New Defects reported by Coverity Scan for freerangerouting/frr
scan-admin at coverity.com
scan-admin at coverity.com
Fri Apr 29 09:12:59 UTC 2022
Hi,
Please find the latest report on new defect(s) introduced to freerangerouting/frr found with Coverity Scan.
1 new defect(s) introduced to freerangerouting/frr found with Coverity Scan.
3 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.
New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)
** CID 1517499: Memory - corruptions (OVERRUN)
/bgpd/bgp_route.c: 5710 in bgp_nlri_parse_ip()
________________________________________________________________________________________________________
*** CID 1517499: Memory - corruptions (OVERRUN)
/bgpd/bgp_route.c: 5710 in bgp_nlri_parse_ip()
5704 "%s [Error] Update packet error (prefix length %d too large for prefix storage %zu)",
5705 peer->host, p.prefixlen, sizeof(p.u));
5706 return BGP_NLRI_PARSE_ERROR_PACKET_LENGTH;
5707 }
5708
5709 /* Fetch prefix from NLRI packet. */
>>> CID 1517499: Memory - corruptions (OVERRUN)
>>> Overrunning array "p.u.val" of 16 bytes by passing it to a function which accesses it at byte offset 47 using argument "psize" (which evaluates to 48).
5710 memcpy(p.u.val, pnt, psize);
5711
5712 /* Check address. */
5713 if (afi == AFI_IP && safi == SAFI_UNICAST) {
5714 if (IN_CLASSD(ntohl(p.u.prefix4.s_addr))) {
5715 /* From RFC4271 Section 6.3:
________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://u15810271.ct.sendgrid.net/ls/click?upn=HRESupC-2F2Czv4BOaCWWCy7my0P0qcxCbhZ31OYv50yrtN2DGUU98GYhjd55wXsXtw53zRK70R0agdV-2Fb7c45-2BkxBoZjryQtr5SpUD80NNfE-3DJeOt_O0IDF7c8sUs2B6kWTeWwAJZqriD5fgsfL8PAN30oQTza7T57Puvhh-2BwPa-2BoLCHViV5Qqp7F4cP5UjgyIlPzeBJcBkzSGCOA3-2FiWE5IlX0XoNo8bblg3c3xbgIungqqESThSRkUmMcSgsOjpsSzIpGPcgHyShwRAkbwtoqf4w4zniWFl0J-2F5LzqBOaVtz33Xf9vsl1D9A-2BEaM7xXPVxeWOg-3D-3D
More information about the dev
mailing list