- dev - lists.frrouting.org

Results of the 2023 FRR TSC elections
by Alistair Woodman 07 Nov '23

07 Nov '23

All, The TSC election was closed yesterday. 21 out of 25 eligible maintainers voted. Here are the results. In alphabetical order, the following nominees were elected by single transferable vote. Jafar Al-Gharaibeh Lou Berger Donald Sharp Mark Stapp Russ White Martin Winter I would like to thank all the nominees and maintainers that were involved in the process. /a (FRR elections officer) > On Oct 17, 2023, at 15:48, Alistair Woodman <awoodman(a)netdef.org> wrote: > > Dear FRR maintainers, > > This is the third and final call for nominees to the FRR TSC election. I will close the nominations window in 72 hours. > > At the moment I have only the existing 6 TSC members on the ballot. Should no new nominees come forward within 72 hours, the existing 6 TSC members will be reconfirmed without a formal election. > > Please unicast me with any questions. > > /a > >>> On Oct 2, 2023, at 23:34, Alistair Woodman <awoodman(a)netdef.org> wrote: >>> >> >> All, >> >> This is the first request for nominations for candidates for the 2023 TSC elections. >> >> Please contact me with nominations or questions. >> 1) Self-nominations are welcome. >> 2) All nominees must be active FRR maintainers in order to stand. >> 3) Present TSC members must opt-out of being auto-nominated. >> 4) If you plan to nominate someone else, please get their approval first. >> >> /a >> >> (your friendly FRR community elections officer)

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 01 Nov '23

01 Nov '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1570864: Incorrect expression (UNINTENDED_INTEGER_DIVISION) /bgpd/bgp_labelpool.c: 656 in bgp_lp_event_zebra_up() ________________________________________________________________________________________________________ *** CID 1570864: Incorrect expression (UNINTENDED_INTEGER_DIVISION) /bgpd/bgp_labelpool.c: 656 in bgp_lp_event_zebra_up() 650 651 lp->next_chunksize <<= 1; 652 } 653 654 /* round up */ 655 if (((float)labels_needed / (float)lp->next_chunksize) > >>> CID 1570864: Incorrect expression (UNINTENDED_INTEGER_DIVISION) >>> Dividing integer expressions "labels_needed" and "lp->next_chunksize", and then converting the integer quotient to type "float". Any remainder, or fractional part of the quotient, is ignored. 656 (labels_needed / lp->next_chunksize)) 657 chunks_needed = (labels_needed / lp->next_chunksize) + 1; 658 else 659 chunks_needed = (labels_needed / lp->next_chunksize); 660 labels_needed = chunks_needed * lp->next_chunksize; 661 ** CID 1570863: Control flow issues (DEADCODE) /zebra/redistribute.c: 138 in zebra_redistribute() ________________________________________________________________________________________________________ *** CID 1570863: Control flow issues (DEADCODE) /zebra/redistribute.c: 138 in zebra_redistribute() 132 && (newre->type != type 133 || newre->instance != instance))) 134 continue; 135 if (!zebra_check_addr(&rn->p)) 136 continue; 137 >>> CID 1570863: Control flow issues (DEADCODE) >>> Execution cannot reach the expression "newre->vrf_id != 0U" inside this statement: "if (type == ZEBRA_ROUTE_ADD...". 138 if (type == ZEBRA_ROUTE_ADD && is_table_direct && 139 newre->vrf_id != VRF_DEFAULT) 140 continue; 141 142 zsend_redistribute_route(ZEBRA_REDISTRIBUTE_ROUTE_ADD, 143 client, rn, newre, is_table_direct); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

