- dev - lists.frrouting.org

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 04 Aug '17

04 Aug '17

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1452541: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_evpn.c: 2761 in bgp_evpn_init() ________________________________________________________________________________________________________ *** CID 1452541: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_evpn.c: 2761 in bgp_evpn_init() 2755 hash_create(vni_hash_key_make, vni_hash_cmp, "BGP VNI Hash"); 2756 bgp->import_rt_hash = 2757 hash_create(import_rt_hash_key_make, import_rt_hash_cmp, 2758 "BGP Import RT Hash"); 2759 bf_init(bgp->rd_idspace, UINT16_MAX); 2760 /*assign 0th index in the bitfield, so that we start with id 1*/ >>> CID 1452541: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a null pointer "bgp->rd_idspace.data". 2761 bf_assign_zero_index(bgp->rd_idspace); ** CID 1433360: Null pointer dereferences (NULL_RETURNS) /eigrpd/eigrp_packet.c: 268 in eigrp_make_sha256_digest() ________________________________________________________________________________________________________ *** CID 1433360: Null pointer dereferences (NULL_RETURNS) /eigrpd/eigrp_packet.c: 268 in eigrp_make_sha256_digest() 262 key = key_lookup_for_send(keychain); 263 264 // saved_len[index] = strnzcpyn(saved_key[index], key, 265 // PLAINTEXT_LENGTH + 1); 266 267 source_ip = calloc(16, sizeof(char)); >>> CID 1433360: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a pointer that might be null "source_ip" when calling "inet_ntop". 268 inet_ntop(AF_INET, &ei->address->u.prefix4, source_ip, 16); 269 270 memset(&ctx, 0, sizeof(ctx)); 271 buffer[0] = '\n'; 272 memcpy(buffer + 1, key, strlen(key->string)); 273 memcpy(buffer + 1 + strlen(key->string), source_ip, strlen(source_ip)); ** CID 1399484: Null pointer dereferences (NULL_RETURNS) /tools/permutations.c: 39 in main() ________________________________________________________________________________________________________ *** CID 1399484: Null pointer dereferences (NULL_RETURNS) /tools/permutations.c: 39 in main() 33 { 34 if (argc < 2) { 35 fprintf(stdout, USAGE "\n"); 36 exit(EXIT_SUCCESS); 37 } 38 struct cmd_element *cmd = calloc(1, sizeof(struct cmd_element)); >>> CID 1399484: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a null pointer "cmd". 39 cmd->string = strdup(argv[1]); 40 41 struct graph *graph = graph_new(); 42 struct cmd_token *token = 43 cmd_token_new(START_TKN, cmd->attr, NULL, NULL); 44 graph_new_node(graph, token, NULL); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "frr(a)lists.nox.tf", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 04 Aug '17

04 Aug '17

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1452539: Memory - corruptions (ARRAY_VS_SINGLETON) /lib/sbuf.c: 72 in sbuf_push() ________________________________________________________________________________________________________ *** CID 1452539: Memory - corruptions (ARRAY_VS_SINGLETON) /lib/sbuf.c: 72 in sbuf_push() 66 char dummy; 67 int written1, written2; 68 size_t new_size; 69 70 written1 = snprintf(&dummy, 0, "%*s", indent, ""); 71 va_start(args, format); >>> CID 1452539: Memory - corruptions (ARRAY_VS_SINGLETON) >>> Passing "&dummy" to function "vsnprintf" which uses it as an array. This might corrupt or misinterpret adjacent memory locations. 72 written2 = vsnprintf(&dummy, 0, format, args); 73 va_end(args); 74 75 new_size = buf->size; 76 if (written1 >= 0 && written2 >= 0) { 77 while (buf->pos + written1 + written2 >= new_size) ** CID 1452538: Resource leaks (RESOURCE_LEAK) /isisd/isis_pdu.c: 1534 in send_hello() ________________________________________________________________________________________________________ *** CID 1452538: Resource leaks (RESOURCE_LEAK) /isisd/isis_pdu.c: 1534 in send_hello() 1528 1529 struct isis_tlvs *tlvs = isis_alloc_tlvs(); 1530 1531 isis_tlvs_add_auth(tlvs, &circuit->passwd); 1532 1533 if (!listcount(circuit->area->area_addrs)) >>> CID 1452538: Resource leaks (RESOURCE_LEAK) >>> Variable "tlvs" going out of scope leaks the storage it points to. 1534 return ISIS_WARNING; 1535 isis_tlvs_add_area_addresses(tlvs, circuit->area->area_addrs); 1536 1537 if (circuit->circ_type == CIRCUIT_T_BROADCAST) 1538 isis_tlvs_add_lan_neighbors( 1539 tlvs, circuit->u.bc.lan_neighs[level - 1]); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "frr(a)lists.nox.tf", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 02 Aug '17

