Skip to content

bgpd, isisd, ospfd: coverity fixes - #20948

Merged
riw777 merged 3 commits into
FRRouting:masterfrom
ashred-lnx:ashred/coverity-fixes-upstream
Mar 3, 2026
Merged

bgpd, isisd, ospfd: coverity fixes#20948
riw777 merged 3 commits into
FRRouting:masterfrom
ashred-lnx:ashred/coverity-fixes-upstream

Conversation

@ashred-lnx

Copy link
Copy Markdown
Contributor

ospfd/ospf_ext.c - buffer overflow
bgpd/bgp.c - ignore Coverity
isisd/isis.c - Ensure packet is at least LLC_LEN bytes to prevent underflow

Signed-off-by: Ashwini Reddy <ashred@nvidia.com>
Comment thread isisd/isis_pfpacket.c Outdated
Comment thread ospfd/ospf_ext.c
Move and consolidate the minimum frame-size validation alongside recvmsg() result handling so short frames are rejected before LLC removal.

Signed-off-by: Ashwini Reddy <ashred@nvidia.com>
Signed-off-by: Ashwini Reddy <ashred@nvidia.com>
@ashred-lnx
ashred-lnx force-pushed the ashred/coverity-fixes-upstream branch from fc877a0 to 2b84aa6 Compare March 1, 2026 20:17
@ashred-lnx
ashred-lnx marked this pull request as ready for review March 1, 2026 20:21
@greptile-apps

greptile-apps Bot commented Mar 1, 2026

Copy link
Copy Markdown

Greptile Summary

This PR addresses three Coverity static analysis warnings across the BGP, IS-IS, and OSPF subsystems.

Key changes:

  • bgpd/bgpd.c: Added coverity[leaked_storage] annotations to suppress false positive memory leak warnings. The memory is correctly managed through the clearing batch lifecycle and freed by bgp_clearing_batch_completed().
  • isisd/isis_pfpacket.c: Fixed a critical buffer underflow vulnerability by validating that bytesread >= LLC_LEN before attempting to strip the LLC header. Previously, if bytesread < LLC_LEN, the code would perform stream_write(..., bytesread - LLC_LEN) which could result in a large negative value (integer underflow) and potential buffer overflow.
  • ospfd/ospf_ext.c: Corrected three instances where TLV_DATA(&exti->prefix.header) and TLV_DATA(&exti->link.header) were changed to TLV_DATA(&exti->prefix) and TLV_DATA(&exti->link). While functionally equivalent (since header is the first struct field), passing the full struct address is clearer for static analysis tools and prevents false buffer overflow warnings.

Confidence Score: 5/5

  • This PR is safe to merge with no concerns
  • All changes are focused Coverity static analysis fixes with no functional behavior changes (except fixing an actual security vulnerability). The IS-IS fix addresses a real buffer underflow issue, while the BGP and OSPF changes improve code clarity for static analysis without altering runtime behavior.
  • No files require special attention

Important Files Changed

Filename Overview
bgpd/bgpd.c Added Coverity annotations to suppress false positive memory leak warnings for clearing batch management
isisd/isis_pfpacket.c Fixed potential buffer underflow by validating packet size before LLC header removal
ospfd/ospf_ext.c Corrected TLV_DATA macro usage to pass full struct address instead of nested header field, preventing static analysis false positives

Last reviewed commit: 2b84aa6

@riw777 riw777 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good

@riw777
riw777 merged commit f27b2f1 into FRRouting:master Mar 3, 2026
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants