[frr] New Defects reported by Coverity Scan for freerangerouting/frr
Hi, Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan. 45 new defect(s) introduced to freerangerouting/frr found with Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 20 of 45 defect(s) ** CID 1422699: Memory - illegal accesses (USE_AFTER_FREE) /ldpd/ldpd.c: 419 in ldpd_shutdown() ________________________________________________________________________________________________________ *** CID 1422699: Memory - illegal accesses (USE_AFTER_FREE) /ldpd/ldpd.c: 419 in ldpd_shutdown() 413 msgbuf_clear(&iev_ldpe->ibuf.w); 414 close(iev_ldpe->ibuf.fd); 415 msgbuf_clear(&iev_lde->ibuf.w); 416 close(iev_lde->ibuf.fd); 417 418 config_clear(ldpd_conf);
CID 1422699: Memory - illegal accesses (USE_AFTER_FREE) Dereferencing freed pointer "ldpd_conf".
419 QOBJ_UNREG(ldpd_conf); 420 421 log_debug("waiting for children to terminate"); 422 do { 423 pid = wait(&status); 424 if (pid == -1) {
** CID 1422698: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422698: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 3978 in set_lcommunity_delete() 3972 char *str; 3973 3974 str = XCALLOC (MTYPE_TMP, strlen (argv[2]->arg) + strlen (" delete") + 1); 3975 strcpy (str, argv[2]->arg); 3976 strcpy (str + strlen (argv[2]->arg), " delete"); 3977
CID 1422698: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
3978 generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 3979 "large-comm-list", str); 3980 3981 XFREE (MTYPE_TMP, str); 3982 return CMD_SUCCESS; 3983 }
** CID 1422697: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422697: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 3934 in set_lcommunity_none() 3928 set_lcommunity_none_cmd, 3929 "set large-community none", 3930 SET_STR 3931 "BGP large community attribute\n" 3932 "No large community attribute\n") 3933 {
CID 1422697: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
3934 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 3935 "large-community", "none"); 3936 } 3937 3938 DEFUN (no_set_lcommunity, 3939 no_set_lcommunity_cmd,
** CID 1422696: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422696: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 3671 in set_aspath_prepend_asn() 3665 { 3666 int idx_asn = 3; 3667 int ret; 3668 char *str; 3669 3670 str = argv_concat (argv, argc, idx_asn);
CID 1422696: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
3671 ret = generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 3672 "as-path prepend", str); 3673 XFREE (MTYPE_TMP, str); 3674 3675 return ret; 3676 }
** CID 1422695: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422695: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 3889 in set_community_delete() 3883 char *str; 3884 3885 str = XCALLOC (MTYPE_TMP, strlen (argv[idx_comm_list]->arg) + strlen (" delete") + 1); 3886 strcpy (str, argv[idx_comm_list]->arg); 3887 strcpy (str + strlen (argv[idx_comm_list]->arg), " delete"); 3888
CID 1422695: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
3889 generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), "comm-list", str); 3890 3891 XFREE (MTYPE_TMP, str); 3892 return CMD_SUCCESS; 3893 } 3894
** CID 1422694: (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422694: (NULL_RETURNS) /bgpd/bgp_routemap.c: 4443 in no_set_ipx_vpn_nexthop() 4437 arg = NULL; 4438 else 4439 arg = argv[idx_ip]->arg; 4440 if (argv_find_and_parse_afi (argv, argc, &idx, &afi)) 4441 { 4442 if (afi == AFI_IP)
CID 1422694: (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_delete".
4443 return generic_set_delete (vty, VTY_GET_CONTEXT(route_map_index), 4444 "ip vpn next-hop", arg); 4445 else 4446 return generic_set_delete (vty, VTY_GET_CONTEXT(route_map_index), 4447 "ipv6 vpn next-hop", argv[idx_ip]->arg); 4448 } /bgpd/bgp_routemap.c: 4446 in no_set_ipx_vpn_nexthop() 4440 if (argv_find_and_parse_afi (argv, argc, &idx, &afi)) 4441 { 4442 if (afi == AFI_IP) 4443 return generic_set_delete (vty, VTY_GET_CONTEXT(route_map_index), 4444 "ip vpn next-hop", arg); 4445 else
CID 1422694: (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_delete".
