]> git.puffer.fish Git - matthieu/frr.git/commit
isisd: Fix usage of uninited memory
authorDonald Sharp <sharpd@nvidia.com>
Tue, 27 Oct 2020 13:59:10 +0000 (09:59 -0400)
committerDonald Sharp <sharpd@nvidia.com>
Tue, 27 Oct 2020 13:59:10 +0000 (09:59 -0400)
commit033c6d28169a0f6b92300995954fe444b2910abc
tree5f6ad22c7a7a33a814e6f8bf15a701ac3fa9eeec
parent9f03e98d1570c56744c2901ca4a8c30b60aab643
isisd: Fix usage of uninited memory

valgrind is showing a usage of uninited memory:

==935465== Conditional jump or move depends on uninitialised value(s)
==935465==    at 0x159E17: tlvs_area_addresses_to_adj (isis_tlvs.c:4430)
==935465==    by 0x15A4BD: isis_tlvs_to_adj (isis_tlvs.c:4568)
==935465==    by 0x1377F0: process_p2p_hello (isis_pdu.c:203)
==935465==    by 0x1391FD: process_hello (isis_pdu.c:781)
==935465==    by 0x13BDBE: isis_handle_pdu (isis_pdu.c:1700)
==935465==    by 0x13BECD: isis_receive (isis_pdu.c:1744)
==935465==    by 0x49210FF: thread_call (thread.c:1585)
==935465==    by 0x48CFACB: frr_run (libfrr.c:1099)
==935465==    by 0x1218C9: main (isis_main.c:272)
==935465==
==935465== Conditional jump or move depends on uninitialised value(s)
==935465==    at 0x483EEC5: bcmp (vg_replace_strmem.c:1111)
==935465==    by 0x15A290: tlvs_ipv4_addresses_to_adj (isis_tlvs.c:4512)
==935465==    by 0x15A4EB: isis_tlvs_to_adj (isis_tlvs.c:4570)
==935465==    by 0x1377F0: process_p2p_hello (isis_pdu.c:203)
==935465==    by 0x1391FD: process_hello (isis_pdu.c:781)
==935465==    by 0x13BDBE: isis_handle_pdu (isis_pdu.c:1700)
==935465==    by 0x13BECD: isis_receive (isis_pdu.c:1744)
==935465==    by 0x49210FF: thread_call (thread.c:1585)
==935465==    by 0x48CFACB: frr_run (libfrr.c:1099)
==935465==    by 0x1218C9: main (isis_main.c:272)

Effectively we are reallocing memory to hold data.  realloc does not
set the new memory to anything.  So whatever happens to be in the memory
is what is there.  after the realloc happens we are iterating over the
memory just realloced and doing memcmp's to values in it causing these
use of uninitialized memory.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>
isisd/isis_tlvs.c