- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 23 Jan '24

23 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 16 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 16 of 16 defect(s) ** CID 1575926: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1772 in rpki_expire_interval_magic() /bgpd/bgp_rpki.c: 1772 in rpki_expire_interval_magic() ________________________________________________________________________________________________________ *** CID 1575926: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1772 in rpki_expire_interval_magic() 1766 1767 if (vty->node == RPKI_VRF_NODE) 1768 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1769 else 1770 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1771 >>> CID 1575926: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1772 if ((unsigned int)tmp >= rpki_vrf->polling_period) { 1773 rpki_vrf->expire_interval = tmp; 1774 return CMD_SUCCESS; 1775 } 1776 1777 vty_out(vty, "%% Expiry interval must be polling period or larger\n"); /bgpd/bgp_rpki.c: 1772 in rpki_expire_interval_magic() 1766 1767 if (vty->node == RPKI_VRF_NODE) 1768 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1769 else 1770 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1771 >>> CID 1575926: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1772 if ((unsigned int)tmp >= rpki_vrf->polling_period) { 1773 rpki_vrf->expire_interval = tmp; 1774 return CMD_SUCCESS; 1775 } 1776 1777 vty_out(vty, "%% Expiry interval must be polling period or larger\n"); ** CID 1575925: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1833 in no_rpki_retry_interval() /bgpd/bgp_rpki.c: 1833 in no_rpki_retry_interval() ________________________________________________________________________________________________________ *** CID 1575925: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1833 in no_rpki_retry_interval() 1827 1828 if (vty->node == RPKI_VRF_NODE) 1829 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1830 else 1831 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1832 >>> CID 1575925: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1833 rpki_vrf->retry_interval = RETRY_INTERVAL_DEFAULT; 1834 return CMD_SUCCESS; 1835 } 1836 1837 DEFPY(rpki_cache, rpki_cache_cmd, 1838 "rpki cache <A.B.C.D|WORD> <TCPPORT|(1-65535)$sshport SSH_UNAME SSH_PRIVKEY [SERVER_PUBKEY]> [source <A.B.C.D>$bindaddr] preference (1-255)", /bgpd/bgp_rpki.c: 1833 in no_rpki_retry_interval() 1827 1828 if (vty->node == RPKI_VRF_NODE) 1829 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1830 else 1831 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1832 >>> CID 1575925: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1833 rpki_vrf->retry_interval = RETRY_INTERVAL_DEFAULT; 1834 return CMD_SUCCESS; 1835 } 1836 1837 DEFPY(rpki_cache, rpki_cache_cmd, 1838 "rpki cache <A.B.C.D|WORD> <TCPPORT|(1-65535)$sshport SSH_UNAME SSH_PRIVKEY [SERVER_PUBKEY]> [source <A.B.C.D>$bindaddr] preference (1-255)", ** CID 1575924: (CHECKED_RETURN) /bgpd/bgp_rpki.c: 1348 in rpki_create_socket() /bgpd/bgp_rpki.c: 1349 in rpki_create_socket() ________________________________________________________________________________________________________ *** CID 1575924: (CHECKED_RETURN) /bgpd/bgp_rpki.c: 1348 in rpki_create_socket() 1342 1343 pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &cancel_state); 1344 timeout.tv_sec = 30; 1345 timeout.tv_usec = 0; 1346 1347 optlen = sizeof(prev_rcv_tmout); >>> CID 1575924: (CHECKED_RETURN) >>> Calling "getsockopt(socket, 1, 20, &prev_rcv_tmout, &optlen)" without checking return value. This library function may fail and return an error code. 1348 getsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, &optlen); 1349 getsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, &optlen); 1350 1351 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)); 1352 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)); 1353 /bgpd/bgp_rpki.c: 1349 in rpki_create_socket() 1343 pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &cancel_state); 1344 timeout.tv_sec = 30; 1345 timeout.tv_usec = 0; 1346 1347 optlen = sizeof(prev_rcv_tmout); 1348 getsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, &optlen); >>> CID 1575924: (CHECKED_RETURN) >>> Calling "getsockopt(socket, 1, 21, &prev_snd_tmout, &optlen)" without checking return value. This library function may fail and return an error code. 1349 getsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, &optlen); 1350 1351 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)); 1352 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)); 1353 1354 if (connect(socket, res->ai_addr, res->ai_addrlen) == -1) { ** CID 1575923: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1735 in rpki_polling_period_magic() /bgpd/bgp_rpki.c: 1735 in rpki_polling_period_magic() ________________________________________________________________________________________________________ *** CID 1575923: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1735 in rpki_polling_period_magic() 1729 1730 if (vty->node == RPKI_VRF_NODE) 1731 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1732 else 1733 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1734 >>> CID 1575923: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1735 rpki_vrf->polling_period = pp; 1736 return CMD_SUCCESS; 1737 } 1738 1739 DEFUN (no_rpki_polling_period, 1740 no_rpki_polling_period_cmd, /bgpd/bgp_rpki.c: 1735 in rpki_polling_period_magic() 1729 1730 if (vty->node == RPKI_VRF_NODE) 1731 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1732 else 1733 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1734 >>> CID 1575923: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1735 rpki_vrf->polling_period = pp; 1736 return CMD_SUCCESS; 1737 } 1738 1739 DEFUN (no_rpki_polling_period, 1740 no_rpki_polling_period_cmd, ** CID 1575922: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1754 in no_rpki_polling_period() /bgpd/bgp_rpki.c: 1754 in no_rpki_polling_period() ________________________________________________________________________________________________________ *** CID 1575922: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1754 in no_rpki_polling_period() 1748 1749 if (vty->node == RPKI_VRF_NODE) 1750 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1751 else 1752 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1753 >>> CID 1575922: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1754 rpki_vrf->polling_period = POLLING_PERIOD_DEFAULT; 1755 return CMD_SUCCESS; 1756 } 1757 1758 DEFPY (rpki_expire_interval, 1759 rpki_expire_interval_cmd, /bgpd/bgp_rpki.c: 1754 in no_rpki_polling_period() 1748 1749 if (vty->node == RPKI_VRF_NODE) 1750 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1751 else 1752 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1753 >>> CID 1575922: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1754 rpki_vrf->polling_period = POLLING_PERIOD_DEFAULT; 1755 return CMD_SUCCESS; 1756 } 1757 1758 DEFPY (rpki_expire_interval, 1759 rpki_expire_interval_cmd, ** CID 1575921: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1796 in no_rpki_expire_interval() /bgpd/bgp_rpki.c: 1796 in no_rpki_expire_interval() ________________________________________________________________________________________________________ *** CID 1575921: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1796 in no_rpki_expire_interval() 1790 1791 if (vty->node == RPKI_VRF_NODE) 1792 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1793 else 1794 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1795 >>> CID 1575921: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1796 rpki_vrf->expire_interval = rpki_vrf->polling_period * 2; 1797 return CMD_SUCCESS; 1798 } 1799 1800 DEFPY (rpki_retry_interval, 1801 rpki_retry_interval_cmd, /bgpd/bgp_rpki.c: 1796 in no_rpki_expire_interval() 1790 1791 if (vty->node == RPKI_VRF_NODE) 1792 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1793 else 1794 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1795 >>> CID 1575921: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1796 rpki_vrf->expire_interval = rpki_vrf->polling_period * 2; 1797 return CMD_SUCCESS; 1798 } 1799 1800 DEFPY (rpki_retry_interval, 1801 rpki_retry_interval_cmd, ** CID 1575920: (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1575920: (NULL_RETURNS) /bgpd/bgp_rpki.c: 2425 in config_on_exit() 2419 struct rpki_vrf *rpki_vrf; 2420 2421 if (vty->node == RPKI_VRF_NODE) 2422 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 2423 else 2424 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); >>> CID 1575920: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "rpki_vrf" when calling "reset". 2425 reset(false, rpki_vrf); 2426 return 1; 2427 } 2428 2429 DEFPY(rpki_reset, 2430 rpki_reset_cmd, /bgpd/bgp_rpki.c: 2425 in config_on_exit() 2419 struct rpki_vrf *rpki_vrf; 2420 2421 if (vty->node == RPKI_VRF_NODE) 2422 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 2423 else 2424 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); >>> CID 1575920: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "rpki_vrf" when calling "reset". 2425 reset(false, rpki_vrf); 2426 return 1; 2427 } 2428 2429 DEFPY(rpki_reset, 2430 rpki_reset_cmd, ** CID 1575919: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1933 in no_rpki_cache_magic() /bgpd/bgp_rpki.c: 1933 in no_rpki_cache_magic() ________________________________________________________________________________________________________ *** CID 1575919: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1933 in no_rpki_cache_magic() 1927 1928 if (vty->node == RPKI_VRF_NODE) 1929 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1930 else 1931 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1932 >>> CID 1575919: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1933 cache_list = rpki_vrf->cache_list; 1934 cache_p = find_cache(preference, cache_list); 1935 if (!rpki_vrf || !cache_p) { 1936 vty_out(vty, "Could not find cache with preference %ld\n", 1937 preference); 1938 return CMD_WARNING; /bgpd/bgp_rpki.c: 1933 in no_rpki_cache_magic() 1927 1928 if (vty->node == RPKI_VRF_NODE) 1929 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1930 else 1931 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1932 >>> CID 1575919: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1933 cache_list = rpki_vrf->cache_list; 1934 cache_p = find_cache(preference, cache_list); 1935 if (!rpki_vrf || !cache_p) { 1936 vty_out(vty, "Could not find cache with preference %ld\n", 1937 preference); 1938 return CMD_WARNING; ** CID 1575918: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_rpki.c: 1294 in