New Defects reported by Coverity Scan for freerangerouting/frr
scan-admin at coverity.com
scan-admin at coverity.com
Fri Nov 15 07:51:23 EST 2019
Hi,
Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan.
7 new defect(s) introduced to freerangerouting/frr found with Coverity Scan.
13 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 7 of 7 defect(s)
** CID 1487863: Incorrect expression (DIVIDE_BY_ZERO)
________________________________________________________________________________________________________
*** CID 1487863: Incorrect expression (DIVIDE_BY_ZERO)
/bgpd/bgp_route.c: 12126 in bgp_damp_set()
12120 if (suppress < reuse) {
12121 vty_out(vty,
12122 "Suppress value cannot be less than reuse value \n");
12123 return 0;
12124 }
12125
>>> CID 1487863: Incorrect expression (DIVIDE_BY_ZERO)
>>> In function call "bgp_damp_enable", division by expression "reuse" which may be zero has undefined behavior.
12126 return bgp_damp_enable(bgp, bgp_node_afi(vty), bgp_node_safi(vty), half,
12127 reuse, suppress, max);
12128 }
12129
12130 DEFUN (bgp_damp_unset,
12131 bgp_damp_unset_cmd,
** CID 1487862: Incorrect expression (DIVIDE_BY_ZERO)
________________________________________________________________________________________________________
*** CID 1487862: Incorrect expression (DIVIDE_BY_ZERO)
/bgpd/bgp_damp.c: 171 in bgp_reuse_timer()
165 bgp_damp_info_free(bdi, 1, bdc->afi, bdc->safi);
166 else
167 BGP_DAMP_LIST_ADD(bdc, bdi);
168 } else
169 /* Re-insert into another list (See RFC2439 Section
170 * 4.8.6). */
>>> CID 1487862: Incorrect expression (DIVIDE_BY_ZERO)
>>> In function call "bgp_reuse_list_add", division by expression "bdc->reuse_limit" which may be zero has undefined behavior.
171 bgp_reuse_list_add(bdi, bdc);
172 }
173
174 return 0;
175 }
176
** CID 1487861: (DIVIDE_BY_ZERO)
________________________________________________________________________________________________________
*** CID 1487861: (DIVIDE_BY_ZERO)
/bgpd/bgp_route.c: 12126 in bgp_damp_set()
12120 if (suppress < reuse) {
12121 vty_out(vty,
12122 "Suppress value cannot be less than reuse value \n");
12123 return 0;
12124 }
12125
>>> CID 1487861: (DIVIDE_BY_ZERO)
>>> In function call "bgp_damp_enable", division by expression "half" which may be zero has undefined behavior.
12126 return bgp_damp_enable(bgp, bgp_node_afi(vty), bgp_node_safi(vty), half,
12127 reuse, suppress, max);
12128 }
12129
12130 DEFUN (bgp_damp_unset,
12131 bgp_damp_unset_cmd,
/bgpd/bgp_route.c: 12126 in bgp_damp_set()
12120 if (suppress < reuse) {
12121 vty_out(vty,
12122 "Suppress value cannot be less than reuse value \n");
12123 return 0;
12124 }
12125
>>> CID 1487861: (DIVIDE_BY_ZERO)
>>> In function call "bgp_damp_enable", division by expression "half" which may be zero has undefined behavior.
12126 return bgp_damp_enable(bgp, bgp_node_afi(vty), bgp_node_safi(vty), half,
12127 reuse, suppress, max);
12128 }
12129
12130 DEFUN (bgp_damp_unset,
12131 bgp_damp_unset_cmd,
** CID 1487860: Memory - corruptions (OVERRUN)
________________________________________________________________________________________________________
*** CID 1487860: Memory - corruptions (OVERRUN)
/zebra/rt_netlink.c: 2481 in netlink_request_nexthop()
2475 memset(&req, 0, sizeof(req));
2476 req.n.nlmsg_type = type;
2477 req.n.nlmsg_flags = NLM_F_ROOT | NLM_F_MATCH | NLM_F_REQUEST;
2478 req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct nhmsg));
2479 req.nhm.nh_family = family;
2480
>>> CID 1487860: Memory - corruptions (OVERRUN)
>>> Overrunning struct type nlmsghdr of 16 bytes by passing it to a function which accesses it at byte offset 23 using argument "req.n.nlmsg_len" (which evaluates to 24).
