New Defects reported by Coverity Scan for freerangerouting/frr
Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 20 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 64 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 20 defect(s) ** CID 1527498: Error handling issues (CHECKED_RETURN) /vtysh/vtysh_user.c: 166 in vtysh_banner_motd_line() ________________________________________________________________________________________________________ *** CID 1527498: Error handling issues (CHECKED_RETURN) /vtysh/vtysh_user.c: 166 in vtysh_banner_motd_line() 160 "Banner from an input\n" 161 "Text\n") 162 { 163 int idx = 0; 164 char *motd; 165
CID 1527498: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
166 argv_find(argv, argc, "LINE", &idx); 167 motd = argv_concat(argv, argc, idx); 168 169 cmd_banner_motd_line(motd); 170 XFREE(MTYPE_TMP, motd); 171
** CID 1527497: Error handling issues (CHECKED_RETURN) /ospfd/ospf_te.c: 4271 in show_ip_ospf_mpls_te_link() ________________________________________________________________________________________________________ *** CID 1527497: Error handling issues (CHECKED_RETURN) /ospfd/ospf_te.c: 4271 in show_ip_ospf_mpls_te_link() 4265 struct ospf *ospf = NULL; 4266 4267 if (argv_find(argv, argc, "vrf", &idx_vrf)) { 4268 vrf_name = argv[idx_vrf + 1]->arg; 4269 all_vrf = strmatch(vrf_name, "all"); 4270 }
CID 1527497: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
4271 argv_find(argv, argc, "INTERFACE", &idx_interface); 4272 /* vrf input is provided could be all or specific vrf*/ 4273 if (vrf_name) { 4274 if (all_vrf) { 4275 for (ALL_LIST_ELEMENTS_RO(om->ospf, node, ospf)) { 4276 if (!ospf->oi_running)
** CID 1527496: Error handling issues (CHECKED_RETURN) /zebra/zebra_pw.c: 559 in pseudowire_control_word() ________________________________________________________________________________________________________ *** CID 1527496: Error handling issues (CHECKED_RETURN) /zebra/zebra_pw.c: 559 in pseudowire_control_word() 553 int idx = 0; 554 uint8_t flags = 0; 555 556 if (argv_find(argv, argc, "no", &idx)) 557 flags = F_PSEUDOWIRE_CWORD; 558 else {
CID 1527496: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
559 argv_find(argv, argc, "control-word", &idx); 560 if (argv[idx + 1]->text[0] == 'i') 561 flags = F_PSEUDOWIRE_CWORD; 562 } 563 564 zebra_pw_change(pw, pw->ifindex, pw->type, pw->af, &pw->nexthop,
** CID 1527495: Error handling issues (CHECKED_RETURN) /lib/command.c: 2268 in banner_motd_line() ________________________________________________________________________________________________________ *** CID 1527495: Error handling issues (CHECKED_RETURN) /lib/command.c: 2268 in banner_motd_line() 2262 "Banner from an input\n" 2263 "Text\n") 2264 { 2265 int idx = 0; 2266 char *motd; 2267
CID 1527495: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
2268 argv_find(argv, argc, "LINE", &idx); 2269 motd = argv_concat(argv, argc, idx); 2270 2271 cmd_banner_motd_line(motd); 2272 XFREE(MTYPE_TMP, motd); 2273
** CID 1527494: (CHECKED_RETURN) /bgpd/bgp_filter.c: 475 in as_path() /bgpd/bgp_filter.c: 464 in as_path() ________________________________________________________________________________________________________ *** CID 1527494: (CHECKED_RETURN) /bgpd/bgp_filter.c: 475 in as_path() 469 470 /* Check the filter type. */ 471 type = argv_find(argv, argc, "deny", &idx) ? AS_FILTER_DENY 472 : AS_FILTER_PERMIT; 473 474 /* Check AS path regex. */
CID 1527494: (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
475 argv_find(argv, argc, "LINE", &idx); 476 regstr = argv_concat(argv, argc, idx); 477 478 regex = bgp_regcomp(regstr); 479 if (!regex) { 480 vty_out(vty, "can't compile regexp %s\n", regstr); /bgpd/bgp_filter.c: 464 in as_path() 458 struct as_list *aslist; 459 regex_t *regex; 460 char *regstr; 461 int64_t seqnum = ASPATH_SEQ_NUMBER_AUTO; 462 463 /* Retrieve access list name */
CID 1527494: (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