rpki_create_socket() ________________________________________________________________________________________________________ *** CID 1575918: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_rpki.c: 1294 in rpki_create_socket() 1288 int ret; 1289 #if defined(FOUND_SSH) 1290 struct tr_ssh_config *ssh_config; 1291 char s_port[10]; 1292 #endif 1293 >>> CID 1575918: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "cache" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1294 if (!cache) 1295 return -1; 1296 1297 if (rpki_vrf->vrfname == NULL) 1298 vrf = vrf_lookup_by_id(VRF_DEFAULT); 1299 else ** CID 1575917: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_rpki.c: 1631 in rpki() ________________________________________________________________________________________________________ *** CID 1575917: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_rpki.c: 1631 in rpki() 1625 if (vty->node == CONFIG_NODE) 1626 vty->node = RPKI_NODE; 1627 else { 1628 struct vrf *vrf = VTY_GET_CONTEXT(vrf); 1629 1630 vty->node = RPKI_VRF_NODE; >>> CID 1575917: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing "vrf", which is known to be "NULL". 1631 if (vrf->vrf_id != VRF_DEFAULT) 1632 vrfname = vrf->name; 1633 } 1634 1635 rpki_vrf = find_rpki_vrf(vrfname); 1636 if (!rpki_vrf) { ** CID 1575916: (CHECKED_RETURN) /bgpd/bgp_rpki.c: 1352 in rpki_create_socket() /bgpd/bgp_rpki.c: 1366 in rpki_create_socket() /bgpd/bgp_rpki.c: 1351 in rpki_create_socket() /bgpd/bgp_rpki.c: 1368 in rpki_create_socket() ________________________________________________________________________________________________________ *** CID 1575916: (CHECKED_RETURN) /bgpd/bgp_rpki.c: 1352 in rpki_create_socket() 1346 1347 optlen = sizeof(prev_rcv_tmout); 1348 getsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, &optlen); 1349 getsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, &optlen); 1350 1351 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)); >>> CID 1575916: (CHECKED_RETURN) >>> Calling "setsockopt(socket, 1, 21, &timeout, 16U)" without checking return value. This library function may fail and return an error code. 1352 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)); 1353 1354 if (connect(socket, res->ai_addr, res->ai_addrlen) == -1) { 1355 if (res) 1356 freeaddrinfo(res); 1357 close(socket); /bgpd/bgp_rpki.c: 1366 in rpki_create_socket() 1360 } 1361 1362 if (res) 1363 freeaddrinfo(res); 1364 pthread_setcancelstate(cancel_state, NULL); 1365 >>> CID 1575916: (CHECKED_RETURN) >>> Calling "setsockopt(socket, 1, 20, &prev_rcv_tmout, 16U)" without checking return value. This library function may fail and return an error code. 1366 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, 1367 sizeof(prev_rcv_tmout)); 1368 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, 1369 sizeof(prev_snd_tmout)); 1370 1371 return socket; /bgpd/bgp_rpki.c: 1351 in rpki_create_socket() 1345 timeout.tv_usec = 0; 1346 1347 optlen = sizeof(prev_rcv_tmout); 1348 getsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, &optlen); 1349 getsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, &optlen); 1350 >>> CID 1575916: (CHECKED_RETURN) >>> Calling "setsockopt(socket, 1, 20, &timeout, 16U)" without checking return value. This library function may fail and return an error code. 1351 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)); 1352 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)); 1353 1354 if (connect(socket, res->ai_addr, res->ai_addrlen) == -1) { 1355 if (res) 1356 freeaddrinfo(res); /bgpd/bgp_rpki.c: 1368 in rpki_create_socket() 1362 if (res) 1363 freeaddrinfo(res); 1364 pthread_setcancelstate(cancel_state, NULL); 1365 1366 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, 1367 sizeof(prev_rcv_tmout)); >>> CID 1575916: (CHECKED_RETURN) >>> Calling "setsockopt(socket, 1, 21, &prev_snd_tmout, 16U)" without checking return value. This library function may fail and return an error code. 1368 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, 1369 sizeof(prev_snd_tmout)); 1370 1371 return socket; 1372 } 1373 ** CID 1575915: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1814 in rpki_retry_interval_magic() /bgpd/bgp_rpki.c: 1814 in rpki_retry_interval_magic() ________________________________________________________________________________________________________ *** CID 1575915: (NULL_RETURNS) /bgpd/bgp_rpki.c: 1814 in rpki_retry_interval_magic() 1808 1809 if (vty->node == RPKI_VRF_NODE) 1810 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1811 else 1812 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1813 >>> CID 1575915: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1814 rpki_vrf->retry_interval = tmp; 1815 return CMD_SUCCESS; 1816 } 1817 1818 DEFUN (no_rpki_retry_interval, 1819 no_rpki_retry_interval_cmd, /bgpd/bgp_rpki.c: 1814 in rpki_retry_interval_magic() 1808 1809 if (vty->node == RPKI_VRF_NODE) 1810 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1811 else 1812 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1813 >>> CID 1575915: (NULL_RETURNS) >>> Dereferencing "rpki_vrf", which is known to be "NULL". 