FIX FRRouting
by Александр Николаевич 01 Nov '23

01 Nov '23

2 1

Assistance Needed with Pending Pull Request Review
by 彭凯飞 31 Oct '23

31 Oct '23

Hello FRRouting Development Team, I hope this message finds you well. I am reaching out in regard to a pull request I submitted to the FRRouting repository about six months ago, which can be found here: [#12862](https://github.com/FRRouting/frr/pull/12862). The PR has successfully passed the CI tests four months ago and has been awaiting a review since then. My pull request was initially assigned to Mr. David Lamparter for review. I've tried reaching out to him directly, but I suspect he may not be actively checking his email. I hold great respect for his expertise and contributions to the project and would very much value his feedback on my submission. Given the circumstances, I kindly request the community's assistance in either reminding Mr. Lamparter about the review or suggesting an alternative reviewer if he is currently unavailable. I understand everyone has their commitments and priorities, but I'm eager to contribute and would greatly appreciate any guidance or feedback on the pull request. Thank you for your understanding and consideration. I'm looking forward to being a part of the FRRouting project's ongoing development. Best regards, Kaifei Peng https://github.com/ponedo

2 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 25 Oct '23

25 Oct '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1569357: (OVERRUN) /bgpd/bgp_packet.c: 3310 in bgp_dynamic_capability_fqdn() /bgpd/bgp_packet.c: 3343 in bgp_dynamic_capability_fqdn() ________________________________________________________________________________________________________ *** CID 1569357: (OVERRUN) /bgpd/bgp_packet.c: 3310 in bgp_dynamic_capability_fqdn() 3304 memcpy(&str, data, len); 3305 str[len] = '\0'; 3306 } 3307 data += len; 3308 3309 if (len) { >>> CID 1569357: (OVERRUN) >>> Overrunning array "str" of 65 bytes at byte offset 65 using index "len" (which evaluates to 65). 3310 str[len] = '\0'; 3311 3312 XFREE(MTYPE_BGP_PEER_HOST, peer->hostname); 3313 XFREE(MTYPE_BGP_PEER_HOST, peer->domainname); 3314 3315 peer->hostname = XSTRDUP(MTYPE_BGP_PEER_HOST, str); /bgpd/bgp_packet.c: 3343 in bgp_dynamic_capability_fqdn() 3337 memcpy(&str, data, len); 3338 str[len] = '\0'; 3339 } 3340 data += len; 3341 3342 if (len) { >>> CID 1569357: (OVERRUN) >>> Overrunning array "str" of 65 bytes at byte offset 65 using index "len" (which evaluates to 65). 3343 str[len] = '\0'; 3344 3345 XFREE(MTYPE_BGP_PEER_HOST, peer->domainname); 3346 3347 peer->domainname = XSTRDUP(MTYPE_BGP_PEER_HOST, str); 3348 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

First notice for nominations for candidates for the FRR 2023 TSC elections.
by Alistair Woodman 17 Oct '23

17 Oct '23

All, This is the first request for nominations for candidates for the 2023 TSC elections. Please contact me with nominations or questions. 1) Self-nominations are welcome. 2) All nominees must be active FRR maintainers in order to stand. 3) Present TSC members must opt-out of being auto-nominated. 4) If you plan to nominate someone else, please get their approval first. /a (your friendly FRR community elections officer)

