 1570950: Integer handling issues (BAD_SHIFT) >>> In expression "1ULL << adapter->id", shifting by a negative amount has undefined behavior. The shift amount, "adapter->id", is as little as -1. 1344 assert(IS_IDBIT_SET(cmtcfg_req->clients, adapter->id)); 1345 1346 indx = 0; 1347 num_batches = 1348 mgmt_txn_batches_count(&cmtcfg_req->curr_batches[adapter->id]); 1349 FOREACH_TXN_CFG_BATCH_IN_LIST (&cmtcfg_req->curr_batches[adapter->id], ** CID 1570949: (BAD_SHIFT) /mgmtd/mgmt_be_adapter.c: 168 in mgmt_register_client_xpath() /mgmtd/mgmt_be_adapter.c: 161 in mgmt_register_client_xpath() ________________________________________________________________________________________________________ *** CID 1570949: (BAD_SHIFT) /mgmtd/mgmt_be_adapter.c: 168 in mgmt_register_client_xpath() 162 return; 163 } 164 } 165 /* we didn't find a matching entry */ 166 map = darr_append(*maps); 167 map->xpath_prefix = XSTRDUP(MTYPE_MGMTD_XPATH, xpath); >>> CID 1570949: (BAD_SHIFT) >>> In expression "1UL << id", shifting by a negative amount has undefined behavior. The shift amount, "id", is as little as -1. 168 map->clients = (1ul << id); 169 } 170 171 /* 172 * initial the combined maps from per client maps 173 */ /mgmtd/mgmt_be_adapter.c: 161 in mgmt_register_client_xpath() 155 struct mgmt_be_xpath_map **maps, *map; 156 157 maps = config ? &be_cfg_xpath_map : &be_oper_xpath_map; 158 159 darr_foreach_p (*maps, map) { 160 if (!strcmp(xpath, map->xpath_prefix)) { >>> CID 1570949: (BAD_SHIFT) >>> In expression "1U << id", shifting by a negative amount has undefined behavior. The shift amount, "id", is as little as -1. 161 map->clients |= (1u << id); 162 return; 163 } 164 } 165 /* we didn't find a matching entry */ 166 map = darr_append(*maps); ** CID 1570948: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1397 in mgmt_txn_send_be_txn_delete() ________________________________________________________________________________________________________ *** CID 1570948: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1397 in mgmt_txn_send_be_txn_delete() 1391 struct mgmt_commit_cfg_req *cmtcfg_req = 1392 &txn->commit_cfg_req->req.commit_cfg; 1393 1394 assert(txn->type == MGMTD_TXN_TYPE_CONFIG); 1395 assert(!mgmt_txn_batches_count(&cmtcfg_req->curr_batches[adapter->id])); 1396 >>> CID 1570948: Integer handling issues (BAD_SHIFT) >>> In expression "1ULL << adapter->id", shifting by a negative amount has undefined behavior. The shift amount, "adapter->id", is as little as -1. 1397 if (IS_IDBIT_UNSET(cmtcfg_req->clients, adapter->id)) 1398 return 0; 1399 1400 return mgmt_be_send_txn_req(adapter, txn->txn_id, false); 1401 } 1402 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

Results of the 2023 FRR TSC elections
by Alistair Woodman 07 Nov '23

07 Nov '23

All, The TSC election was closed yesterday. 21 out of 25 eligible maintainers voted. Here are the results. In alphabetical order, the following nominees were elected by single transferable vote. Jafar Al-Gharaibeh Lou Berger Donald Sharp Mark Stapp Russ White Martin Winter I would like to thank all the nominees and maintainers that were involved in the process. /a (FRR elections officer) > On Oct 17, 2023, at 15:48, Alistair Woodman <awoodman(a)netdef.org> wrote: > > Dear FRR maintainers, > > This is the third and final call for nominees to the FRR TSC election. I will close the nominations window in 72 hours. > > At the moment I have only the existing 6 TSC members on the ballot. Should no new nominees come forward within 72 hours, the existing 6 TSC members will be reconfirmed without a formal election. > > Please unicast me with any questions. > > /a > >>> On Oct 2, 2023, at 23:34, Alistair Woodman <awoodman(a)netdef.org> wrote: >>> >> >> All, >> >> This is the first request for nominations for candidates for the 2023 TSC elections. >> >> Please contact me with nominations or questions. >> 1) Self-nominations are welcome. >> 2) All nominees must be active FRR maintainers in order to stand. >> 3) Present TSC members must opt-out of being auto-nominated. >> 4) If you plan to nominate someone else, please get their approval first. >> >> /a >> >> (your friendly FRR community elections officer)

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 31 Oct '23

31 Oct '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1570864: Incorrect expression (UNINTENDED_INTEGER_DIVISION) /bgpd/bgp_labelpool.c: 656 in bgp_lp_event_zebra_up() ________________________________________________________________________________________________________ *** CID 1570864: Incorrect expression (UNINTENDED_INTEGER_DIVISION) /bgpd/bgp_labelpool.c: 656 in bgp_lp_event_zebra_up() 650 651 lp->next_chunksize <<= 1; 652 } 653 654 /* round up */ 655 if (((float)labels_needed / (float)lp->next_chunksize) > >>> CID 1570864: Incorrect expression (UNINTENDED_INTEGER_DIVISION) >>> Dividing integer expressions "labels_needed" and "lp->next_chunksize", and then converting the integer quotient to type "float". Any remainder, or fractional part of the quotient, is ignored. 656 (labels_needed / lp->next_chunksize)) 657 chunks_needed = (labels_needed / lp->next_chunksize) + 1; 658 else 659 chunks_needed = (labels_needed / lp->next_chunksize); 660 labels_needed = chunks_needed * lp->next_chunksize; 661 ** CID 1570863: Control flow issues (DEADCODE) /zebra/redistribute.c: 138 in zebra_redistribute() ________________________________________________________________________________________________________ *** CID 1570863: Control flow issues (DEADCODE) /zebra/redistribute.c: 138 in zebra_redistribute() 132 && (newre->type != type 133 || newre->instance != instance))) 134 continue; 135 if (!zebra_check_addr(&rn->p)) 136 continue; 137 >>> CID 1570863: Control flow issues (DEADCODE) >>> Execution cannot reach the expression "newre->vrf_id != 0U" inside this statement: "if (type == ZEBRA_ROUTE_ADD...". 138 if (type == ZEBRA_ROUTE_ADD && is_table_direct && 139 newre->vrf_id != VRF_DEFAULT) 140 continue; 141 142 zsend_redistribute_route(ZEBRA_REDISTRIBUTE_ROUTE_ADD, 143 client, rn, newre, is_table_direct); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0