1814 rpki_vrf->retry_interval = tmp; 1815 return CMD_SUCCESS; 1816 } 1817 1818 DEFUN (no_rpki_retry_interval, 1819 no_rpki_retry_interval_cmd, ** CID 1575914: Resource leaks (RESOURCE_LEAK) /bgpd/bgp_rpki.c: 1341 in rpki_create_socket() ________________________________________________________________________________________________________ *** CID 1575914: Resource leaks (RESOURCE_LEAK) /bgpd/bgp_rpki.c: 1341 in rpki_create_socket() 1335 1336 frr_with_privs (&bgpd_privs) { 1337 socket = vrf_socket(res->ai_family, res->ai_socktype, 1338 res->ai_protocol, vrf->vrf_id, NULL); 1339 } 1340 if (socket < 0) >>> CID 1575914: Resource leaks (RESOURCE_LEAK) >>> Variable "res" going out of scope leaks the storage it points to. 1341 return -1; 1342 1343 pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &cancel_state); 1344 timeout.tv_sec = 30; 1345 timeout.tv_usec = 0; 1346 ** CID 1575913: (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1575913: (NULL_RETURNS) /bgpd/bgp_rpki.c: 2457 in rpki_reset_config_mode_magic() 2451 struct rpki_vrf *rpki_vrf; 2452 2453 if (vty->node == RPKI_VRF_NODE) 2454 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 2455 else 2456 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); >>> CID 1575913: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "rpki_vrf" when calling "reset". 2457 return reset(true, rpki_vrf) == SUCCESS ? CMD_SUCCESS : CMD_WARNING; 2458 } 2459 2460 DEFUN (debug_rpki, 2461 debug_rpki_cmd, 2462 "debug rpki", /bgpd/bgp_rpki.c: 2457 in rpki_reset_config_mode_magic() 2451 struct rpki_vrf *rpki_vrf; 2452 2453 if (vty->node == RPKI_VRF_NODE) 2454 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 2455 else 2456 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); >>> CID 1575913: (NULL_RETURNS) >>> Dereferencing a pointer that might be "NULL" "rpki_vrf" when calling "reset". 2457 return reset(true, rpki_vrf) == SUCCESS ? CMD_SUCCESS : CMD_WARNING; 2458 } 2459 2460 DEFUN (debug_rpki, 2461 debug_rpki_cmd, 2462 "debug rpki", ** CID 1575912: (REVERSE_INULL) /bgpd/bgp_rpki.c: 1355 in rpki_create_socket() /bgpd/bgp_rpki.c: 1362 in rpki_create_socket() ________________________________________________________________________________________________________ *** CID 1575912: (REVERSE_INULL) /bgpd/bgp_rpki.c: 1355 in rpki_create_socket() 1349 getsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &prev_snd_tmout, &optlen); 1350 1351 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)); 1352 setsockopt(socket, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)); 1353 1354 if (connect(socket, res->ai_addr, res->ai_addrlen) == -1) { >>> CID 1575912: (REVERSE_INULL) >>> Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1355 if (res) 1356 freeaddrinfo(res); 1357 close(socket); 1358 pthread_setcancelstate(cancel_state, NULL); 1359 return -1; 1360 } /bgpd/bgp_rpki.c: 1362 in rpki_create_socket() 1356 freeaddrinfo(res); 1357 close(socket); 1358 pthread_setcancelstate(cancel_state, NULL); 1359 return -1; 1360 } 1361 >>> CID 1575912: (REVERSE_INULL) >>> Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1362 if (res) 1363 freeaddrinfo(res); 1364 pthread_setcancelstate(cancel_state, NULL); 1365 1366 setsockopt(socket, SOL_SOCKET, SO_RCVTIMEO, &prev_rcv_tmout, 1367 sizeof(prev_rcv_tmout)); ** CID 1575911: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_rpki.c: 1935 in no_rpki_cache_magic() ________________________________________________________________________________________________________ *** CID 1575911: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_rpki.c: 1935 in no_rpki_cache_magic() 1929 rpki_vrf = VTY_GET_CONTEXT_SUB(rpki_vrf); 1930 else 1931 rpki_vrf = VTY_GET_CONTEXT(rpki_vrf); 1932 1933 cache_list = rpki_vrf->cache_list; 1934 cache_p = find_cache(preference, cache_list); >>> CID 1575911: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "rpki_vrf" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1935 if (!rpki_vrf || !cache_p) { 1936 vty_out(vty, "Could not find cache with preference %ld\n", 1937 preference); 1938 return CMD_WARNING; 1939 } 1940 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 12 Jan '24

12 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1575595: Null pointer dereferences (REVERSE_INULL) /lib/northbound_oper.c: 521 in nb_op_ys_init_node_infos() ________________________________________________________________________________________________________ *** CID 1575595: Null pointer dereferences (REVERSE_INULL) /lib/northbound_oper.c: 521 in nb_op_ys_init_node_infos() 515 516 /* Move up to the container if on a leaf currently. */ 517 if (node && 518 !CHECK_FLAG(node->schema->nodetype, LYS_CONTAINER | LYS_LIST)) 519 node = &node->parent->node; 520 assert(CHECK_FLAG(node->schema->nodetype, LYS_CONTAINER | LYS_LIST)); >>> CID 1575595: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "node" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 521 if (!node) 522 return NB_ERR_NOT_FOUND; 523 524 inner = node; 525 for (len = 1; inner->parent; len++) 526 inner = &inner->parent->node; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 11 Jan '24