02 Aug '17

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 17 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 54 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 17 of 17 defect(s) ** CID 1452506: Resource leaks (RESOURCE_LEAK) /pimd/pim_msdp_socket.c: 159 in pim_msdp_sock_listen() ________________________________________________________________________________________________________ *** CID 1452506: Resource leaks (RESOURCE_LEAK) /pimd/pim_msdp_socket.c: 159 in pim_msdp_sock_listen() 153 if (pim->vrf_id != VRF_DEFAULT) { 154 struct interface *ifp = 155 if_lookup_by_name(pim->vrf->name, pim->vrf_id); 156 if (!ifp) { 157 zlog_err("%s: Unable to lookup vrf interface: %s", 158 __PRETTY_FUNCTION__, pim->vrf->name); >>> CID 1452506: Resource leaks (RESOURCE_LEAK) >>> Handle variable "sock" going out of scope leaks the handle. 159 return -1; 160 } 161 pim_socket_bind(sock, ifp); 162 } 163 164 if (pimd_privs.change(ZPRIVS_RAISE)) { ** CID 1452505: Error handling issues (CHECKED_RETURN) /pimd/pim_mroute.c: 717 in pim_mroute_socket_enable() ________________________________________________________________________________________________________ *** CID 1452505: Error handling issues (CHECKED_RETURN) /pimd/pim_mroute.c: 717 in pim_mroute_socket_enable() 711 zlog_err("pim_mroute_socket_enable: could not raise privs, %s", 712 safe_strerror(errno)); 713 714 fd = socket(AF_INET, SOCK_RAW, IPPROTO_IGMP); 715 716 #ifdef SO_BINDTODEVICE >>> CID 1452505: Error handling issues (CHECKED_RETURN) >>> Calling "setsockopt(fd, 1, 25, pim->vrf->name, strlen(pim->vrf->name))" without checking return value. This library function may fail and return an error code. 717 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, pim->vrf->name, 718 strlen(pim->vrf->name)); 719 #endif 720 721 if (pimd_privs.change(ZPRIVS_LOWER)) 722 zlog_err("pim_mroute_socket_enable: could not lower privs, %s", ** CID 1452504: Null pointer dereferences (FORWARD_NULL) /pimd/pim_instance.c: 198 in pim_vrf_config_write() ________________________________________________________________________________________________________ *** CID 1452504: Null pointer dereferences (FORWARD_NULL) /pimd/pim_instance.c: 198 in pim_vrf_config_write() 192 struct vrf *vrf; 193 struct pim_instance *pim; 194 195 RB_FOREACH(vrf, vrf_name_head, &vrfs_by_name) 196 { 197 pim = vrf->info; >>> CID 1452504: Null pointer dereferences (FORWARD_NULL) >>> Comparing "pim" to null implies that "pim" might be null. 198 if (!pim || vrf->vrf_id != VRF_DEFAULT) { 199 vty_out(vty, "vrf %s\n", vrf->name); 200 pim_global_config_write_worker(pim, vty); 201 vty_out(vty, "!\n"); 202 } 203 } ** CID 1452503: Error handling issues (CHECKED_RETURN) /zebra/zebra_vty.c: 1853 in show_ipv6_route() ________________________________________________________________________________________________________ *** CID 1452503: Error handling issues (CHECKED_RETURN) /zebra/zebra_vty.c: 1853 in show_ipv6_route() 1847 } 1848 1849 if (argv_find(argv, argc, "tag", &idx)) 1850 tag = strtoul(argv[idx + 1]->arg, NULL, 10); 1851 1852 else if (argv_find(argv, argc, "X:X::X:X/M", &idx)) { >>> CID 1452503: Error handling issues (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 1853 str2prefix(argv[idx]->arg, &p); 1854 longer_prefixes = true; 1855 } 1856 1857 else { 1858 if (argv_find(argv, argc, "kernel", &idx)) ** CID 1452502: Error handling issues (NEGATIVE_RETURNS) /pimd/pim_mroute.c: 717 in pim_mroute_socket_enable() ________________________________________________________________________________________________________ *** CID 1452502: Error handling issues (NEGATIVE_RETURNS) /pimd/pim_mroute.c: 717 in pim_mroute_socket_enable() 711 zlog_err("pim_mroute_socket_enable: could not raise privs, %s", 712 safe_strerror(errno)); 713 714 fd = socket(AF_INET, SOCK_RAW, IPPROTO_IGMP); 715 716 #ifdef SO_BINDTODEVICE >>> CID 1452502: Error handling issues (NEGATIVE_RETURNS) >>> "fd" is passed to a parameter that cannot be negative. 717 setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, pim->vrf->name, 718 strlen(pim->vrf->name)); 719 #endif 720 721 if (pimd_privs.change(ZPRIVS_LOWER)) 722 zlog_err("pim_mroute_socket_enable: could not lower privs, %s", ** CID 1452501: Null pointer dereferences (NULL_RETURNS) /pimd/pim_zebra.c: 185 in pim_zebra_if_state_up() ________________________________________________________________________________________________________ *** CID 1452501: Null pointer dereferences (NULL_RETURNS) /pimd/pim_zebra.c: 185 in pim_zebra_if_state_up() 179 if (sscanf(ifp->name, "pimreg%d", &table_id) == 1) { 180 struct vrf *vrf; 181 RB_FOREACH(vrf, vrf_name_head, &vrfs_by_name) 182 { 183 if ((table_id == vrf->data.l.table_id) 184 && (ifp->vrf_id != vrf->vrf_id)) { >>> CID 1452501: Null pointer dereferences (NULL_RETURNS) >>> Assigning: "master" = null return value from "if_lookup_by_name". 185 struct interface *master = if_lookup_by_name( 186 vrf->name, vrf->vrf_id); 187 zclient_interface_set_master(zclient, master, 188 ifp); 189 } 190 } ** CID 1452500: Error handling issues (CHECKED_RETURN) ________________________________________________________________________________________________________ *** CID 1452500: Error handling issues (CHECKED_RETURN) /pimd/pim_msdp_socket.c: 239 in pim_msdp_sock_connect() 233 if_lookup_by_name(mp->pim->vrf->name, mp->pim->vrf_id); 234 if (!ifp) { 235 zlog_err("%s: Unable to lookup vrf interface: %s", 236 __PRETTY_FUNCTION__, mp->pim->vrf->name); 237 return -1; 238 } >>> CID 1452500: Error handling issues (CHECKED_RETURN) >>> Calling "pim_socket_bind(mp->fd, ifp)" without checking return value. It wraps a library function that may fail and return an error code. 239 pim_socket_bind(mp->fd, ifp); 240 } 241 242 set_nonblocking(mp->fd); 243 244 /* Set socket send buffer size */ ** CID 1452499: Error handling issues (CHECKED_RETURN) ________________________________________________________________________________________________________ *** CID 1452499: Error handling issues (CHECKED_RETURN) /pimd/pim_msdp_socket.c: 161 in pim_msdp_sock_listen() 155 if_lookup_by_name(pim->vrf->name, pim->vrf_id); 156 if (!ifp) { 157 zlog_err("%s: Unable to lookup vrf interface: %s", 158 __PRETTY_FUNCTION__, pim->vrf->name); 159 return -1; 160 } >>> CID 1452499: Error handling issues (CHECKED_RETURN) >>> Calling "pim_socket_bind(sock, ifp)" without checking return value. It wraps a library function that may fail and return an error code. 161 pim_socket_bind(sock, ifp); 162 } 163 164 if (pimd_privs.change(ZPRIVS_RAISE)) { 165 zlog_err("pim_msdp_socket: could not raise privs, %s", 166 safe_strerror(errno)); ** CID 1452498: Memory - corruptions (REVERSE_NEGATIVE) /pimd/pim_mroute.c: 725 in pim_mroute_socket_enable() ________________________________________________________________________________________________________ *** CID 1452498: Memory - corruptions (REVERSE_NEGATIVE) /pimd/pim_mroute.c: 725 in pim_mroute_socket_enable() 719 #endif 720 721 if (pimd_privs.change(ZPRIVS_LOWER)) 722 zlog_err("pim_mroute_socket_enable: could not lower privs, %s", 723 safe_strerror(errno)); 724 >>> CID 1452498: Memory - corruptions (REVERSE_NEGATIVE) >>> You might be using variable "fd" before verifying that it is >= 0. 725 if (fd < 0) { 726 zlog_warn("Could not create mroute socket: errno=%d: %s", errno, 727 safe_strerror(errno)); 728 return -2; 729 } 730 ** CID 1452497: Control flow issues (MISSING_BREAK) /zebra/zserv.c: 2435 in zebra_client_read() ________________________________________________________________________________________________________ *** CID 1452497: Control flow issues (MISSING_BREAK) /zebra/zserv.c: 2435 in zebra_client_read() 2429 break; 2430 case ZEBRA_REMOTE_MACIP_ADD: 2431 zebra_vxlan_remote_macip_add(client, sock, length, zvrf); 2432 break; 2433 case ZEBRA_REMOTE_MACIP_DEL: 2434 zebra_vxlan_remote_macip_del(client, sock, length, zvrf); >>> CID 1452497: Control flow issues (MISSING_BREAK) >>> The above case falls through to this one. 2435 case ZEBRA_INTERFACE_SET_MASTER: 2436 zread_interface_set_master(client, sock, length); 2437 break; 2438 default: 2439 zlog_info("Zebra received unknown command %d", command); 2440 break; ** CID 1452496: Null pointer dereferences (NULL_RETURNS) /pimd/pim_cmd.c: 4898 in show_ip_mroute_count() ________________________________________________________________________________________________________ *** CID 1452496: Null pointer dereferences (NULL_RETURNS) /pimd/pim_cmd.c: 4898 in show_ip_mroute_count() 4892 VRF_CMD_HELP_STR 4893 "Route and packet count data\n") 4894 { 4895 int idx = 2; 4896 struct vrf *vrf = pim_cmd_lookup_vrf(vty, argv, argc, &idx); 4897 >>> CID 1452496: Null pointer dereferences (NULL_RETURNS) >>> Dereferencing a null pointer "vrf". 