4446 return generic_set_delete (vty, VTY_GET_CONTEXT(route_map_index), 4447 "ipv6 vpn next-hop", argv[idx_ip]->arg); 4448 } 4449 return CMD_SUCCESS; 4450 } 4451
** CID 1422693: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422693: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 4047 in set_ecommunity_soo() 4041 { 4042 int idx_asn_nn = 3; 4043 int ret; 4044 char *str; 4045 4046 str = argv_concat (argv, argc, idx_asn_nn);
CID 1422693: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
4047 ret = generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 4048 "extcommunity soo", str); 4049 XFREE (MTYPE_TMP, str); 4050 return ret; 4051 } 4052
** CID 1422692: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422692: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 4013 in set_ecommunity_rt() 4007 { 4008 int idx_asn_nn = 3; 4009 int ret; 4010 char *str; 4011 4012 str = argv_concat (argv, argc, idx_asn_nn);
CID 1422692: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
4013 ret = generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 4014 "extcommunity rt", str); 4015 XFREE (MTYPE_TMP, str); 4016 4017 return ret; 4018 }
** CID 1422691: (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422691: (NULL_RETURNS) /bgpd/bgp_routemap.c: 3834 in set_community() 3828 3829 if (additive) 3830 { 3831 argstr = XCALLOC (MTYPE_TMP, strlen (str) + strlen (" additive") + 1); 3832 strcpy (argstr, str); 3833 strcpy (argstr + strlen (str), " additive");
CID 1422691: (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
3834 ret = generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 3835 "community", argstr); 3836 XFREE (MTYPE_TMP, argstr); 3837 } 3838 else 3839 ret = generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), /bgpd/bgp_routemap.c: 3839 in set_community() 3833 strcpy (argstr + strlen (str), " additive"); 3834 ret = generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 3835 "community", argstr); 3836 XFREE (MTYPE_TMP, argstr); 3837 } 3838 else
CID 1422691: (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
3839 ret = generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 3840 "community", str); 3841 3842 community_free (com); 3843 3844 return ret;
** CID 1422690: (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422690: (NULL_RETURNS) /bgpd/bgp_routemap.c: 4079 in set_origin() 4073 "remote EGP\n" 4074 "local IGP\n" 4075 "unknown heritage\n") 4076 { 4077 int idx_origin = 2; 4078 if (strncmp (argv[idx_origin]->arg, "igp", 2) == 0)
CID 1422690: (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
4079 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), "origin", 4080 "igp"); 4081 if (strncmp (argv[idx_origin]->arg, "egp", 1) == 0) 4082 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), "origin", 4083 "egp"); 4084 if (strncmp (argv[idx_origin]->arg, "incomplete", 2) == 0) /bgpd/bgp_routemap.c: 4082 in set_origin() 4076 { 4077 int idx_origin = 2; 4078 if (strncmp (argv[idx_origin]->arg, "igp", 2) == 0) 4079 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), "origin", 4080 "igp"); 4081 if (strncmp (argv[idx_origin]->arg, "egp", 1) == 0)
CID 1422690: (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
4082 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), "origin", 4083 "egp"); 4084 if (strncmp (argv[idx_origin]->arg, "incomplete", 2) == 0) 4085 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), "origin", 4086 "incomplete"); 4087 /bgpd/bgp_routemap.c: 4085 in set_origin() 4079 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), "origin", 4080 "igp"); 4081 if (strncmp (argv[idx_origin]->arg, "egp", 1) == 0) 4082 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), "origin", 4083 "egp"); 4084 if (strncmp (argv[idx_origin]->arg, "incomplete", 2) == 0)
CID 1422690: (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
4085 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), "origin", 4086 "incomplete"); 4087 4088 return CMD_WARNING; 4089 } 4090
** CID 1422689: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422689: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 4310 in set_ipv6_nexthop_global() 4304 IN6_IS_ADDR_LINKLOCAL(&addr)) 4305 { 4306 vty_out (vty, "%% Invalid global nexthop address%s", VTY_NEWLINE); 4307 return CMD_WARNING; 4308 } 4309
CID 1422689: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
4310 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 4311 "ipv6 next-hop global", argv[idx_ipv6]->arg); 4312 } 4313 4314 4315 DEFUN (no_set_ipv6_nexthop_global,
** CID 1422688: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422688: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 3606 in set_local_pref() 3600 "set local-preference (0-4294967295)", 3601 SET_STR 3602 "BGP local preference path attribute\n" 3603 "Preference value\n") 3604 { 3605 int idx_number = 2;
CID 1422688: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
3606 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 3607 "local-preference", argv[idx_number]->arg); 3608 } 3609 3610 3611 DEFUN (no_set_local_pref,