1 2

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 28 Sep '23

28 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 6 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 6 of 6 defect(s) ** CID 1568381: Insecure data handling (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 1408 in bgp_linkstate_tlv_opaque_display() ________________________________________________________________________________________________________ *** CID 1568381: Insecure data handling (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 1408 in bgp_linkstate_tlv_opaque_display() 1402 1403 if (pnt + sub_length > lim) { 1404 vty_out(vty, "Bad length received: %u\n", sub_length); 1405 break; 1406 } 1407 >>> CID 1568381: Insecure data handling (TAINTED_SCALAR) >>> Using tainted variable "sub_length" as a loop boundary. 1408 for (i = 0; i < sub_length; i++) { 1409 if (i != 0 && i % 8 == 0) 1410 vty_out(vty, " "); 1411 vty_out(vty, "%02x", *pnt); 1412 } 1413 } ** CID 1568380: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568380: Insecure data handling (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 692 in bgp_linkstate_nlri_prefix_json() 686 length = pnt_decode16(&pnt); 687 688 if (pnt + length > lim) 689 /* bad length */ 690 return; 691 >>> CID 1568380: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_nlri_value_display", which uses it as an offset. 692 ret = bgp_linkstate_nlri_value_display(NULL, 0, pnt, nlri_type, 693 type, length, false, 694 json_nlri); 695 696 if (!ret) 697 /* bad length */ ** CID 1568379: Control flow issues (DEADCODE) /bgpd/bgp_attr.c: 784 in link_state_hash_cmp() ________________________________________________________________________________________________________ *** CID 1568379: Control flow issues (DEADCODE) /bgpd/bgp_attr.c: 784 in link_state_hash_cmp() 778 const struct bgp_attr_ls *link_state1 = p1; 779 const struct bgp_attr_ls *link_state2 = p2; 780 781 if (!link_state1 && link_state2) 782 return false; 783 if (!link_state1 && link_state2) >>> CID 1568379: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return false;". 784 return false; 785 if (!link_state1 && !link_state2) 786 return true; 787 788 if (link_state1->length != link_state2->length) 789 return false; ** CID 1568378: (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568378: (TAINTED_SCALAR) /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as a loop boundary. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as a loop boundary. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as an offset. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as a loop boundary. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as an offset. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } /bgpd/bgp_linkstate_tlv.c: 1747 in bgp_linkstate_tlv_attribute_display() 1741 vty_out(vty, "Bad length received: %u\n", 1742 length); 1743 break; 1744 } 1745 } 1746 >>> CID 1568378: (TAINTED_SCALAR) >>> Passing tainted expression "length" to "bgp_linkstate_tlv_attribute_value_display", which uses it as an offset. 1747 bgp_linkstate_tlv_attribute_value_display( 1748 vty, pnt, type, length, indent, json_tlv); 1749 } ** CID 1568377: (OVERRUN) /bgpd/bgp_linkstate_tlv.c: 156 in bgp_ls_tlv_check_size() /bgpd/bgp_linkstate_tlv.c: 165 in bgp_ls_tlv_check_size() /bgpd/bgp_linkstate_tlv.c: 161 in bgp_ls_tlv_check_size() /bgpd/bgp_linkstate_tlv.c: 163 in bgp_ls_tlv_check_size() ________________________________________________________________________________________________________ *** CID 1568377: (OVERRUN) /bgpd/bgp_linkstate_tlv.c: 156 in bgp_ls_tlv_check_size() 150 }; 151 /* clang-format on */ 152 153 /* Return the TLV length is valid for the TLV type */ 154 static bool bgp_ls_tlv_check_size(enum bgp_linkstate_tlv type, size_t length) 155 { >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 156 if (type > BGP_LS_TLV_MAX || 157 bgp_linkstate_tlv_infos[type].descr == NULL) 158 /* TLV type is not defined. Cannot check size */ 159 return false; 160 161 if (bgp_linkstate_tlv_infos[type].min_size > length) /bgpd/bgp_linkstate_tlv.c: 165 in bgp_ls_tlv_check_size() 159 return false; 160 161 if (bgp_linkstate_tlv_infos[type].min_size > length) 162 return false; 163 if (bgp_linkstate_tlv_infos[type].max_size < length) 164 return false; >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 165 if (length % bgp_linkstate_tlv_infos[type].multiple != 0) 166 return false; 167 168 return true; 169 } 170 /bgpd/bgp_linkstate_tlv.c: 161 in bgp_ls_tlv_check_size() 155 { 156 if (type > BGP_LS_TLV_MAX || 157 bgp_linkstate_tlv_infos[type].descr == NULL) 158 /* TLV type is not defined. Cannot check size */ 159 return false; 160 >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 161 if (bgp_linkstate_tlv_infos[type].min_size > length) 162 return false; 163 if (bgp_linkstate_tlv_infos[type].max_size < length) 164 return false; 165 if (length % bgp_linkstate_tlv_infos[type].multiple != 0) 166 return false; /bgpd/bgp_linkstate_tlv.c: 163 in bgp_ls_tlv_check_size() 157 bgp_linkstate_tlv_infos[type].descr == NULL) 158 /* TLV type is not defined. Cannot check size */ 159 return false; 160 161 if (bgp_linkstate_tlv_infos[type].min_size > length) 162 return false; >>> CID 1568377: (OVERRUN) >>> Overrunning array "bgp_linkstate_tlv_infos" of 1253 16-byte elements at element index 1253 (byte offset 20063) using index "type" (which evaluates to 1253). 163 if (bgp_linkstate_tlv_infos[type].max_size < length) 164 return false; 165 if (length % bgp_linkstate_tlv_infos[type].multiple != 0) 166 return false; 167 168 return true; ** CID 1568376: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_attr.c: 4985 in bgp_packet_attribute() ________________________________________________________________________________________________________ *** CID 1568376: Null pointer dereferences (REVERSE_INULL) /bgpd/bgp_attr.c: 4985 in bgp_packet_attribute() 4979 /* VNC attribute */ 4980 bgp_packet_mpattr_tea(bgp, peer, s, attr, BGP_ATTR_VNC); 4981 #endif 4982 } 4983 4984 /* BGP Link-State */ >>> CID 1568376: Null pointer dereferences (REVERSE_INULL) >>> Null-checking "attr" suggests that it may be null, but it has already been dereferenced on all paths leading to the check. 4985 if (attr && attr->link_state) { 4986 stream_putc(s, BGP_ATTR_FLAG_OPTIONAL); 4987 stream_putc(s, BGP_ATTR_LINK_STATE); 4988 stream_putc(s, attr->link_state->length); 4989 stream_put(s, attr->link_state->data, attr->link_state->length); 4990 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 22 Sep '23