11 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1575507: Null pointer dereferences (REVERSE_INULL) /lib/yang.c: 1146 in yang_lyd_trim_xpath() ________________________________________________________________________________________________________ *** CID 1575507: Null pointer dereferences (REVERSE_INULL) /lib/yang.c: 1146 in yang_lyd_trim_xpath() 1140 if (remove[i] == *root) 1141 *root = (*root)->next; 1142 lyd_free_tree(remove[i]); 1143 } 1144 darr_free(remove); 1145 >>> CID 1575507: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "set" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 1146 if (set) 1147 ly_set_free(set, NULL); 1148 1149 return LY_SUCCESS; 1150 #endif 1151 } ** CID 1575506: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/yang.c: 279 in yang_resolve_snode_xpath() ________________________________________________________________________________________________________ *** CID 1575506: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/yang.c: 279 in yang_resolve_snode_xpath() 273 if (!set->count) { 274 ly_set_free(set, NULL); 275 return LY_ENOTFOUND; 276 } 277 278 *simple = false; >>> CID 1575506: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "(int)(set->count - 1) <= 2147483647" is always true regardless of the values of its operands. This occurs as the logical second operand of "&&". 279 darr_ensure_i(*snodes, set->count - 1); 280 memcpy(*snodes, set->snodes, set->count * sizeof(set->snodes[0])); 281 ly_set_free(set, NULL); 282 return LY_SUCCESS; 283 } 284 ** CID 1575505: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/northbound.c: 184 in nb_nodes_find() ________________________________________________________________________________________________________ *** CID 1575505: Integer handling issues (CONSTANT_EXPRESSION_RESULT) /lib/northbound.c: 184 in nb_nodes_find() 178 uint i; 179 180 err = yang_resolve_snode_xpath(ly_native_ctx, xpath, &snodes, &simple); 181 if (err) 182 return NULL; 183 >>> CID 1575505: Integer handling issues (CONSTANT_EXPRESSION_RESULT) >>> "(int)(((snodes == NULL) ? 0 : (ssize_t)((struct darr_metadata *)snodes - 1)->len) - 1) <= 2147483647" is always true regardless of the values of its operands. This occurs as the logical second operand of "&&". 184 darr_ensure_i(nb_nodes, darr_lasti(snodes)); 185 darr_foreach_i (snodes, i) 186 nb_nodes[i] = snodes[i]->priv; 187 darr_free(snodes); 188 return nb_nodes; 189 } ** CID 1575504: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1575504: Insecure data handling (TAINTED_SCALAR) /mgmtd/mgmt_fe_adapter.c: 1103 in fe_adapter_send_tree_data() 1097 1098 if (!tree) { 1099 empty = yang_dnode_new(ly_native_ctx, false); 1100 tree = empty; 1101 } 1102 >>> CID 1575504: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "*buf" to "yang_print_tree_append", which uses it as an offset. 1103 ret = yang_print_tree_append(&buf, tree, result_type, 1104 (LYD_PRINT_WD_EXPLICIT | 1105 LYD_PRINT_WITHSIBLINGS)); 1106 /* buf may have been reallocated and moved */ 1107 msg = (typeof(msg))buf; 1108 (void)msg; /* suppress clang-SA unused warning on safety code */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 03 Jan '24

03 Jan '24

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1575079: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_dplane.c: 5950 in dplane_srv6_encap_srcaddr_set() ________________________________________________________________________________________________________ *** CID 1575079: Null pointer dereferences (REVERSE_INULL) /zebra/zebra_dplane.c: 5950 in dplane_srv6_encap_srcaddr_set() 5944 if (ret == AOK) 5945 result = ZEBRA_DPLANE_REQUEST_QUEUED; 5946 else { 5947 atomic_fetch_add_explicit(&zdplane_info 5948 .dg_srv6_encap_srcaddr_set_errors, 5949 1, memory_order_relaxed); >>> CID 1575079: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "ctx" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 5950 if (ctx) 5951 dplane_ctx_free(&ctx); 5952 } 5953 return result; 5954 } 5955 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 29 Dec '23

29 Dec '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 5 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 5 of 5 defect(s) ** CID 1574981: Null pointer dereferences (REVERSE_INULL) /lib/northbound.c: 2334 in nb_oper_data_iterate() ________________________________________________________________________________________________________ *** CID 1574981: Null pointer dereferences (REVERSE_INULL) /lib/northbound.c: 2334 in nb_oper_data_iterate() 2328 else 2329 ret = nb_oper_data_iter_node(nb_node->snode, xpath, list_entry, 2330 &list_keys, translator, true, 2331 flags, cb, arg, dnode); 2332 2333 list_delete(&list_dnodes); >>> CID 1574981: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "dnode" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 2334 if (dnode) { 2335 while (lyd_parent(dnode)) 2336 dnode = lyd_parent(dnode); 2337 2338 if (tree && ret == NB_OK) 2339 *tree = dnode; ** CID 1574980: Null pointer dereferences (FORWARD_NULL) /mgmtd/mgmt_txn.c: 1292 in txn_get_tree_data_done() ________________________________________________________________________________________________________ *** CID 1574980: Null pointer dereferences (FORWARD_NULL) /mgmtd/mgmt_txn.c: 1292 in txn_get_tree_data_done() 1286 get_tree->partial_error, false); 1287 1288 /* we're done with the request */ 1289 mgmt_txn_req_free(&txn_req); 1290 1291 if (ret) { >>> CID 1574980: Null pointer dereferences (FORWARD_NULL) >>> Dereferencing null pointer "txn_req". 1292 MGMTD_TXN_ERR("Error saving the results of GETTREE for txn-id %" PRIu64 1293 " req_id %" PRIu64 " to requested type %u", 1294 txn->txn_id, txn_req->req_id, 1295 get_tree->result_type); 1296 1297 (void)mgmt_fe_adapter_txn_error(txn->txn_id, txn_req->req_id, ** CID 1574979: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1574979: Insecure data handling (TAINTED_SCALAR) /lib/mgmt_msg.c: 114 in mgmt_msg_read() 108 * Message was longer than what was left and we have no 109 * available space to read more in. B/c mcount == 0 the 110 * message starts at the beginning of the stream so 111 * therefor the stream is too small to fit the message.. 