2481 return netlink_request(&zns->netlink_cmd, &req.n);
2482 }
2483
2484
2485 /**
2486 * netlink_nexthop_read() - Nexthop read function using netlink interface
** CID 1487859: Null pointer dereferences (NULL_RETURNS)
________________________________________________________________________________________________________
*** CID 1487859: Null pointer dereferences (NULL_RETURNS)
/isisd/isis_zebra.c: 97 in isis_zebra_if_address_add()
91 if (p->family == AF_INET)
92 zlog_debug("connected IP address %s", buf);
93 if (p->family == AF_INET6)
94 zlog_debug("connected IPv6 address %s", buf);
95 #endif /* EXTREME_DEBUG */
96 if (if_is_operative(c->ifp))
>>> CID 1487859: Null pointer dereferences (NULL_RETURNS)
>>> Dereferencing a pointer that might be "NULL" "circuit_scan_by_ifp(c->ifp)" when calling "isis_circuit_add_addr".
97 isis_circuit_add_addr(circuit_scan_by_ifp(c->ifp), c);
98
99 return 0;
100 }
101
102 static int isis_zebra_if_address_del(ZAPI_CALLBACK_ARGS)
** CID 1487858: Memory - illegal accesses (USE_AFTER_FREE)
/ospfd/ospf_interface.c: 908 in ospf_vl_if_delete()
________________________________________________________________________________________________________
*** CID 1487858: Memory - illegal accesses (USE_AFTER_FREE)
/ospfd/ospf_interface.c: 908 in ospf_vl_if_delete()
902
903 static void ospf_vl_if_delete(struct ospf_vl_data *vl_data)
904 {
905 vl_data->vl_oi->address->u.prefix4.s_addr = 0;
906 vl_data->vl_oi->address->prefixlen = 0;
907 ospf_if_free(vl_data->vl_oi);
>>> CID 1487858: Memory - illegal accesses (USE_AFTER_FREE)
>>> Dereferencing freed pointer "vl_data->vl_oi".
908 if_delete(&vl_data->vl_oi->ifp);
909 vlink_count--;
910 }
911
912 /* for a defined area, count the number of configured vl
913 */
** CID 20290: Control flow issues (MISSING_BREAK)
/lib/command_parse.c: 1001 in yytnamerr()
________________________________________________________________________________________________________
*** CID 20290: Control flow issues (MISSING_BREAK)
/lib/command_parse.c: 1001 in yytnamerr()
995 switch (*++yyp)
996 {
997 case '\'':
998 case ',':
999 goto do_not_strip_quotes;
1000
>>> CID 20290: Control flow issues (MISSING_BREAK)
>>> The case for value "'\\'" is not terminated by a 'break' statement.
1001 case '\\':
1002 if (*++yyp != '\\')
1003 goto do_not_strip_quotes;
1004 else
1005 goto append;
1006
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRa7dJ8klHLUFWVd2fqpS-2B-2FHaN43B-2FQ11ntcKmbKat2WeDU1AdI-2FBBrnda9ub5tlg3U-3D_d-2Fi2nRutHp-2FDWtw8JRg-2Bc1m9CS4-2B5uVbodfDyLsp-2FJn3ugF-2B8pAZyIvgWnVhd8y4bFby4DJr-2FUavUuNAFw0pEPJ25yBuFxwRz-2B-2FIiM1uqu9ZTcWIyoaKA3PQrQCjC-2BQkKfhWNFRj0we3oS4E5e37R1Qi6DJ05XXp19WCvcpLp2IDmiRv-2FcpaXlsWYxVmbPMAlFYtDoBJ2tzCvyYFDxYjsw-3D-3D
More information about the dev
mailing list