22 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 105 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1568249: Null pointer dereferences (FORWARD_NULL) ________________________________________________________________________________________________________ *** CID 1568249: Null pointer dereferences (FORWARD_NULL) /isisd/isis_route.c: 966 in isis_route_switchover_nexthop() 960 continue; 961 962 srcdest_rnode_prefixes(rnode, (const struct prefix **)&prefix, 963 (const struct prefix **)&src_p); 964 965 /* Switchover route. */ >>> CID 1568249: Null pointer dereferences (FORWARD_NULL) >>> Passing null pointer "area" to "isis_route_remove_previous_sid", which dereferences it. 966 isis_route_remove_previous_sid(area, prefix, rinfo); 967 UNSET_FLAG(rinfo->flag, ISIS_ROUTE_FLAG_ZEBRA_SYNCED); 968 isis_route_update(area, prefix, src_p, rinfo->backup); 969 970 isis_route_info_delete(rinfo); 971 972 rnode->info = NULL; 973 route_unlock_node(rnode); 974 } ** CID 1568248: API usage errors (USE_AFTER_FREE) /pimd/pim_ssmpingd.c: 188 in ssmpingd_socket() ________________________________________________________________________________________________________ *** CID 1568248: API usage errors (USE_AFTER_FREE) /pimd/pim_ssmpingd.c: 188 in ssmpingd_socket() 182 set_nonblocking(fd); 183 sockopt_reuseaddr(fd); 184 185 ret = ssmpingd_setsockopt(fd, addr, mttl); 186 if (ret) { 187 zlog_warn("ssmpingd_setsockopt failed"); >>> CID 1568248: API usage errors (USE_AFTER_FREE) >>> Calling "close(int)" closes handle "fd" which has already been closed. 188 close(fd); 189 return -1; 190 } 191 192 return fd; 193 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 21 Sep '23