112 * Resize the stream to fit. 113 */ >>> CID 1574979: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "mhdr->len" to "stream_new", which uses it as an allocation size. 114 news = stream_new(mhdr->len); 115 stream_put(news, mhdr, left); 116 stream_set_endp(news, left); 117 stream_free(ms->ins); 118 ms->ins = news; 119 } ** CID 1574978: Possible Control flow issues (DEADCODE) /mgmtd/mgmt_txn.c: 531 in mgmt_txn_req_free() ________________________________________________________________________________________________________ *** CID 1574978: Possible Control flow issues (DEADCODE) /mgmtd/mgmt_txn.c: 531 in mgmt_txn_req_free() 525 case MGMTD_TXN_GETTREE_TIMEOUT: 526 case MGMTD_TXN_CLEANUP: 527 break; 528 } 529 530 if ((*txn_req)->pending_be_proc && pending_list) { >>> CID 1574978: Possible Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "mgmt_txn_reqs_del(pending_l...". 531 mgmt_txn_reqs_del(pending_list, *txn_req); 532 MGMTD_TXN_DBG("Removed req-id: %" PRIu64 533 " from pending-list (left:%zu)", 534 (*txn_req)->req_id, 535 mgmt_txn_reqs_count(pending_list)); 536 } else if (req_list) { ** CID 1574977: Control flow issues (DEADCODE) /lib/vty.c: 3660 in vty_mgmt_get_data_result_notified() ________________________________________________________________________________________________________ *** CID 1574977: Control flow issues (DEADCODE) /lib/vty.c: 3660 in vty_mgmt_get_data_result_notified() 3654 for (indx = 0; indx < num_data; indx++) { 3655 vty_out(vty, " \"%s\": \"%s\"\n", yang_data[indx]->xpath, 3656 yang_data[indx]->value->encoded_str_val); 3657 } 3658 if (next_key < 0) { 3659 vty_out(vty, "]\n"); >>> CID 1574977: Control flow issues (DEADCODE) >>> Execution cannot reach the expression "1" inside this statement: "vty_mgmt_resume_response(vt...". 3660 vty_mgmt_resume_response(vty, 3661 success ? CMD_SUCCESS : CMD_WARNING); 3662 } 3663 3664 return 0; 3665 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 08 Dec '23

08 Dec '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1574320: Memory - illegal accesses (USE_AFTER_FREE) /zebra/zebra_rib.c: 1454 in rib_process() ________________________________________________________________________________________________________ *** CID 1574320: Memory - illegal accesses (USE_AFTER_FREE) /zebra/zebra_rib.c: 1454 in rib_process() 1448 /* 1449 * If zebra has a new_selected and a proto_re_changed 1450 * entry that was not the old selected and the protocol 1451 * is different, zebra should notify the upper level 1452 * protocol that the sent down entry was not selected 1453 */ >>> CID 1574320: Memory - illegal accesses (USE_AFTER_FREE) >>> Dereferencing freed pointer "proto_re_changed". 1454 if (new_selected && proto_re_changed && 1455 proto_re_changed != old_selected && 1456 new_selected->type != proto_re_changed->type) { 1457 struct rib_table_info *info = srcdest_rnode_table_info(rn); 1458 1459 zsend_route_notify_owner(rn, proto_re_changed, ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

FRR 9.0.1 and 8.5.3 Releases
by Jafar Al-Gharaibeh 28 Nov '23

28 Nov '23

Dear FRR Community, We are pleased to announce FRR 9.0.1 and FRR 8.5.3 bug fix releases. For release notes please visit: https://frrouting.org/release/ https://github.com/FRRouting/frr/releases Security updates: https://frrouting.org/security Cheers, The FRR Development Team!

1 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 15 Nov '23

15 Nov '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1571038: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1571038: Null pointer dereferences (FORWARD_NULL) /bgpd/bgp_bmp.c: 351 in bmp_per_peer_hdr() 345 /* set router-id but for LOC-RIB INSTANCE (RFC 9069) put the instance 346 * router-id if available or 0 347 */ 348 struct in_addr *bgp_id = 349 !is_locrib ? &peer->remote_id : bgp ? &bgp->router_id : NULL; 350 >>> CID 1571038: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "bgp_id" to "stream_put_in_addr", which dereferences it. 351 stream_put_in_addr(s, bgp_id); 352 353 /* Timestamp */ 354 if (tv) { 355 stream_putl(s, tv->tv_sec); 356 stream_putl(s, tv->tv_usec); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 12 Nov '23

12 Nov '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1570969: (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 534 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 575 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 514 in bgp4v2PathAttrLookup() ________________________________________________________________________________________________________ *** CID 1570969: (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 534 in bgp4v2PathAttrLookup() 528 /* Set OID offset for prefix type */ 529 offset = name + namelen; 530 offsetlen = *length - namelen; 531 len = offsetlen; 532 533 if (offsetlen == 0) { >>> CID 1570969: (OVERRUN) >>> Overrunning array "bgp->rib" of 4 64-byte elements at element index 4 (byte offset 319) using index "afi" (which evaluates to 4). 