4898 show_mroute_count(vrf->info, vty); 4899 return CMD_SUCCESS; 4900 } 4901 4902 DEFUN (show_ip_mroute_count_vrf_all, 4903 show_ip_mroute_count_vrf_all_cmd, ** CID 1452495: Error handling issues (CHECKED_RETURN) /zebra/zebra_vty.c: 1198 in show_ip_route() ________________________________________________________________________________________________________ *** CID 1452495: Error handling issues (CHECKED_RETURN) /zebra/zebra_vty.c: 1198 in show_ip_route() 1192 } 1193 1194 if (argv_find(argv, argc, "tag", &idx)) 1195 tag = strtoul(argv[idx + 1]->arg, NULL, 10); 1196 1197 else if (argv_find(argv, argc, "A.B.C.D/M", &idx)) { >>> CID 1452495: Error handling issues (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 1198 str2prefix(argv[idx]->arg, &p); 1199 longer_prefixes = true; 1200 } 1201 1202 else if (argv_find(argv, argc, "supernets_only", &idx)) 1203 supernets_only = true; ** CID 1423945: Error handling issues (CHECKED_RETURN) /pimd/pim_ssm.c: 74 in pim_is_grp_standard_ssm() ________________________________________________________________________________________________________ *** CID 1423945: Error handling issues (CHECKED_RETURN) /pimd/pim_ssm.c: 74 in pim_is_grp_standard_ssm() 68 static int pim_is_grp_standard_ssm(struct prefix *group) 69 { 70 static int first = 1; 71 static struct prefix group_ssm; 72 73 if (first) { >>> CID 1423945: Error handling issues (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 74 str2prefix(PIM_SSM_STANDARD_RANGE, &group_ssm); 75 first = 0; 76 } 77 78 return prefix_match(&group_ssm, group); 79 } ** CID 1399208: Error handling issues (CHECKED_RETURN) /pimd/pim_rp.c: 545 in pim_rp_del() ________________________________________________________________________________________________________ *** CID 1399208: Error handling issues (CHECKED_RETURN) /pimd/pim_rp.c: 545 in pim_rp_del() 539 prefix2str(&nht_p, buf, sizeof(buf)); 540 zlog_debug("%s: Deregister RP addr %s with Zebra ", 541 __PRETTY_FUNCTION__, buf); 542 } 543 pim_delete_tracked_nexthop(pim, &nht_p, NULL, rp_info); 544 >>> CID 1399208: Error handling issues (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 545 str2prefix("224.0.0.0/4", &g_all); 546 rp_all = pim_rp_find_match_group(pim, &g_all); 547 548 if (rp_all == rp_info) { 549 rp_all->rp.rpf_addr.family = AF_INET; 550 rp_all->rp.rpf_addr.u.prefix4.s_addr = INADDR_NONE; ** CID 1399199: (CHECKED_RETURN) /bgpd/bgp_updgrp_adv.c: 697 in subgroup_default_originate() /bgpd/bgp_updgrp_adv.c: 699 in subgroup_default_originate() /bgpd/bgp_updgrp_adv.c: 764 in subgroup_default_originate() /bgpd/bgp_updgrp_adv.c: 766 in subgroup_default_originate() ________________________________________________________________________________________________________ *** CID 1399199: (CHECKED_RETURN) /bgpd/bgp_updgrp_adv.c: 697 in subgroup_default_originate() 691 692 bgp_attr_default_set(&attr, BGP_ORIGIN_IGP); 693 aspath = attr.aspath; 694 attr.local_pref = bgp->default_local_pref; 695 696 if (afi == AFI_IP) >>> CID 1399199: (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 697 str2prefix("0.0.0.0/0", &p); 698 else if (afi == AFI_IP6) { 699 str2prefix("::/0", &p); 700 701 /* IPv6 global nexthop must be included. */ 702 attr.mp_nexthop_len = BGP_ATTR_NHLEN_IPV6_GLOBAL; /bgpd/bgp_updgrp_adv.c: 699 in subgroup_default_originate() 693 aspath = attr.aspath; 694 attr.local_pref = bgp->default_local_pref; 695 696 if (afi == AFI_IP) 697 str2prefix("0.0.0.0/0", &p); 698 else if (afi == AFI_IP6) { >>> CID 1399199: (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 699 str2prefix("::/0", &p); 700 701 /* IPv6 global nexthop must be included. */ 702 attr.mp_nexthop_len = BGP_ATTR_NHLEN_IPV6_GLOBAL; 703 704 /* If the peer is on shared nextwork and we have link-local /bgpd/bgp_updgrp_adv.c: 764 in subgroup_default_originate() 758 * implicit withdraw for any previous UPDATEs sent for 759 * 0.0.0.0/0 so 760 * clear adj_out for the 0.0.0.0/0 prefix in the BGP 761 * table. 762 */ 763 if (afi == AFI_IP) >>> CID 1399199: (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 764 str2prefix("0.0.0.0/0", &p); 765 else 766 str2prefix("::/0", &p); 767 768 rn = bgp_afi_node_get(bgp->rib[afi][safi], afi, safi, 769 &p, NULL); /bgpd/bgp_updgrp_adv.c: 766 in subgroup_default_originate() 760 * clear adj_out for the 0.0.0.0/0 prefix in the BGP 761 * table. 762 */ 763 if (afi == AFI_IP) 764 str2prefix("0.0.0.0/0", &p); 765 else >>> CID 1399199: (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 766 str2prefix("::/0", &p); 767 768 rn = bgp_afi_node_get(bgp->rib[afi][safi], afi, safi, 769 &p, NULL); 770 bgp_adj_out_unset_subgroup( 771 rn, subgrp, 0, ** CID 1399197: (CHECKED_RETURN) /bgpd/bgp_updgrp_packet.c: 1095 in subgroup_default_update_packet() /bgpd/bgp_updgrp_packet.c: 1097 in subgroup_default_update_packet() ________________________________________________________________________________________________________ *** CID 1399197: (CHECKED_RETURN) /bgpd/bgp_updgrp_packet.c: 1095 in subgroup_default_update_packet() 1089 afi = SUBGRP_AFI(subgrp); 1090 safi = SUBGRP_SAFI(subgrp); 1091 bpacket_attr_vec_arr_reset(&vecarr); 1092 addpath_encode = bgp_addpath_encode_tx(peer, afi, safi); 1093 1094 if (afi == AFI_IP) >>> CID 1399197: (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 1095 str2prefix("0.0.0.0/0", &p); 1096 else 1097 str2prefix("::/0", &p); 1098 1099 /* Logging the attribute. */ 1100 if (bgp_debug_update(NULL, &p, subgrp->update_group, 0)) { /bgpd/bgp_updgrp_packet.c: 1097 in subgroup_default_update_packet() 1091 bpacket_attr_vec_arr_reset(&vecarr); 1092 addpath_encode = bgp_addpath_encode_tx(peer, afi, safi); 1093 1094 if (afi == AFI_IP) 1095 str2prefix("0.0.0.0/0", &p); 1096 else >>> CID 1399197: (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 1097 str2prefix("::/0", &p); 1098 1099 /* Logging the attribute. */ 1100 if (bgp_debug_update(NULL, &p, subgrp->update_group, 0)) { 1101 char attrstr[BUFSIZ]; 1102 char buf[PREFIX_STRLEN]; ** CID 1399194: (CHECKED_RETURN) /bgpd/bgp_updgrp_packet.c: 1181 in subgroup_default_withdraw_packet() /bgpd/bgp_updgrp_packet.c: 1183 in subgroup_default_withdraw_packet() ________________________________________________________________________________________________________ *** CID 1399194: (CHECKED_RETURN) /bgpd/bgp_updgrp_packet.c: 1181 in subgroup_default_withdraw_packet() 1175 peer = SUBGRP_PEER(subgrp); 1176 afi = SUBGRP_AFI(subgrp); 1177 safi = SUBGRP_SAFI(subgrp); 1178 addpath_encode = bgp_addpath_encode_tx(peer, afi, safi); 1179 1180 if (afi == AFI_IP) >>> CID 1399194: (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 1181 str2prefix("0.0.0.0/0", &p); 1182 else 1183 str2prefix("::/0", &p); 1184 1185 if (bgp_debug_update(NULL, &p, subgrp->update_group, 0)) { 1186 char buf[PREFIX_STRLEN]; /bgpd/bgp_updgrp_packet.c: 1183 in subgroup_default_withdraw_packet() 1177 safi = SUBGRP_SAFI(subgrp); 1178 addpath_encode = bgp_addpath_encode_tx(peer, afi, safi); 1179 1180 if (afi == AFI_IP) 1181 str2prefix("0.0.0.0/0", &p); 1182 else >>> CID 1399194: (CHECKED_RETURN) >>> Calling "str2prefix" without checking return value (as is done elsewhere 66 out of 78 times). 1183 str2prefix("::/0", &p); 1184 1185 if (bgp_debug_update(NULL, &p, subgrp->update_group, 0)) { 1186 char buf[PREFIX_STRLEN]; 1187 /* ' with addpath ID ' 17 1188 * max strlen of uint32 + 10 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "frr(a)lists.nox.tf", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