21 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 13 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1568217: Memory - illegal accesses (RETURN_LOCAL) /bgpd/bgpd.h: 2604 in timestamp_string() ________________________________________________________________________________________________________ *** CID 1568217: Memory - illegal accesses (RETURN_LOCAL) /bgpd/bgpd.h: 2604 in timestamp_string() 2598 static inline char *timestamp_string(time_t ts) 2599 { 2600 time_t tbuf; 2601 char timebuf[32]; 2602 2603 tbuf = time(NULL) - (monotime(NULL) - ts); >>> CID 1568217: Memory - illegal accesses (RETURN_LOCAL) >>> Returning result of calling "ctime_r". 2604 return ctime_r(&tbuf, timebuf); 2605 } 2606 2607 static inline bool peer_established(struct peer_connection *connection) 2608 { 2609 return connection->status == Established; ** CID 1568216: Integer handling issues (NEGATIVE_RETURNS) ________________________________________________________________________________________________________ *** CID 1568216: Integer handling issues (NEGATIVE_RETURNS) /lib/vty.c: 2416 in vtysh_read() 2410 2411 /* warning: watchfrr hardcodes this result write 2412 */ 2413 header[3] = ret; 2414 buffer_put(vty->obuf, header, 4); 2415 >>> CID 1568216: Integer handling issues (NEGATIVE_RETURNS) >>> "vty->pass_fd" is passed to a parameter that cannot be negative. 2416 if (!vty->t_write && (vtysh_flush(vty) < 0)) 2417 /* Try to flush results; exit if a write 2418 * error occurs. */ 2419 return; 2420 } 2421 } ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 19 Sep '23

