Merge pull request #2397 from pacovn/Coverity_1469896_Dereference_after_null_check

vtysh: null dereference (Coverity 1469896)

diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c
index f84deede0d81aed5cbc442bb1da36c37f16e8402..d3c03cb72213cd6cdb527ebe01f4d81b70bc3b12 100644 (file)
--- a/bgpd/bgp_route.c
+++ b/bgpd/bgp_route.c
@@ -6962,22 +6962,22 @@ void route_vty_out_tag(struct vty *vty, struct prefix *p,
                                                inet_ntop(
                                                        AF_INET6,
                                                        &attr->mp_nexthop_global,
-                                                       buf_a, BUFSIZ));
+                                                       buf_a, sizeof(buf_a)));
                                else
                                        vty_out(vty, "%s",
                                                inet_ntop(
                                                        AF_INET6,
                                                        &attr->mp_nexthop_global,
-                                                       buf_a, BUFSIZ));
+                                                       buf_a, sizeof(buf_a)));
                        } else if (attr->mp_nexthop_len
                                   == BGP_ATTR_NHLEN_IPV6_GLOBAL_AND_LL) {
                                if (json) {
                                        inet_ntop(AF_INET6,
                                                  &attr->mp_nexthop_global,
-                                                 buf_a, BUFSIZ);
+                                                 buf_a, sizeof(buf_a));
                                        inet_ntop(AF_INET6,
                                                  &attr->mp_nexthop_local,
-                                                 buf_b, BUFSIZ);
+                                                 buf_b, sizeof(buf_b));
                                        sprintf(buf_c, "%s(%s)", buf_a, buf_b);
                                        json_object_string_add(
                                                json_out,
@@ -6987,11 +6987,11 @@ void route_vty_out_tag(struct vty *vty, struct prefix *p,
                                                inet_ntop(
                                                        AF_INET6,
                                                        &attr->mp_nexthop_global,
-                                                       buf_a, BUFSIZ),
+                                                       buf_a, sizeof(buf_a)),
                                                inet_ntop(
                                                        AF_INET6,
                                                        &attr->mp_nexthop_local,
-                                                       buf_b, BUFSIZ));
+                                                       buf_b, sizeof(buf_b)));
                        }
                }
        }

diff --git a/lib/thread.c b/lib/thread.c
index f9ff16b7b3cd560b89642e944554f1e7ec88c441..18e1c922804cf43faad3302a2860582835ab79e2 100644 (file)
--- a/lib/thread.c
+++ b/lib/thread.c
@@ -60,7 +60,7 @@ static struct list *masters;
 /* CLI start ---------------------------------------------------------------- */
 static unsigned int cpu_record_hash_key(struct cpu_thread_history *a)
 {
-       int size = sizeof(&a->func);
+       int size = sizeof(a->func);
 
        return jhash(&a->func, size, 0);
 }

diff --git a/lib/vty.c b/lib/vty.c
index 2d8112727ab9c56d71b6db4f9cfc6b45fd0551b8..280b2ace51a64bd64c5df459b5291854bc2ab554 100644 (file)
--- a/lib/vty.c
+++ b/lib/vty.c
@@ -120,9 +120,11 @@ bool vty_set_include(struct vty *vty, const char *regexp)
        bool ret = true;
        char errbuf[256];
 
-       if (!regexp && vty->filter) {
-               regfree(&vty->include);
-               vty->filter = false;
+       if (!regexp) {
+               if (vty->filter) {
+                       regfree(&vty->include);
+                       vty->filter = false;
+               }
                return true;
        }
 

diff --git a/ospf6d/ospf6_flood.c b/ospf6d/ospf6_flood.c
index 6040c53dce191a9c03e5fd134afe640db738eaab..2059d8486829c099daf136c1b853df2d8e418fc0 100644 (file)
--- a/ospf6d/ospf6_flood.c
+++ b/ospf6d/ospf6_flood.c
@@ -349,8 +349,9 @@ void ospf6_flood_interface(struct ospf6_neighbor *from, struct ospf6_lsa *lsa,
                                                ospf6_lsa_unlock(req);
                                                on->last_ls_req = NULL;
                                        }
-                                       ospf6_lsdb_remove(req,
-                                                         on->request_list);
+                                       if (req)
+                                               ospf6_lsdb_remove(req,
+                                                       on->request_list);
                                        ospf6_check_nbr_loading(on);
                                        /* fall through */
                                }