PIM VRF
by Donald Sharp 02 Aug '17

02 Aug '17

All - The ability for PIM to work within the context of linux VRF's has been committed into master. To configure for a VRF: vrf red <---- VRF configuration, same as global configuration ip pim ecmp ip pim rp 99.1.1.1 224.0.0.0/4 interface vrf red ip pim sm The 'interface vrf red' is treated like the loopback. So if you intend to use the particular router as a RP you should configure an ip address on your vrf device and configure pim to use it. interface swp1 vrf red <----- Turn on pim on the interface as per normal ip pim sm interface swp2 vrf red ip pim sm ip igmp thanks! donald

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 01 Aug '17

01 Aug '17

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 1 of 1 defect(s) ** CID 1452458: Control flow issues (UNREACHABLE) /bgpd/rfapi/rfapi_import.c: 3880 in rfapiBgpInfoFilteredImportFunction() ________________________________________________________________________________________________________ *** CID 1452458: Control flow issues (UNREACHABLE) /bgpd/rfapi/rfapi_import.c: 3880 in rfapiBgpInfoFilteredImportFunction() 3874 return rfapiBgpInfoFilteredImportEncap; 3875 3876 default: 3877 /* not expected */ 3878 return NULL; 3879 } >>> CID 1452458: Control flow issues (UNREACHABLE) >>> This code cannot be reached: "zlog_err("%s: bad safi %d",...". 3880 zlog_err("%s: bad safi %d", __func__, safi); 3881 return NULL; 3882 } 3883 3884 void rfapiProcessUpdate(struct peer *peer, 3885 void *rfd, /* set when looped from RFP/RFAPI */ ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "frr(a)lists.nox.tf", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 01 Aug '17