19 Sep '23

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 38 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 26 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 38 defect(s) ** CID 1568213: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568213: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_auth.c: 203 in ospf_auth_check_md5_digest() 197 EVP_DigestUpdate(ctx, auth_key, OSPF_AUTH_MD5_SIZE); 198 EVP_DigestFinal(ctx, digest, &md5_size); 199 EVP_MD_CTX_free(ctx); 200 #elif CRYPTO_INTERNAL 201 memset(&ctx, 0, sizeof(ctx)); 202 MD5Init(&ctx); >>> CID 1568213: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "length" to "md5_loop", which uses it as a loop boundary. 203 MD5Update(&ctx, ospfh, length); 204 MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE); 205 MD5Final(digest, &ctx); 206 #endif 207 208 /* compare the two */ ** CID 1568212: Insecure data handling (TAINTED_SCALAR) ________________________________________________________________________________________________________ *** CID 1568212: Insecure data handling (TAINTED_SCALAR) /ospfd/ospf_auth.c: 254 in ospf_auth_make_md5_digest() 248 EVP_DigestUpdate(ctx, auth_key, OSPF_AUTH_MD5_SIZE); 249 EVP_DigestFinal(ctx, digest, &md5_size); 250 EVP_MD_CTX_free(ctx); 251 #elif CRYPTO_INTERNAL 252 memset(&ctx, 0, sizeof(ctx)); 253 MD5Init(&ctx); >>> CID 1568212: Insecure data handling (TAINTED_SCALAR) >>> Passing tainted expression "length" to "md5_loop", which uses it as a loop boundary. 254 MD5Update(&ctx, ospfh, length); 255 MD5Update(&ctx, auth_key, OSPF_AUTH_MD5_SIZE); 256 MD5Final(digest, &ctx); 257 #endif 258 259 stream_put(op->s, digest, OSPF_AUTH_MD5_SIZE); ** CID 1568211: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_del() ________________________________________________________________________________________________________ *** CID 1568211: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_del() 172 { 173 uint32_t seed = a->s_bit ? 0x68f0eb5e : 0x156b7f19; 174 175 return jhash(&a->grp, sizeof(a->grp), seed); 176 } 177 >>> CID 1568211: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 178 DECLARE_HASH(gm_gsq_pends, struct gm_gsq_pending, itm, gm_gsq_pending_cmp, 179 gm_gsq_pending_hash); 180 181 /* 182 * interface -> (S,G) 183 */ ** CID 1568210: Integer handling issues (BAD_SHIFT) /vtysh/vtysh_config.c: 88 in config_master_hash_del() ________________________________________________________________________________________________________ *** CID 1568210: Integer handling issues (BAD_SHIFT) /vtysh/vtysh_config.c: 88 in config_master_hash_del() 82 static uint32_t config_hash(const struct config *c) 83 { 84 return string_hash_make(c->name); 85 } 86 87 DECLARE_LIST(config_master, struct config, rbt_item); >>> CID 1568210: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 88 DECLARE_HASH(config_master_hash, struct config, hash_item, config_cmp, 89 config_hash); 90 91 /* 92 * The config_master_head is a list for order of receipt 93 * The hash is for quick lookup under this NODE ** CID 1568209: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_const_next() ________________________________________________________________________________________________________ *** CID 1568209: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_const_next() 99 static int cpu_record_hash_cmp(const struct cpu_event_history *a, 100 const struct cpu_event_history *b) 101 { 102 return numcmp((uintptr_t)a->func, (uintptr_t)b->func); 103 } 104 >>> CID 1568209: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 105 DECLARE_HASH(cpu_records, struct cpu_event_history, item, cpu_record_hash_cmp, 106 cpu_record_hash_key); 107 108 static struct cpu_event_history *cpu_records_get(struct event_loop *loop, 109 void (*func)(struct event *e), 110 const char *funcname) ** CID 1568208: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_const_next() ________________________________________________________________________________________________________ *** CID 1568208: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_const_next() 48 49 /* Registration helper prototypes */ 50 static uint32_t registration_hash(const struct opq_msg_reg *reg); 51 static int registration_compare(const struct opq_msg_reg *reg1, 52 const struct opq_msg_reg *reg2); 53 >>> CID 1568208: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 54 DECLARE_HASH(opq_regh, struct opq_msg_reg, item, registration_compare, 55 registration_hash); 56 57 static struct opq_regh_head opq_reg_hash; 58 59 /* ** CID 1568207: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 139 in nbkey_map_del() ________________________________________________________________________________________________________ *** CID 1568207: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 139 in nbkey_map_del() 133 const struct req_map_data *b); 134 static uint32_t req_map_hash(const struct req_map_data *e); 135 136 /* Data Structure Declarations */ 137 DECLARE_HASH(plspid_map, struct plspid_map_data, mi, plspid_map_cmp, 138 plspid_map_hash); >>> CID 1568207: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 139 DECLARE_HASH(nbkey_map, struct nbkey_map_data, mi, nbkey_map_cmp, 140 nbkey_map_hash); 141 DECLARE_HASH(req_map, struct req_map_data, mi, req_map_cmp, req_map_hash); 142 143 static inline int req_entry_compare(const struct req_entry *a, 144 const struct req_entry *b) ** CID 1568206: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_del() ________________________________________________________________________________________________________ *** CID 1568206: Integer handling issues (BAD_SHIFT) /lib/event.c: 105 in cpu_records_del() 99 static int cpu_record_hash_cmp(const struct cpu_event_history *a, 100 const struct cpu_event_history *b) 101 { 102 return numcmp((uintptr_t)a->func, (uintptr_t)b->func); 103 } 104 >>> CID 1568206: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 105 DECLARE_HASH(cpu_records, struct cpu_event_history, item, cpu_record_hash_cmp, 106 cpu_record_hash_key); 107 108 static struct cpu_event_history *cpu_records_get(struct event_loop *loop, 109 void (*func)(struct event *e), 110 const char *funcname) ** CID 1568205: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 197 in bmp_qhash_del() ________________________________________________________________________________________________________ *** CID 1568205: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 197 in bmp_qhash_del() 191 + PSIZE(e->rd.prefixlen), 192 key); 193 194 return key; 195 } 196 >>> CID 1568205: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 197 DECLARE_HASH(bmp_qhash, struct bmp_queue_entry, bhi, 198 bmp_qhash_cmp, bmp_qhash_hkey); 199 200 static int bmp_active_cmp(const struct bmp_active *a, 201 const struct bmp_active *b) 202 { ** CID 1568204: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 80 in bmp_bgph_const_next() ________________________________________________________________________________________________________ *** CID 1568204: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 80 in bmp_bgph_const_next() 74 75 static uint32_t bmp_bgp_hash(const struct bmp_bgp *e) 76 { 77 return jhash(&e->bgp, sizeof(e->bgp), 0x55aa5a5a); 78 } 79 >>> CID 1568204: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 80 DECLARE_HASH(bmp_bgph, struct bmp_bgp, bbi, bmp_bgp_cmp, bmp_bgp_hash); 81 82 struct bmp_bgph_head bmp_bgph; 83 84 static int bmp_bgp_peer_cmp(const struct bmp_bgp_peer *a, 85 const struct bmp_bgp_peer *b) ** CID 1568203: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_del() ________________________________________________________________________________________________________ *** CID 1568203: Integer handling issues (BAD_SHIFT) /zebra/zebra_opaque.c: 54 in opq_regh_del() 48 49 /* Registration helper prototypes */ 50 static uint32_t registration_hash(const struct opq_msg_reg *reg); 51 static int registration_compare(const struct opq_msg_reg *reg1, 52 const struct opq_msg_reg *reg2); 53 >>> CID 1568203: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 54 DECLARE_HASH(opq_regh, struct opq_msg_reg, item, registration_compare, 55 registration_hash); 56 57 static struct opq_regh_head opq_reg_hash; 58 59 /* ** CID 1568202: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 137 in plspid_map_const_next() ________________________________________________________________________________________________________ *** CID 1568202: Integer handling issues (BAD_SHIFT) /pathd/path_pcep_pcc.c: 137 in plspid_map_const_next() 131 static uint32_t nbkey_map_hash(const struct nbkey_map_data *e); 132 static int req_map_cmp(const struct req_map_data *a, 133 const struct req_map_data *b); 134 static uint32_t req_map_hash(const struct req_map_data *e); 135 136 /* Data Structure Declarations */ >>> CID 1568202: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 137 DECLARE_HASH(plspid_map, struct plspid_map_data, mi, plspid_map_cmp, 138 plspid_map_hash); 139 DECLARE_HASH(nbkey_map, struct nbkey_map_data, mi, nbkey_map_cmp, 140 nbkey_map_hash); 141 DECLARE_HASH(req_map, struct req_map_data, mi, req_map_cmp, req_map_hash); 142 ** CID 1568201: Integer handling issues (BAD_SHIFT) /lib/qobj.c: 32 in qobj_nodes_del() ________________________________________________________________________________________________________ *** CID 1568201: Integer handling issues (BAD_SHIFT) /lib/qobj.c: 32 in qobj_nodes_del() 26 return -1; 27 if (na->nid > nb->nid) 28 return 1; 29 return 0; 30 } 31 >>> CID 1568201: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 32 DECLARE_HASH(qobj_nodes, struct qobj_node, nodehash, 33 qobj_cmp, qobj_hash); 34 35 static pthread_rwlock_t nodes_lock; 36 static struct qobj_nodes_head nodes = { }; 37 ** CID 1568200: Integer handling issues (BAD_SHIFT) /staticd/static_zebra.c: 69 in