534 dest = bgp_table_top(bgp->rib[afi][SAFI_UNICAST]); 535 safi = SAFI_UNICAST; 536 } else { 537 538 /* bgp4V2NlriAfi is already get */ 539 /* it is comming from the name parameter */ /bgpd/bgp_snmp_bgp4v2.c: 575 in bgp4v2PathAttrLookup() 569 addr->prefixlen = afi_len * 8; 570 571 offset++; 572 offsetlen--; 573 574 /* get node */ >>> CID 1570969: (OVERRUN) >>> Overrunning array "bgp->rib" of 4 64-byte elements at element index 4 (byte offset 319) using index "afi" (which evaluates to 4). 575 dest = bgp_node_get(bgp->rib[afi][safi], addr); 576 } 577 578 if (!dest) 579 return NULL; 580 /bgpd/bgp_snmp_bgp4v2.c: 514 in bgp4v2PathAttrLookup() 508 else 509 oid2in6_addr(offset, &su.sin6.sin6_addr); 510 511 /* bgp4V2NlriIndex currently ignored */ 512 513 /* Lookup node */ >>> CID 1570969: (OVERRUN) >>> Overrunning array "bgp->rib" of 4 64-byte elements at element index 4 (byte offset 319) using index "afi" (which evaluates to 4). 514 dest = bgp_node_lookup(bgp->rib[afi][safi], addr); 515 if (dest) { 516 for (path = bgp_dest_get_bgp_path_info(dest); path; 517 path = path->next) 518 if (sockunion_same(&path->peer->connection->su, 519 &su)) ** CID 1570968: Memory - corruptions (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 605 in bgp4v2PathAttrLookup() ________________________________________________________________________________________________________ *** CID 1570968: Memory - corruptions (OVERRUN) /bgpd/bgp_snmp_bgp4v2.c: 605 in bgp4v2PathAttrLookup() 599 } else { 600 /* default case start with ipv4*/ 601 if (afi == AFI_IP) 602 family = AF_INET; 603 else 604 family = AF_INET6; >>> CID 1570968: Memory - corruptions (OVERRUN) >>> Overrunning struct type in_addr of 4 bytes by passing it to a function which accesses it at byte offset 15 using argument "16UL". 605 memset(&paddr.ip._v4_addr, 0, sizeof(paddr.ip)); 606 } 607 608 do { 609 min = NULL; 610 min_family = 0; ** CID 1570967: (SIZEOF_MISMATCH) /bgpd/bgp_snmp_bgp4v2.c: 702 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 483 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 561 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 695 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 682 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 487 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 677 in bgp4v2PathAttrLookup() /bgpd/bgp_snmp_bgp4v2.c: 556 in bgp4v2PathAttrLookup() ________________________________________________________________________________________________________ *** CID 1570967: (SIZEOF_MISMATCH) /bgpd/bgp_snmp_bgp4v2.c: 702 in bgp4v2PathAttrLookup() 696 addr->u.prefix4 = rn_p->u.prefix4; 697 } else { 698 *offset = IANA_AFI_IPV6; 699 offset++; 700 oid_copy_in6_addr( 701 offset, &min->peer->connection->su.sin6.sin6_addr); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 702 offset += IN6_ADDR_SIZE; 703 addr->u.prefix6 = rn_p->u.prefix6; 704 } 705 706 /* Encode bgp4V2NlriIndex*/ 707 /bgpd/bgp_snmp_bgp4v2.c: 483 in bgp4v2PathAttrLookup() 477 offset++; 478 479 /* get bgp4V2NlriPrefix */ 480 if (prefix_type == IANA_AFI_IPV4) { 481 oid2in_addr(offset, IN_ADDR_SIZE, &addr->u.prefix4); 482 addr->family = AF_INET; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 483 offset += IN_ADDR_SIZE; 484 } else if (prefix_type == IANA_AFI_IPV6) { 485 oid2in6_addr(offset, &addr->u.prefix6); 486 addr->family = AF_INET6; 487 offset += IN6_ADDR_SIZE; 488 } /bgpd/bgp_snmp_bgp4v2.c: 561 in bgp4v2PathAttrLookup() 555 addr->family = AF_INET; 556 offset += IN_ADDR_SIZE; 557 offsetlen -= IN_ADDR_SIZE; 558 } else if (prefix_type == IANA_AFI_IPV6) { 559 oid2in6_addr(offset, &addr->u.prefix6); 560 addr->family = AF_INET6; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 561 offset += IN6_ADDR_SIZE; 562 offsetlen -= IN6_ADDR_SIZE; 563 } 564 565 /* get bgp4V2NlriPrefixLen */ 566 if (offsetlen > 0) /bgpd/bgp_snmp_bgp4v2.c: 695 in bgp4v2PathAttrLookup() 689 /* Encode bgp4V2PeerRemoteAddr */ 690 if (min_family == AF_INET) { 691 *offset = IANA_AFI_IPV4; 692 offset++; 693 oid_copy_in_addr(offset, 694 &min->peer->connection->su.sin.sin_addr); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 695 offset += IN_ADDR_SIZE; 696 addr->u.prefix4 = rn_p->u.prefix4; 697 } else { 698 *offset = IANA_AFI_IPV6; 699 offset++; 700 oid_copy_in6_addr( /bgpd/bgp_snmp_bgp4v2.c: 682 in bgp4v2PathAttrLookup() 676 oid_copy_in_addr(offset, &rn_p->u.prefix4); 677 offset += IN_ADDR_SIZE; 678 } else { 679 *offset = IANA_AFI_IPV6; 680 offset++; 681 oid_copy_in6_addr(offset, &rn_p->u.prefix6); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 682 offset += IN6_ADDR_SIZE; 683 } 684 /* encode bgp4V2NlriPrefixLen into index*/ 685 *offset = rn_p->prefixlen; 686 offset++; 687 /bgpd/bgp_snmp_bgp4v2.c: 487 in bgp4v2PathAttrLookup() 481 oid2in_addr(offset, IN_ADDR_SIZE, &addr->u.prefix4); 482 addr->family = AF_INET; 483 offset += IN_ADDR_SIZE; 484 } else if (prefix_type == IANA_AFI_IPV6) { 485 oid2in6_addr(offset, &addr->u.prefix6); 486 addr->family = AF_INET6; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "16UL /* sizeof (struct in6_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in6_addr)" is extraneous and should be replaced with 1. 