diff --git a/pimd/pim_nht.c b/pimd/pim_nht.c
index 3cbd11a9ae2a44be70fc1cc5f285e89ed0976bdb..fa6486a83e76312b406e2f9626809d85aa4044b8 100644 (file)
--- a/pimd/pim_nht.c
+++ b/pimd/pim_nht.c
@@ -667,7 +667,7 @@ int pim_parse_nexthop_update(int command, struct zclient *zclient,
                                 * RPF address from nexthop cache (i.e.
                                 * destination) as PIM nexthop.
                                 */
-                               nexthop->type = NEXTHOP_TYPE_IPV4;
+                               nexthop->type = NEXTHOP_TYPE_IPV4_IFINDEX;
                                nexthop->gate.ipv4 =
                                        pnc->rpf.rpf_addr.u.prefix4;
                                break;

diff --git a/pimd/pim_zlookup.c b/pimd/pim_zlookup.c
index 9295b231cb0236ac97cc7428f1d20c32b150d8d2..fb616e1b0dda8ea586c9993c3834516471a06c9a 100644 (file)
--- a/pimd/pim_zlookup.c
+++ b/pimd/pim_zlookup.c
@@ -215,6 +215,8 @@ static int zclient_read_nexthop(struct pim_instance *pim,
                                tab_size, addr_str, pim->vrf->name);
                        return num_ifindex;
                }
+               nexthop_tab[num_ifindex].protocol_distance = distance;
+               nexthop_tab[num_ifindex].route_metric = metric;
                switch (nexthop_type) {
                case NEXTHOP_TYPE_IFINDEX:
                        nexthop_tab[num_ifindex].ifindex = stream_getl(s);
@@ -276,13 +278,19 @@ static int zclient_read_nexthop(struct pim_instance *pim,
                        }
                        ++num_ifindex;
                        break;
-               case NEXTHOP_TYPE_IPV6:
-               case NEXTHOP_TYPE_BLACKHOLE:
-                       /* ignore */
-                       continue;
+               default:
+                       /* do nothing */
+                       {
+                               char addr_str[INET_ADDRSTRLEN];
+                               pim_inet4_dump("<addr?>", addr, addr_str,
+                                              sizeof(addr_str));
+                               zlog_warn(
+                                       "%s: found non-ifindex nexthop type=%d for address %s(%s)",
+                                       __PRETTY_FUNCTION__, nexthop_type,
+                                       addr_str, pim->vrf->name);
+                       }
+                       break;
                }
-               nexthop_tab[num_ifindex].protocol_distance = distance;
-               nexthop_tab[num_ifindex].route_metric = metric;
        }
 
        return num_ifindex;

diff --git a/zebra/zebra_vty.c b/zebra/zebra_vty.c
index eb11941a3a5f5843aa394f0dcfcf350ac2473d78..9ce8c74220042cb35164079d032c7a50dd8d3945 100644 (file)
--- a/zebra/zebra_vty.c
+++ b/zebra/zebra_vty.c
@@ -260,18 +260,22 @@ static int zebra_static_route_holdem(
                        return CMD_SUCCESS;
                }
 
-               XFREE(MTYPE_STATIC_ROUTE, shr->nhvrf_name);
-               XFREE(MTYPE_STATIC_ROUTE, shr->vrf_name);
-               XFREE(MTYPE_STATIC_ROUTE, shr);
                /*
                 * If a person enters the same line again
                 * we need to silently accept it
                 */
-               return CMD_SUCCESS;
+               goto shr_cleanup;
        }
 
-       if (!negate)
+       if (!negate) {
                listnode_add_sort(static_list, shr);
+               return CMD_SUCCESS;
+       }
+
+shr_cleanup:
+       XFREE(MTYPE_STATIC_ROUTE, shr->nhvrf_name);
+       XFREE(MTYPE_STATIC_ROUTE, shr->vrf_name);
+       XFREE(MTYPE_STATIC_ROUTE, shr);
 
        return CMD_SUCCESS;
 }

diff --git a/zebra/zebra_vxlan.c b/zebra/zebra_vxlan.c
index 98fa7ccf677a46d0e325cf075271d408ec6eb094..59f0cf52f0a1b46664f472442b23090663d568c3 100644 (file)
--- a/zebra/zebra_vxlan.c
+++ b/zebra/zebra_vxlan.c
@@ -1864,7 +1864,7 @@ static int zvni_gw_macip_del(struct interface *ifp, zebra_vni_t *zvni,
                zlog_debug(
                        "%u:SVI %s(%u) VNI %u, sending GW MAC %s IP %s del to BGP",
                        ifp->vrf_id, ifp->name, ifp->ifindex, zvni->vni,
-                       prefix_mac2str(&(n->emac), NULL, ETHER_ADDR_STRLEN),
+                       prefix_mac2str(&(n->emac), buf1, sizeof(buf1)),
                        ipaddr2str(ip, buf2, sizeof(buf2)));
 
        /* Remove neighbor from BGP. */