01 Aug '17

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 14 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 3 of 3 defect(s) ** CID 1452456: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1452456: Memory - corruptions (OVERRUN) /ospfd/ospf_ri.c: 1484 in no_pce_cap_flag() 1478 "no pce flag", 1479 NO_STR 1480 PCE_STR 1481 "Disable PCE capabilities\n") 1482 { 1483 >>> CID 1452456: Memory - corruptions (OVERRUN) >>> Overrunning struct type tlv_header of 4 bytes by passing it to a function which accesses it at byte offset 4. 1484 unset_param(&OspfRI.pce_info.pce_cap_flag.header); 1485 1486 /* Refresh RI LSA if already engaged */ 1487 if (CHECK_FLAG(OspfRI.flags, RIFLG_LSA_ENGAGED)) 1488 ospf_router_info_lsa_schedule(REFRESH_THIS_LSA); 1489 ** CID 1452455: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1452455: Memory - corruptions (OVERRUN) /ospfd/ospf_ri.c: 1295 in no_pce_path_scope() 1289 NO_STR 1290 PCE_STR 1291 "Disable PCE path scope\n" 1292 "32-bit Hexadecimal value\n") 1293 { 1294 >>> CID 1452455: Memory - corruptions (OVERRUN) >>> Overrunning struct type tlv_header of 4 bytes by passing it to a function which accesses it at byte offset 4. 1295 unset_param(&OspfRI.pce_info.pce_address.header); 1296 1297 /* Refresh RI LSA if already engaged */ 1298 if (CHECK_FLAG(OspfRI.flags, RIFLG_LSA_ENGAGED)) 1299 ospf_router_info_lsa_schedule(REFRESH_THIS_LSA); 1300 ** CID 1452454: Memory - corruptions (OVERRUN) ________________________________________________________________________________________________________ *** CID 1452454: Memory - corruptions (OVERRUN) /ospfd/ospf_ri.c: 1245 in no_pce_address() 1239 NO_STR 1240 PCE_STR 1241 "Disable PCE address\n" 1242 "PCE address in IPv4 address format\n") 1243 { 1244 >>> CID 1452454: Memory - corruptions (OVERRUN) >>> Overrunning struct type tlv_header of 4 bytes by passing it to a function which accesses it at byte offset 4. 1245 unset_param(&OspfRI.pce_info.pce_address.header); 1246 1247 /* Refresh RI LSA if already engaged */ 1248 if (CHECK_FLAG(OspfRI.flags, RIFLG_LSA_ENGAGED)) 1249 ospf_router_info_lsa_schedule(REFRESH_THIS_LSA); 1250 ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "frr(a)lists.nox.tf", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Today's Technical Meeting Aug 1, 2017
by Donald Sharp 01 Aug '17

01 Aug '17

All - Meeting is https://bluejeans.com/9192742159 at 11 am EDT 1) 3.0 status( issues ) 2) New Issues 3) PR's 4) Anything Else? donald