** CID 1422687: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422687: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 4240 in set_ipv6_nexthop_peer() 4234 "set ipv6 next-hop peer-address", 4235 SET_STR 4236 IPV6_STR 4237 "Next hop address\n" 4238 "Use peer address (for BGP only)\n") 4239 {
CID 1422687: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
4240 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 4241 "ipv6 next-hop peer-address", NULL); 4242 } 4243 4244 DEFUN (no_set_ipv6_nexthop_peer, 4245 no_set_ipv6_nexthop_peer_cmd,
** CID 1422686: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422686: Null pointer dereferences (NULL_RETURNS) /ospfd/ospf_routemap.c: 623 in set_metric_type() 617 SET_STR 618 "Type of metric for destination routing protocol\n" 619 "OSPF[6] external type 1 metric\n" 620 "OSPF[6] external type 2 metric\n") 621 { 622 char *ext = argv[2]->text;
CID 1422686: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
623 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 624 "metric-type", ext); 625 } 626 627 DEFUN (no_set_metric_type, 628 no_set_metric_type_cmd,
** CID 1422685: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422685: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 3636 in set_weight() 3630 "set weight (0-4294967295)", 3631 SET_STR 3632 "BGP weight for routing table\n" 3633 "Weight value\n") 3634 { 3635 int idx_number = 2;
CID 1422685: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
3636 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), "weight", 3637 argv[idx_number]->arg); 3638 } 3639 3640 3641 DEFUN (no_set_weight,
** CID 1422684: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422684: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 4155 in set_aggregator_as() 4149 4150 argstr = XMALLOC (MTYPE_ROUTE_MAP_COMPILED, 4151 strlen (argv[idx_number]->arg) + strlen (argv[idx_ipv4]->arg) + 2); 4152 4153 sprintf (argstr, "%s %s", argv[idx_number]->arg, argv[idx_ipv4]->arg); 4154
CID 1422684: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
4155 ret = generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 4156 "aggregator as", argstr); 4157 4158 XFREE (MTYPE_ROUTE_MAP_COMPILED, argstr); 4159 4160 return ret;
** CID 1422683: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422683: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 4113 in set_atomic_aggregate() 4107 DEFUN (set_atomic_aggregate, 4108 set_atomic_aggregate_cmd, 4109 "set atomic-aggregate", 4110 SET_STR 4111 "BGP atomic aggregate attribute\n" ) 4112 {
CID 1422683: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
4113 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 4114 "atomic-aggregate", NULL); 4115 } 4116 4117 DEFUN (no_set_atomic_aggregate, 4118 no_set_atomic_aggregate_cmd,
** CID 1422682: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422682: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 3581 in set_ip_nexthop_peer() 3575 "set ip next-hop peer-address", 3576 SET_STR 3577 IP_STR 3578 "Next hop address\n" 3579 "Use peer address (for BGP only)\n") 3580 {
CID 1422682: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
3581 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 3582 "ip next-hop", "peer-address"); 3583 } 3584 3585 DEFUN (set_ip_nexthop_unchanged, 3586 set_ip_nexthop_unchanged_cmd,
** CID 1422681: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422681: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 3724 in set_aspath_exclude() 3718 { 3719 int idx_asn = 3; 3720 int ret; 3721 char *str; 3722 3723 str = argv_concat (argv, argc, idx_asn);
CID 1422681: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
3724 ret = generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), 3725 "as-path exclude", str); 3726 XFREE (MTYPE_TMP, str); 3727 return ret; 3728 } 3729
** CID 1422680: Null pointer dereferences (NULL_RETURNS) ________________________________________________________________________________________________________ *** CID 1422680: Null pointer dereferences (NULL_RETURNS) /bgpd/bgp_routemap.c: 3854 in set_community_none() 3848 set_community_none_cmd, 3849 "set community none", 3850 SET_STR 3851 "BGP community attribute\n" 3852 "No community attribute\n") 3853 {
CID 1422680: Null pointer dereferences (NULL_RETURNS) Dereferencing a pointer that might be null "(struct route_map_index *)qobj_get_typed(vty->qobj_index, &qobj_t_route_map_index)" when calling "generic_set_add".
3854 return generic_set_add (vty, VTY_GET_CONTEXT(route_map_index), "community", 3855 "none"); 3856 } 3857 3858 DEFUN (no_set_community, 3859 no_set_community_cmd,
________________________________________________________________________________________________________ To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05... To manage Coverity Scan email notifications for "frr@lists.nox.tf", click https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05...
participants (1)
-
scan-admin＠coverity.com