464 argv_find(argv, argc, "AS_PATH_FILTER_NAME", &idx); 465 char *alname = argv[idx]->arg; 466 467 if (argv_find(argv, argc, "(0-4294967295)", &idx)) 468 seqnum = (int64_t)atol(argv[idx]->arg); 469
** CID 1527493: Error handling issues (CHECKED_RETURN) /zebra/zebra_pw.c: 460 in no_pseudowire_if() ________________________________________________________________________________________________________ *** CID 1527493: Error handling issues (CHECKED_RETURN) /zebra/zebra_pw.c: 460 in no_pseudowire_if() 454 int idx = 0; 455 456 zvrf = vrf_info_lookup(VRF_DEFAULT); 457 if (!zvrf) 458 return CMD_WARNING; 459
CID 1527493: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
460 argv_find(argv, argc, "IFNAME", &idx); 461 ifname = argv[idx]->arg; 462 463 pw = zebra_pw_find(zvrf, ifname); 464 if (pw) { 465 if (pw->protocol != ZEBRA_ROUTE_STATIC) {
** CID 1527492: (CHECKED_RETURN) /zebra/router-id.c: 320 in ipv6_router_id() /zebra/router-id.c: 328 in ipv6_router_id() ________________________________________________________________________________________________________ *** CID 1527492: (CHECKED_RETURN) /zebra/router-id.c: 320 in ipv6_router_id() 314 { 315 int idx = 0; 316 struct prefix rid; 317 vrf_id_t vrf_id; 318 struct zebra_vrf *zvrf; 319
CID 1527492: (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
320 argv_find(argv, argc, "X:X::X:X", &idx); 321 322 if (!inet_pton(AF_INET6, argv[idx]->arg, &rid.u.prefix6)) 323 return CMD_WARNING_CONFIG_FAILED; 324 325 rid.prefixlen = IPV6_MAX_BITLEN; /zebra/router-id.c: 328 in ipv6_router_id() 322 if (!inet_pton(AF_INET6, argv[idx]->arg, &rid.u.prefix6)) 323 return CMD_WARNING_CONFIG_FAILED; 324 325 rid.prefixlen = IPV6_MAX_BITLEN; 326 rid.family = AF_INET6; 327
CID 1527492: (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
328 argv_find(argv, argc, "NAME", &idx); 329 VRF_GET_ID(vrf_id, argv[idx]->arg, false); 330 331 zvrf = vrf_info_lookup(vrf_id); 332 router_id_set(AFI_IP6, &rid, zvrf); 333
** CID 1527491: (CHECKED_RETURN) /zebra/zebra_pw.c: 496 in pseudowire_labels() /zebra/zebra_pw.c: 494 in pseudowire_labels() ________________________________________________________________________________________________________ *** CID 1527491: (CHECKED_RETURN) /zebra/zebra_pw.c: 496 in pseudowire_labels() 490 if (argv_find(argv, argc, "no", &idx)) { 491 local_label = MPLS_NO_LABEL; 492 remote_label = MPLS_NO_LABEL; 493 } else { 494 argv_find(argv, argc, "local", &idx); 495 local_label = atoi(argv[idx + 1]->arg);
CID 1527491: (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
496 argv_find(argv, argc, "remote", &idx); 497 remote_label = atoi(argv[idx + 1]->arg); 498 } 499 500 zebra_pw_change(pw, pw->ifindex, pw->type, pw->af, &pw->nexthop, 501 local_label, remote_label, pw->flags, &pw->data); /zebra/zebra_pw.c: 494 in pseudowire_labels() 488 mpls_label_t local_label, remote_label; 489 490 if (argv_find(argv, argc, "no", &idx)) { 491 local_label = MPLS_NO_LABEL; 492 remote_label = MPLS_NO_LABEL; 493 } else {
CID 1527491: (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
494 argv_find(argv, argc, "local", &idx); 495 local_label = atoi(argv[idx + 1]->arg); 496 argv_find(argv, argc, "remote", &idx); 497 remote_label = atoi(argv[idx + 1]->arg); 498 } 499
** CID 1527490: Error handling issues (CHECKED_RETURN) /ospf6d/ospf6_snmp.c: 1030 in ospfv3WwLsdbEntry() ________________________________________________________________________________________________________ *** CID 1527490: Error handling issues (CHECKED_RETURN) /ospf6d/ospf6_snmp.c: 1030 in ospfv3WwLsdbEntry() 1024 1025 /* Return the current value of the variable */ 1026 switch (v->magic & OSPFv3WWCOLUMN) { 1027 case OSPFv3WWLSDBSEQUENCE: 1028 return SNMP_INTEGER(ntohl(lsa->header->seqnum)); 1029 case OSPFv3WWLSDBAGE:
CID 1527490: Error handling issues (CHECKED_RETURN) Calling "ospf6_lsa_age_current" without checking return value (as is done elsewhere 25 out of 28 times).