2 1

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 31 Jul '17

31 Jul '17

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 79 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 79 defect(s) ** CID 1452363: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 88 in no_ldp_address_family() ________________________________________________________________________________________________________ *** CID 1452363: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 88 in no_ldp_address_family() 82 if (_fail) 83 vty_out (vty, "%% invalid input for %s: %s\n", 84 argv[_i]->varname, argv[_i]->arg); 85 _failcnt += _fail; 86 } 87 if (_failcnt) >>> CID 1452363: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return 1;". 88 return CMD_WARNING; 89 return no_ldp_address_family_magic(self, vty, argc, argv, af); 90 } 91 92 /* ldp_discovery_holdtime => "[no] discovery <hello|targeted-hello>$hello_type holdtime (1-65535)$holdtime" */ 93 DEFUN_CMD_FUNC_DECL(ldp_discovery_holdtime) ** CID 1452362: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1045 in no_ldp_member_pseudowire() ________________________________________________________________________________________________________ *** CID 1452362: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1045 in no_ldp_member_pseudowire() 1039 if (_fail) 1040 vty_out (vty, "%% invalid input for %s: %s\n", 1041 argv[_i]->varname, argv[_i]->arg); 1042 _failcnt += _fail; 1043 } 1044 if (_failcnt) >>> CID 1452362: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return 1;". 1045 return CMD_WARNING; 1046 return no_ldp_member_pseudowire_magic(self, vty, argc, argv, ifname); 1047 } 1048 1049 /* ldp_vc_type => "[no] vc type <ethernet|ethernet-tagged>$vc_type" */ 1050 DEFUN_CMD_FUNC_DECL(ldp_vc_type) ** CID 1452361: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 743 in ldp_ttl_security_disable() ________________________________________________________________________________________________________ *** CID 1452361: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 743 in ldp_ttl_security_disable() 737 if (_fail) 738 vty_out (vty, "%% invalid input for %s: %s\n", 739 argv[_i]->varname, argv[_i]->arg); 740 _failcnt += _fail; 741 } 742 if (_failcnt) >>> CID 1452361: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return 1;". 743 return CMD_WARNING; 744 return ldp_ttl_security_disable_magic(self, vty, argc, argv, no); 745 } 746 747 /* ldp_session_holdtime => "[no] session holdtime (15-65535)$holdtime" */ 748 DEFUN_CMD_FUNC_DECL(ldp_session_holdtime) ** CID 1452360: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1758 in ldp_show_l2vpn_atom_vc() ________________________________________________________________________________________________________ *** CID 1452360: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1758 in ldp_show_l2vpn_atom_vc() 1752 if (_fail) 1753 vty_out (vty, "%% invalid input for %s: %s\n", 1754 argv[_i]->varname, argv[_i]->arg); 1755 _failcnt += _fail; 1756 } 1757 if (_failcnt) >>> CID 1452360: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return 1;". 1758 return CMD_WARNING; 1759 return ldp_show_l2vpn_atom_vc_magic(self, vty, argc, argv, json); 1760 } 1761 1762 /* ldp_show_debugging_mpls_ldp => "show debugging mpls ldp" */ 1763 DEFUN_CMD_FUNC_DECL(ldp_show_debugging_mpls_ldp) ** CID 1452359: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 24 in no_ldp_mpls_ldp() ________________________________________________________________________________________________________ *** CID 1452359: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 24 in no_ldp_mpls_ldp() 18 if (_fail) 19 vty_out (vty, "%% invalid input for %s: %s\n", 20 argv[_i]->varname, argv[_i]->arg); 21 _failcnt += _fail; 22 } 23 if (_failcnt) >>> CID 1452359: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return 1;". 24 return CMD_WARNING; 25 return no_ldp_mpls_ldp_magic(self, vty, argc, argv); 26 } 27 28 /* no_ldp_l2vpn => "no l2vpn WORD$l2vpn_name type vpls" */ 29 DEFUN_CMD_FUNC_DECL(no_ldp_l2vpn) ** CID 1452358: Null pointer dereferences (FORWARD_NULL) /ldpd/ldp_vty_cmds_clippy.c: 1101 in ldp_control_word() ________________________________________________________________________________________________________ *** CID 1452358: Null pointer dereferences (FORWARD_NULL) /ldpd/ldp_vty_cmds_clippy.c: 1101 in ldp_control_word() 1095 funcdecl_ldp_control_word; 1096 DEFUN_CMD_FUNC_TEXT(ldp_control_word) 1097 { 1098 int _i; 1099 unsigned _fail = 0, _failcnt = 0; 1100 const char *no = NULL; >>> CID 1452358: Null pointer dereferences (FORWARD_NULL) >>> Assigning: "preference" = "NULL". 1101 const char *preference = NULL; 1102 1103 for (_i = 0; _i < argc; _i++) { 1104 if (!argv[_i]->varname) 1105 continue; 1106 _fail = 0; ** CID 1452357: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1753 in ldp_show_l2vpn_atom_vc() ________________________________________________________________________________________________________ *** CID 1452357: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1753 in ldp_show_l2vpn_atom_vc() 1747 continue; 1748 _fail = 0; 1749 if (!strcmp(argv[_i]->varname, "json")) { 1750 json = argv[_i]->arg; 1751 } 1752 if (_fail) >>> CID 1452357: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "vty_out(vty, "%% invalid in...". 1753 vty_out (vty, "%% invalid input for %s: %s\n", 1754 argv[_i]->varname, argv[_i]->arg); 1755 _failcnt += _fail; 1756 } 1757 if (_failcnt) 1758 return CMD_WARNING; ** CID 1452356: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 706 in ldp_label_remote_accept() ________________________________________________________________________________________________________ *** CID 1452356: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 706 in ldp_label_remote_accept() 700 from_acl = argv[_i]->arg; 701 } 702 if (!strcmp(argv[_i]->varname, "for_acl")) { 703 for_acl = argv[_i]->arg; 704 } 705 if (_fail) >>> CID 1452356: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "vty_out(vty, "%% invalid in...". 706 vty_out (vty, "%% invalid input for %s: %s\n", 707 argv[_i]->varname, argv[_i]->arg); 708 _failcnt += _fail; 709 } 710 if (_failcnt) 711 return CMD_WARNING; ** CID 1452355: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 209 in ldp_dual_stack_transport_connection_prefer_ipv4() ________________________________________________________________________________________________________ *** CID 1452355: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 209 in ldp_dual_stack_transport_connection_prefer_ipv4() 203 continue; 204 _fail = 0; 205 if (!strcmp(argv[_i]->varname, "no")) { 206 no = argv[_i]->arg; 207 } 208 if (_fail) >>> CID 1452355: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "vty_out(vty, "%% invalid in...". 209 vty_out (vty, "%% invalid input for %s: %s\n", 210 argv[_i]->varname, argv[_i]->arg); 211 _failcnt += _fail; 212 } 213 if (_failcnt) 214 return CMD_WARNING; ** CID 1452354: Null pointer dereferences (FORWARD_NULL) /ldpd/ldp_vty_cmds_clippy.c: 73 in no_ldp_address_family() ________________________________________________________________________________________________________ *** CID 1452354: Null pointer dereferences (FORWARD_NULL) /ldpd/ldp_vty_cmds_clippy.c: 73 in no_ldp_address_family() 67 const char * af) 68 funcdecl_no_ldp_address_family; 69 DEFUN_CMD_FUNC_TEXT(no_ldp_address_family) 70 { 71 int _i; 72 unsigned _fail = 0, _failcnt = 0; >>> CID 1452354: Null pointer dereferences (FORWARD_NULL) >>> Assigning: "af" = "NULL". 