static_nht_hash_del() ________________________________________________________________________________________________________ *** CID 1568200: Integer handling issues (BAD_SHIFT) /staticd/static_zebra.c: 69 in static_nht_hash_del() 63 unsigned int key = 0; 64 65 key = prefix_hash_key(&nhtd->nh); 66 return jhash_2words(nhtd->nh_vrf_id, nhtd->safi, key); 67 } 68 >>> CID 1568200: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 69 DECLARE_HASH(static_nht_hash, struct static_nht_data, itm, static_nht_data_cmp, 70 static_nht_data_hash); 71 72 static struct static_nht_hash_head static_nht_hash[1]; 73 74 /* Zebra structure to hold current status. */ ** CID 1568199: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 249 in gm_subscribers_const_next() ________________________________________________________________________________________________________ *** CID 1568199: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 249 in gm_subscribers_const_next() 243 244 static uint32_t gm_subscriber_hash(const struct gm_subscriber *a) 245 { 246 return jhash(&a->addr, sizeof(a->addr), 0xd0e94ad4); 247 } 248 >>> CID 1568199: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 249 DECLARE_HASH(gm_subscribers, struct gm_subscriber, itm, gm_subscriber_cmp, 250 gm_subscriber_hash); 251 252 static struct gm_subscriber *gm_subscriber_findref(struct gm_if *gm_ifp, 253 pim_addr addr) 254 { ** CID 1568198: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_const_next() ________________________________________________________________________________________________________ *** CID 1568198: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_const_next() 93 94 static uint32_t bmp_bgp_peer_hash(const struct bmp_bgp_peer *e) 95 { 96 return e->peerid; 97 } 98 >>> CID 1568198: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 99 DECLARE_HASH(bmp_peerh, struct bmp_bgp_peer, bpi, 100 bmp_bgp_peer_cmp, bmp_bgp_peer_hash); 101 102 struct bmp_peerh_head bmp_peerh; 103 104 DECLARE_LIST(bmp_mirrorq, struct bmp_mirrorq, bmi); ** CID 1568197: Integer handling issues (BAD_SHIFT) /lib/table.c: 28 in rn_hash_node_del() ________________________________________________________________________________________________________ *** CID 1568197: Integer handling issues (BAD_SHIFT) /lib/table.c: 28 in rn_hash_node_del() 22 static int route_table_hash_cmp(const struct route_node *a, 23 const struct route_node *b) 24 { 25 return prefix_cmp(&a->p, &b->p); 26 } 27 >>> CID 1568197: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 28 DECLARE_HASH(rn_hash_node, struct route_node, nodehash, route_table_hash_cmp, 29 prefix_hash_key); 30 /* 31 * route_table_init_with_delegate 32 */ 33 struct route_table * ** CID 1568196: Integer handling issues (BAD_SHIFT) /lib/routemap.c: 49 in rmap_cmd_name_const_next() ________________________________________________________________________________________________________ *** CID 1568196: Integer handling issues (BAD_SHIFT) /lib/routemap.c: 49 in rmap_cmd_name_const_next() 43 44 static uint32_t rmap_cmd_name_hash(const struct route_map_rule_cmd_proxy *item) 45 { 46 return jhash(item->cmd->str, strlen(item->cmd->str), 0xbfd69320); 47 } 48 >>> CID 1568196: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 49 DECLARE_HASH(rmap_cmd_name, struct route_map_rule_cmd_proxy, itm, 50 rmap_cmd_name_cmp, rmap_cmd_name_hash); 51 52 static struct rmap_cmd_name_head rmap_match_cmds[1] = { 53 INIT_HASH(rmap_match_cmds[0]), 54 }; ** CID 1568195: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_del() ________________________________________________________________________________________________________ *** CID 1568195: Integer handling issues (BAD_SHIFT) /bgpd/bgp_bmp.c: 99 in bmp_peerh_del() 93 94 static uint32_t bmp_bgp_peer_hash(const struct bmp_bgp_peer *e) 95 { 96 return e->peerid; 97 } 98 >>> CID 1568195: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 99 DECLARE_HASH(bmp_peerh, struct bmp_bgp_peer, bpi, 100 bmp_bgp_peer_cmp, bmp_bgp_peer_hash); 101 102 struct bmp_peerh_head bmp_peerh; 103 104 DECLARE_LIST(bmp_mirrorq, struct bmp_mirrorq, bmi); ** CID 1568194: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_const_next() ________________________________________________________________________________________________________ *** CID 1568194: Integer handling issues (BAD_SHIFT) /pimd/pim6_mld.c: 178 in gm_gsq_pends_const_next() 172 { 173 uint32_t seed = a->s_bit ? 0x68f0eb5e : 0x156b7f19; 174 175 return jhash(&a->grp, sizeof(a->grp), seed); 176 } 177 >>> CID 1568194: Integer handling issues (BAD_SHIFT) >>> In expression "1U << h->hh.tabshift", left shifting by more than 31 bits has undefined behavior. The shift amount, "h->hh.tabshift", is as much as 33. 178 DECLARE_HASH(gm_gsq_pends, struct gm_gsq_pending, itm, gm_gsq_pending_cmp, 179 gm_gsq_pending_hash); 180 181 /* 182 * interface -> (S,G) 183 */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P…

1 0