1030 ospf6_lsa_age_current(lsa); 1031 return SNMP_INTEGER(ntohs(lsa->header->age)); 1032 case OSPFv3WWLSDBCHECKSUM: 1033 return SNMP_INTEGER(ntohs(lsa->header->checksum)); 1034 case OSPFv3WWLSDBADVERTISEMENT: 1035 *var_len = ntohs(lsa->header->length);
** CID 1527489: Error handling issues (CHECKED_RETURN) /ospfd/ospf_sr.c: 2547 in no_sr_prefix_sid() ________________________________________________________________________________________________________ *** CID 1527489: Error handling issues (CHECKED_RETURN) /ospfd/ospf_sr.c: 2547 in no_sr_prefix_sid() 2541 return CMD_WARNING_CONFIG_FAILED; 2542 2543 if (OspfSR.status != SR_UP) 2544 return CMD_SUCCESS; 2545 2546 /* Get network prefix */
CID 1527489: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
2547 argv_find(argv, argc, "A.B.C.D/M", &idx); 2548 rc = str2prefix(argv[idx]->arg, &p); 2549 if (!rc) { 2550 vty_out(vty, "Invalid prefix format %s\n", argv[idx]->arg); 2551 return CMD_WARNING_CONFIG_FAILED; 2552 }
** CID 1527488: (RESOURCE_LEAK) /pceplib/test/pcep_socket_comm_test.c: 280 in test_pcep_socket_comm_initialize_handlers() /pceplib/test/pcep_socket_comm_test.c: 288 in test_pcep_socket_comm_initialize_handlers() ________________________________________________________________________________________________________ *** CID 1527488: (RESOURCE_LEAK) /pceplib/test/pcep_socket_comm_test.c: 280 in test_pcep_socket_comm_initialize_handlers() 274 NULL, NULL, NULL, test_connection_except_notifier, 275 &test_host_ip, test_port, connect_timeout_millis, NULL, false, 276 NULL); 277 CU_ASSERT_PTR_NULL(test_session); 278 279 /* Both receive handlers cannot be set */
CID 1527488: (RESOURCE_LEAK) Overwriting "test_session" in "test_session = socket_comm_session_initialize(test_message_received_handler, test_message_ready_to_read_handler, test_message_sent_handler, test_connection_except_notifier, &test_host_ip, test_port, connect_timeout_millis, NULL, false, NULL)" leaks the storage that "test_session" points to.
280 test_session = socket_comm_session_initialize( 281 test_message_received_handler, 282 test_message_ready_to_read_handler, test_message_sent_handler, 283 test_connection_except_notifier, &test_host_ip, test_port, 284 connect_timeout_millis, NULL, false, NULL); 285 CU_ASSERT_PTR_NULL(test_session); /pceplib/test/pcep_socket_comm_test.c: 288 in test_pcep_socket_comm_initialize_handlers() 282 test_message_ready_to_read_handler, test_message_sent_handler, 283 test_connection_except_notifier, &test_host_ip, test_port, 284 connect_timeout_millis, NULL, false, NULL); 285 CU_ASSERT_PTR_NULL(test_session); 286 287 /* Only one receive handler can be set */
CID 1527488: (RESOURCE_LEAK) Overwriting "test_session" in "test_session = socket_comm_session_initialize(NULL, test_message_ready_to_read_handler, test_message_sent_handler, test_connection_except_notifier, &test_host_ip, test_port, connect_timeout_millis, NULL, false, NULL)" leaks the storage that "test_session" points to.
288 test_session = socket_comm_session_initialize( 289 NULL, test_message_ready_to_read_handler, 290 test_message_sent_handler, test_connection_except_notifier, 291 &test_host_ip, test_port, connect_timeout_millis, NULL, false, 292 NULL); 293 CU_ASSERT_PTR_NOT_NULL(test_session);
** CID 1527487: Memory - corruptions (ARRAY_VS_SINGLETON) ________________________________________________________________________________________________________ *** CID 1527487: Memory - corruptions (ARRAY_VS_SINGLETON) /bgpd/bgp_table.c: 229 in bgp_table_subtree_lookup() 223 224 if (node_p->prefixlen == p->prefixlen) { 225 matched = node; 226 break; 227 } 228
CID 1527487: Memory - corruptions (ARRAY_VS_SINGLETON) Passing "&p->u.prefix" to function "prefix_bit" which uses it as an array. This might corrupt or misinterpret adjacent memory locations.