73 const char *af = NULL; 74 75 for (_i = 0; _i < argc; _i++) { 76 if (!argv[_i]->varname) 77 continue; 78 _fail = 0; ** CID 1452353: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1694 in ldp_show_mpls_ldp_neighbor_capabilities() ________________________________________________________________________________________________________ *** CID 1452353: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1694 in ldp_show_mpls_ldp_neighbor_capabilities() 1688 if (_fail) 1689 vty_out (vty, "%% invalid input for %s: %s\n", 1690 argv[_i]->varname, argv[_i]->arg); 1691 _failcnt += _fail; 1692 } 1693 if (_failcnt) >>> CID 1452353: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return 1;". 1694 return CMD_WARNING; 1695 return ldp_show_mpls_ldp_neighbor_capabilities_magic(self, vty, argc, argv, json); 1696 } 1697 1698 /* ldp_show_l2vpn_atom_binding => "show l2vpn atom binding [json]$json" */ 1699 DEFUN_CMD_FUNC_DECL(ldp_show_l2vpn_atom_binding) ** CID 1452352: Null pointer dereferences (FORWARD_NULL) /ldpd/ldp_vty_cmds_clippy.c: 1030 in no_ldp_member_pseudowire() ________________________________________________________________________________________________________ *** CID 1452352: Null pointer dereferences (FORWARD_NULL) /ldpd/ldp_vty_cmds_clippy.c: 1030 in no_ldp_member_pseudowire() 1024 const char * ifname) 1025 funcdecl_no_ldp_member_pseudowire; 1026 DEFUN_CMD_FUNC_TEXT(no_ldp_member_pseudowire) 1027 { 1028 int _i; 1029 unsigned _fail = 0, _failcnt = 0; >>> CID 1452352: Null pointer dereferences (FORWARD_NULL) >>> Assigning: "ifname" = "NULL". 1030 const char *ifname = NULL; 1031 1032 for (_i = 0; _i < argc; _i++) { 1033 if (!argv[_i]->varname) 1034 continue; 1035 _fail = 0; ** CID 1452351: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1472 in ldp_debug_mpls_ldp_messages_sent() ________________________________________________________________________________________________________ *** CID 1452351: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1472 in ldp_debug_mpls_ldp_messages_sent() 1466 if (_fail) 1467 vty_out (vty, "%% invalid input for %s: %s\n", 1468 argv[_i]->varname, argv[_i]->arg); 1469 _failcnt += _fail; 1470 } 1471 if (_failcnt) >>> CID 1452351: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return 1;". 1472 return CMD_WARNING; 1473 return ldp_debug_mpls_ldp_messages_sent_magic(self, vty, argc, argv, no, all); 1474 } 1475 1476 /* ldp_show_mpls_ldp_binding => "show mpls ldp [<ipv4|ipv6>]$af binding [detail]$detail [json]$json" */ 1477 DEFUN_CMD_FUNC_DECL(ldp_show_mpls_ldp_binding) ** CID 1452350: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1276 in ldp_pw_status_disable() ________________________________________________________________________________________________________ *** CID 1452350: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1276 in ldp_pw_status_disable() 1270 continue; 1271 _fail = 0; 1272 if (!strcmp(argv[_i]->varname, "no")) { 1273 no = argv[_i]->arg; 1274 } 1275 if (_fail) >>> CID 1452350: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "vty_out(vty, "%% invalid in...". 1276 vty_out (vty, "%% invalid input for %s: %s\n", 1277 argv[_i]->varname, argv[_i]->arg); 1278 _failcnt += _fail; 1279 } 1280 if (_failcnt) 1281 return CMD_WARNING; ** CID 1452349: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1040 in no_ldp_member_pseudowire() ________________________________________________________________________________________________________ *** CID 1452349: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1040 in no_ldp_member_pseudowire() 1034 continue; 1035 _fail = 0; 1036 if (!strcmp(argv[_i]->varname, "ifname")) { 1037 ifname = argv[_i]->arg; 1038 } 1039 if (_fail) >>> CID 1452349: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "vty_out(vty, "%% invalid in...". 1040 vty_out (vty, "%% invalid input for %s: %s\n", 1041 argv[_i]->varname, argv[_i]->arg); 1042 _failcnt += _fail; 1043 } 1044 if (_failcnt) 1045 return CMD_WARNING; ** CID 1452348: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1785 in ldp_show_debugging_mpls_ldp() ________________________________________________________________________________________________________ *** CID 1452348: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1785 in ldp_show_debugging_mpls_ldp() 1779 if (_fail) 1780 vty_out (vty, "%% invalid input for %s: %s\n", 1781 argv[_i]->varname, argv[_i]->arg); 1782 _failcnt += _fail; 1783 } 1784 if (_failcnt) >>> CID 1452348: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return 1;". 1785 return CMD_WARNING; 1786 return ldp_show_debugging_mpls_ldp_magic(self, vty, argc, argv); ** CID 1452347: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1361 in ldp_debug_mpls_ldp_discovery_hello() ________________________________________________________________________________________________________ *** CID 1452347: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1361 in ldp_debug_mpls_ldp_discovery_hello() 1355 if (_fail) 1356 vty_out (vty, "%% invalid input for %s: %s\n", 1357 argv[_i]->varname, argv[_i]->arg); 1358 _failcnt += _fail; 1359 } 1360 if (_failcnt) >>> CID 1452347: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return 1;". 1361 return CMD_WARNING; 1362 return ldp_debug_mpls_ldp_discovery_hello_magic(self, vty, argc, argv, no, dir); 1363 } 1364 1365 /* ldp_debug_mpls_ldp_type => "[no] debug mpls ldp <errors|event|zebra>$type" */ 1366 DEFUN_CMD_FUNC_DECL(ldp_debug_mpls_ldp_type) ** CID 1452346: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1620 in ldp_show_mpls_ldp_capabilities() ________________________________________________________________________________________________________ *** CID 1452346: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1620 in ldp_show_mpls_ldp_capabilities() 1614 continue; 1615 _fail = 0; 1616 if (!strcmp(argv[_i]->varname, "json")) { 1617 json = argv[_i]->arg; 1618 } 1619 if (_fail) >>> CID 1452346: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "vty_out(vty, "%% invalid in...". 1620 vty_out (vty, "%% invalid input for %s: %s\n", 1621 argv[_i]->varname, argv[_i]->arg); 1622 _failcnt += _fail; 1623 } 1624 if (_failcnt) 1625 return CMD_WARNING; ** CID 1452345: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1726 in ldp_show_l2vpn_atom_binding() ________________________________________________________________________________________________________ *** CID 1452345: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1726 in ldp_show_l2vpn_atom_binding() 1720 if (_fail) 1721 vty_out (vty, "%% invalid input for %s: %s\n", 1722 argv[_i]->varname, argv[_i]->arg); 1723 _failcnt += _fail; 1724 } 1725 if (_failcnt) >>> CID 1452345: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "return 1;". 1726 return CMD_WARNING; 1727 return ldp_show_l2vpn_atom_binding_magic(self, vty, argc, argv, json); 1728 } 1729 1730 /* ldp_show_l2vpn_atom_vc => "show l2vpn atom vc [json]$json" */ 1731 DEFUN_CMD_FUNC_DECL(ldp_show_l2vpn_atom_vc) ** CID 1452344: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1780 in ldp_show_debugging_mpls_ldp() ________________________________________________________________________________________________________ *** CID 1452344: Control flow issues (DEADCODE) /ldpd/ldp_vty_cmds_clippy.c: 1780 in ldp_show_debugging_mpls_ldp() 1774 1775 for (_i = 0; _i < argc; _i++) { 1776 if (!argv[_i]->varname) 1777 continue; 1778 _fail = 0; 1779 if (_fail) >>> CID 1452344: Control flow issues (DEADCODE) >>> Execution cannot reach this statement: "vty_out(vty, "%% invalid in...". 1780 vty_out (vty, "%% invalid input for %s: %s\n", 1781 argv[_i]->varname, argv[_i]->arg); 1782 _failcnt += _fail; 1783 } 1784 if (_failcnt) 1785 return CMD_WARNING; 1786 return ldp_show_debugging_mpls_ldp_magic(self, vty, argc, argv); ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "frr(a)lists.nox.tf", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