487 offset += IN6_ADDR_SIZE; 488 } 489 490 /* get bgp4V2NlriPrefixLen */ 491 addr->prefixlen = *offset; 492 offset++; /bgpd/bgp_snmp_bgp4v2.c: 677 in bgp4v2PathAttrLookup() 671 /* encode bgp4V2NlriPrefixType into index*/ 672 /* encode bgp4V2NlriPrefix into index */ 673 if (rn_p->family == AF_INET) { 674 *offset = IANA_AFI_IPV4; 675 offset++; 676 oid_copy_in_addr(offset, &rn_p->u.prefix4); >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 677 offset += IN_ADDR_SIZE; 678 } else { 679 *offset = IANA_AFI_IPV6; 680 offset++; 681 oid_copy_in6_addr(offset, &rn_p->u.prefix6); 682 offset += IN6_ADDR_SIZE; /bgpd/bgp_snmp_bgp4v2.c: 556 in bgp4v2PathAttrLookup() 550 prefix_type = *offset; 551 offset++; 552 /* get bgp4V2NlriPrefix */ 553 if (prefix_type == IANA_AFI_IPV4) { 554 oid2in_addr(offset, IN_ADDR_SIZE, &addr->u.prefix4); 555 addr->family = AF_INET; >>> CID 1570967: (SIZEOF_MISMATCH) >>> Adding "4UL /* sizeof (struct in_addr) */" to pointer "offset" of type "oid *" is suspicious because adding an integral value to this pointer automatically scales that value by the size, 8 bytes, of the pointed-to type, "oid". Most likely, "sizeof (struct in_addr)" is extraneous and should be replaced with 1. 556 offset += IN_ADDR_SIZE; 557 offsetlen -= IN_ADDR_SIZE; 558 } else if (prefix_type == IANA_AFI_IPV6) { 559 oid2in6_addr(offset, &addr->u.prefix6); 560 addr->family = AF_INET6; 561 offset += IN6_ADDR_SIZE; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 09 Nov '23

09 Nov '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 4 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 4 of 4 defect(s) ** CID 1570951: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 2344 in mgmt_txn_notify_be_adapter_conn() ________________________________________________________________________________________________________ *** CID 1570951: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 2344 in mgmt_txn_notify_be_adapter_conn() 2338 * completed */ 2339 if (txn->type == MGMTD_TXN_TYPE_CONFIG) { 2340 cmtcfg_req = txn->commit_cfg_req 2341 ? &txn->commit_cfg_req->req 2342 .commit_cfg 2343 : NULL; >>> CID 1570951: Integer handling issues (BAD_SHIFT) >>> In expression "1ULL << adapter->id", shifting by a negative amount has undefined behavior. The shift amount, "adapter->id", is as little as -1. 2344 if (cmtcfg_req && IS_IDBIT_SET(cmtcfg_req->clients, 2345 adapter->id)) { 2346 mgmt_txn_send_commit_cfg_reply( 2347 txn, MGMTD_INTERNAL_ERROR, 2348 "Backend daemon disconnected while processing commit!"); 2349 } ** CID 1570950: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1344 in mgmt_txn_send_be_cfg_data() ________________________________________________________________________________________________________ *** CID 1570950: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1344 in mgmt_txn_send_be_cfg_data() 1338 struct mgmt_be_cfgreq cfg_req = { 0 }; 1339 size_t num_batches, indx; 1340 1341 assert(txn->type == MGMTD_TXN_TYPE_CONFIG && txn->commit_cfg_req); 1342 1343 cmtcfg_req = &txn->commit_cfg_req->req.commit_cfg; >>> CID 1570950: Integer handling issues (BAD_SHIFT) >>> In expression "1ULL << adapter->id", shifting by a negative amount has undefined behavior. The shift amount, "adapter->id", is as little as -1. 1344 assert(IS_IDBIT_SET(cmtcfg_req->clients, adapter->id)); 1345 1346 indx = 0; 1347 num_batches = 1348 mgmt_txn_batches_count(&cmtcfg_req->curr_batches[adapter->id]); 1349 FOREACH_TXN_CFG_BATCH_IN_LIST (&cmtcfg_req->curr_batches[adapter->id], ** CID 1570949: (BAD_SHIFT) /mgmtd/mgmt_be_adapter.c: 168 in mgmt_register_client_xpath() /mgmtd/mgmt_be_adapter.c: 161 in mgmt_register_client_xpath() ________________________________________________________________________________________________________ *** CID 1570949: (BAD_SHIFT) /mgmtd/mgmt_be_adapter.c: 168 in mgmt_register_client_xpath() 162 return; 163 } 164 } 165 /* we didn't find a matching entry */ 166 map = darr_append(*maps); 167 map->xpath_prefix = XSTRDUP(MTYPE_MGMTD_XPATH, xpath); >>> CID 1570949: (BAD_SHIFT) >>> In expression "1UL << id", shifting by a negative amount has undefined behavior. The shift amount, "id", is as little as -1. 168 map->clients = (1ul << id); 169 } 170 171 /* 172 * initial the combined maps from per client maps 173 */ /mgmtd/mgmt_be_adapter.c: 161 in mgmt_register_client_xpath() 155 struct mgmt_be_xpath_map **maps, *map; 156 157 maps = config ? &be_cfg_xpath_map : &be_oper_xpath_map; 158 159 darr_foreach_p (*maps, map) { 160 if (!strcmp(xpath, map->xpath_prefix)) { >>> CID 1570949: (BAD_SHIFT) >>> In expression "1U << id", shifting by a negative amount has undefined behavior. The shift amount, "id", is as little as -1. 161 map->clients |= (1u << id); 162 return; 163 } 164 } 165 /* we didn't find a matching entry */ 166 map = darr_append(*maps); ** CID 1570948: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1397 in mgmt_txn_send_be_txn_delete() ________________________________________________________________________________________________________ *** CID 1570948: Integer handling issues (BAD_SHIFT) /mgmtd/mgmt_txn.c: 1397 in mgmt_txn_send_be_txn_delete() 1391 struct mgmt_commit_cfg_req *cmtcfg_req = 1392 &txn->commit_cfg_req->req.commit_cfg; 1393 1394 assert(txn->type == MGMTD_TXN_TYPE_CONFIG); 1395 assert(!mgmt_txn_batches_count(&cmtcfg_req->curr_batches[adapter->id])); 1396 >>> CID 1570948: Integer handling issues (BAD_SHIFT) >>> In expression "1ULL << adapter->id", shifting by a negative amount has undefined behavior. The shift amount, "adapter->id", is as little as -1. 1397 if (IS_IDBIT_UNSET(cmtcfg_req->clients, adapter->id)) 1398 return 0; 1399 1400 return mgmt_be_send_txn_req(adapter, txn->txn_id, false); 1401 } 1402 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0