229 node = bgp_dest_from_rnode(node->link[prefix_bit( 230 &p->u.prefix, node_p->prefixlen)]); 231 } 232 233 if (!matched) 234 return NULL;
** CID 1527486: Error handling issues (CHECKED_RETURN) /zebra/router-id.c: 379 in ipv6_router_id_in_vrf() ________________________________________________________________________________________________________ *** CID 1527486: Error handling issues (CHECKED_RETURN) /zebra/router-id.c: 379 in ipv6_router_id_in_vrf() 373 "IPV6 address to use for router-id\n") 374 { 375 ZEBRA_DECLVAR_CONTEXT_VRF(vrf, zvrf); 376 int idx = 0; 377 struct prefix rid; 378
CID 1527486: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
379 argv_find(argv, argc, "X:X::X:X", &idx); 380 381 if (!inet_pton(AF_INET6, argv[idx]->arg, &rid.u.prefix6)) 382 return CMD_WARNING_CONFIG_FAILED; 383 384 rid.prefixlen = IPV6_MAX_BITLEN;
** CID 1527485: Error handling issues (CHECKED_RETURN) /zebra/zebra_pw.c: 524 in pseudowire_neighbor() ________________________________________________________________________________________________________ *** CID 1527485: Error handling issues (CHECKED_RETURN) /zebra/zebra_pw.c: 524 in pseudowire_neighbor() 518 union g_addr nexthop; 519 520 af = AF_UNSPEC; 521 memset(&nexthop, 0, sizeof(nexthop)); 522 523 if (!argv_find(argv, argc, "no", &idx)) {
CID 1527485: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
524 argv_find(argv, argc, "neighbor", &idx); 525 address = argv[idx + 1]->arg; 526 527 if (inet_pton(AF_INET, address, &nexthop.ipv4) == 1) 528 af = AF_INET; 529 else if (inet_pton(AF_INET6, address, &nexthop.ipv6) == 1)
** CID 1527484: (CHECKED_RETURN) /ospfd/ospf_sr.c: 2403 in sr_prefix_sid() /ospfd/ospf_sr.c: 2396 in sr_prefix_sid() ________________________________________________________________________________________________________ *** CID 1527484: (CHECKED_RETURN) /ospfd/ospf_sr.c: 2403 in sr_prefix_sid() 2397 if (!str2prefix(argv[idx]->arg, &p)) { 2398 vty_out(vty, "Invalid prefix format %s\n", argv[idx]->arg); 2399 return CMD_WARNING_CONFIG_FAILED; 2400 } 2401 2402 /* Get & verify index value */
CID 1527484: (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
2403 argv_find(argv, argc, "(0-65535)", &idx); 2404 index = strtoul(argv[idx]->arg, NULL, 10); 2405 if (index > OspfSR.srgb.size - 1) { 2406 vty_out(vty, "Index %u must be lower than range size %u\n", 2407 index, OspfSR.srgb.size); 2408 return CMD_WARNING_CONFIG_FAILED; /ospfd/ospf_sr.c: 2396 in sr_prefix_sid() 2390 uint8_t desired_flags = 0; 2391 2392 if (!ospf_sr_enabled(vty)) 2393 return CMD_WARNING_CONFIG_FAILED; 2394 2395 /* Get network prefix */
CID 1527484: (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
2396 argv_find(argv, argc, "A.B.C.D/M", &idx); 2397 if (!str2prefix(argv[idx]->arg, &p)) { 2398 vty_out(vty, "Invalid prefix format %s\n", argv[idx]->arg); 2399 return CMD_WARNING_CONFIG_FAILED; 2400 } 2401
** CID 1527483: (CHECKED_RETURN) /zebra/router-id.c: 283 in ip_router_id() /zebra/router-id.c: 291 in ip_router_id() ________________________________________________________________________________________________________ *** CID 1527483: (CHECKED_RETURN) /zebra/router-id.c: 283 in ip_router_id() 277 { 278 int idx = 0; 279 struct prefix rid; 280 vrf_id_t vrf_id; 281 struct zebra_vrf *zvrf; 282
CID 1527483: (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