New Defects reported by Coverity Scan for freerangerouting/frr
by scan-admin＠coverity.com 31 Jul '17

31 Jul '17

Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 2 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 1452282: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_vty_clippy.c: 186 in ipv6_route() ________________________________________________________________________________________________________ *** CID 1452282: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_vty_clippy.c: 186 in ipv6_route() 180 DEFUN_CMD_FUNC_TEXT(ipv6_route) 181 { 182 int _i; 183 unsigned _fail = 0, _failcnt = 0; 184 const char *no = NULL; 185 struct prefix_ipv6 prefix = { }; >>> CID 1452282: Null pointer dereferences (FORWARD_NULL) >>> Assigning: "prefix_str" = "NULL". 186 const char *prefix_str = NULL; 187 struct prefix_ipv6 from = { }; 188 const char *from_str = NULL; 189 struct in6_addr gate = IN6ADDR_ANY_INIT; 190 const char *gate_str = NULL; 191 const char *ifname = NULL; ** CID 1452281: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_vty_clippy.c: 23 in ip_mroute_dist() ________________________________________________________________________________________________________ *** CID 1452281: Null pointer dereferences (FORWARD_NULL) /zebra/zebra_vty_clippy.c: 23 in ip_mroute_dist() 17 DEFUN_CMD_FUNC_TEXT(ip_mroute_dist) 18 { 19 int _i; 20 unsigned _fail = 0, _failcnt = 0; 21 const char *no = NULL; 22 struct prefix_ipv4 prefix = { }; >>> CID 1452281: Null pointer dereferences (FORWARD_NULL) >>> Assigning: "prefix_str" = "NULL". 23 const char *prefix_str = NULL; 24 struct in_addr gate = { INADDR_ANY }; 25 const char *gate_str = NULL; 26 const char *ifname = NULL; 27 long distance = 0; 28 const char *distance_str = NULL; ________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0… To manage Coverity Scan email notifications for "frr(a)lists.nox.tf", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V0…

1 0

Backtraces and best way to check cause
by Nigel Kukard 30 Jul '17

30 Jul '17

Hi guys, I'm wondering what would be the best way to try track the cause of these two backtraces. I'm trying to replace a Quagga 1.1.1 box with FRR 2.0 but am blocked by the below. There are about 30 or so external peers. 4 internal private peers. About 40 or so route maps and maybe 100 prefix lists. Jul 30 01:43:36 x-01-x zebra[12658]: Assertion `object->next_best == *updptr || !*updptr' failed in file plist.c, line 613, function trie_install_fn Jul 30 01:43:36 x-01-x zebra[12658]: Backtrace for 15 stack frames: Jul 30 01:43:36 x-01-x zebra[12658]: [bt 0] /usr/lib/x86_64-linux-gnu/libfrr.so.0(zlog_backtrace+0x3a) [0x7f89359acada] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 1] /usr/lib/x86_64-linux-gnu/libfrr.so.0(_zlog_assert_failed+0x67) [0x7f89359ad027] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 2] /usr/lib/x86_64-linux-gnu/libfrr.so.0(+0x415c1) [0x7f89359ae5c1] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 3] /usr/lib/x86_64-linux-gnu/libfrr.so.0(+0x42195) [0x7f89359af195] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 4] /usr/lib/x86_64-linux-gnu/libfrr.so.0(+0x42858) [0x7f89359af858] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 5] /usr/lib/x86_64-linux-gnu/libfrr.so.0(+0x42b67) [0x7f89359afb67] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 6] /usr/lib/x86_64-linux-gnu/libfrr.so.0(+0x29c24) [0x7f8935996c24] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 7] /usr/lib/x86_64-linux-gnu/libfrr.so.0(cmd_execute_command+0xd0) [0x7f8935998180] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 8] /usr/lib/x86_64-linux-gnu/libfrr.so.0(+0x22dd2) [0x7f893598fdd2] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 9] /usr/lib/x86_64-linux-gnu/libfrr.so.0(+0x23103) [0x7f8935990103] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 10] /usr/lib/x86_64-linux-gnu/libfrr.so.0(+0x2468b) [0x7f893599168b] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 11] /usr/lib/x86_64-linux-gnu/libfrr.so.0(thread_call+0x6b) [0x7f893599ccdb] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 12] /usr/lib/frr/zebra(main+0x508) [0x555b24ff47b8] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 13] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f8934b70b45] Jul 30 01:43:36 x-01-x zebra[12658]: [bt 14] /usr/lib/frr/zebra(+0x1c9de) [0x555b24ff49de] Jul 30 01:43:36 x-01-x zebra[12658]: Current thread function vtysh_read, scheduled from file vty.c, line 2710 Jul 30 02:07:16 x-01-x bgpd[19976]: memory allocation count underflow for "BGP peer hostname" Jul 30 02:07:16 x-01-x bgpd[19976]: Backtrace for 10 stack frames: Jul 30 02:07:16 x-01-x bgpd[19976]: [bt 0] /usr/lib/x86_64-linux-gnu/libfrr.so.0(zlog_backtrace+0x3a) [0x7f0903fafada] Jul 30 02:07:16 x-01-x bgpd[19976]: [bt 1] /usr/lib/x86_64-linux-gnu/libfrr.so.0(qfree+0x4e) [0x7f0903fc464e] Jul 30 02:07:16 x-01-x bgpd[19976]: [bt 2] /usr/lib/frr/bgpd(peer_group_delete+0xd4) [0x557425e9a244] Jul 30 02:07:16 x-01-x bgpd[19976]: [bt 3] /usr/lib/frr/bgpd(bgp_delete+0x145) [0x557425e9aa05] Jul 30 02:07:16 x-01-x bgpd[19976]: [bt 4] /usr/lib/frr/bgpd(sigint+0x68) [0x557425e91778] Jul 30 02:07:16 x-01-x bgpd[19976]: [bt 5] /usr/lib/x86_64-linux-gnu/libfrr.so.0(quagga_sigevent_process+0x50) [0x7f0903fbc790] Jul 30 02:07:16 x-01-x bgpd[19976]: [bt 6] /usr/lib/x86_64-linux-gnu/libfrr.so.0(thread_fetch+0x5d) [0x7f0903f9f77d] Jul 30 02:07:16 x-01-x bgpd[19976]: [bt 7] /usr/lib/frr/bgpd(main+0x4c8) [0x557425e901c8] Jul 30 02:07:16 x-01-x bgpd[19976]: [bt 8] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) [0x7f0902e72b45] Jul 30 02:07:16 x-01-x bgpd[19976]: [bt 9] /usr/lib/frr/bgpd(+0x3f3dc) [0x557425e913dc] Kind Regards Nigel

1 0