283 argv_find(argv, argc, "A.B.C.D", &idx); 284 285 if (!inet_pton(AF_INET, argv[idx]->arg, &rid.u.prefix4)) 286 return CMD_WARNING_CONFIG_FAILED; 287 288 rid.prefixlen = IPV4_MAX_BITLEN; /zebra/router-id.c: 291 in ip_router_id() 285 if (!inet_pton(AF_INET, argv[idx]->arg, &rid.u.prefix4)) 286 return CMD_WARNING_CONFIG_FAILED; 287 288 rid.prefixlen = IPV4_MAX_BITLEN; 289 rid.family = AF_INET; 290
CID 1527483: (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
291 argv_find(argv, argc, "NAME", &idx); 292 VRF_GET_ID(vrf_id, argv[idx]->arg, false); 293 294 zvrf = vrf_info_lookup(vrf_id); 295 router_id_set(AFI_IP, &rid, zvrf); 296
** CID 1527482: Error handling issues (CHECKED_RETURN) /bgpd/bgp_filter.c: 555 in no_as_path() ________________________________________________________________________________________________________ *** CID 1527482: Error handling issues (CHECKED_RETURN) /bgpd/bgp_filter.c: 555 in no_as_path() 549 else { 550 vty_out(vty, "filter type must be [permit|deny]\n"); 551 return CMD_WARNING_CONFIG_FAILED; 552 } 553 554 /* Compile AS path. */
CID 1527482: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
555 argv_find(argv, argc, "LINE", &idx); 556 regstr = argv_concat(argv, argc, idx); 557 558 if (!config_bgp_aspath_validate(regstr)) { 559 vty_out(vty, "Invalid character in as-path access-list %s\n", 560 regstr);
** CID 1527481: Error handling issues (CHECKED_RETURN) /zebra/zebra_pw.c: 428 in pseudowire_if() ________________________________________________________________________________________________________ *** CID 1527481: Error handling issues (CHECKED_RETURN) /zebra/zebra_pw.c: 428 in pseudowire_if() 422 int idx = 0; 423 424 zvrf = vrf_info_lookup(VRF_DEFAULT); 425 if (!zvrf) 426 return CMD_WARNING; 427
CID 1527481: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
428 argv_find(argv, argc, "IFNAME", &idx); 429 ifname = argv[idx]->arg; 430 431 pw = zebra_pw_find(zvrf, ifname); 432 if (pw && pw->protocol != ZEBRA_ROUTE_STATIC) { 433 vty_out(vty, "%% Pseudowire is not static\n");
** CID 1527480: Error handling issues (CHECKED_RETURN) /zebra/router-id.c: 349 in ip_router_id_in_vrf() ________________________________________________________________________________________________________ *** CID 1527480: Error handling issues (CHECKED_RETURN) /zebra/router-id.c: 349 in ip_router_id_in_vrf() 343 "IP address to use for router-id\n") 344 { 345 ZEBRA_DECLVAR_CONTEXT_VRF(vrf, zvrf); 346 int idx = 0; 347 struct prefix rid; 348
CID 1527480: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
349 argv_find(argv, argc, "A.B.C.D", &idx); 350 351 if (!inet_pton(AF_INET, argv[idx]->arg, &rid.u.prefix4)) 352 return CMD_WARNING_CONFIG_FAILED; 353 354 rid.prefixlen = IPV4_MAX_BITLEN;
** CID 1527479: Error handling issues (CHECKED_RETURN) /ospfd/ospf_sr.c: 2320 in sr_node_msd() ________________________________________________________________________________________________________ *** CID 1527479: Error handling issues (CHECKED_RETURN) /ospfd/ospf_sr.c: 2320 in sr_node_msd() 2314 int idx = 1; 2315 2316 if (!ospf_sr_enabled(vty)) 2317 return CMD_WARNING_CONFIG_FAILED; 2318 2319 /* Get MSD */
CID 1527479: Error handling issues (CHECKED_RETURN) Calling "argv_find" without checking return value (as is done elsewhere 103 out of 125 times).
2320 argv_find(argv, argc, "(1-16)", &idx); 2321 msd = strtoul(argv[idx]->arg, NULL, 10); 2322 if (msd < 1 || msd > MPLS_MAX_LABELS) { 2323 vty_out(vty, "MSD must be comprise between 1 and %u\n", 2324 MPLS_MAX_LABELS); 2325 return CMD_WARNING_CONFIG_FAILED;
________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0...
participants (1)
-
scan-admin＠coverity.com