isisd: address Coverity warnings

this fixes a bunch of issues found by Coverity SCAN and flagged as
"high" impact -- although, they're all rather minute issues.

* isisd/isis_adjacency.c: one superfluous check, one possible NULL deref
* isisd/isis_circuit.c: two prefix memory leaks
* isisd/isis_csm.c: one missing break
* isisd/isis_lsp.c: one possible NULL deref
* isisd/isis_pfpacket.c: one error-case fd leak
* isisd/isis_route.c: one isis_route_info memory leak
* isisd/isis_routemap.c: one... fnord
* isisd/isis_tlv.c: one infinite loop

Reported-by: Coverity SCAN
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>

diff --git a/isisd/isis_adjacency.c b/isisd/isis_adjacency.c
index 468b0a69c6a272a56cb98e94b405871b293bb7e9..414885fc4dec265d7d8e9bb7254913e2e2c5b090 100644 (file)
--- a/isisd/isis_adjacency.c
+++ b/isisd/isis_adjacency.c
@@ -207,7 +207,7 @@ isis_adj_state_change (struct isis_adjacency *adj, enum isis_adj_state new_state
 
       zlog_info ("%%ADJCHANGE: Adjacency to %s (%s) changed from %s to %s, %s",
                 adj_name,
-                adj->circuit ? adj->circuit->interface->name : "no circuit",
+                adj->circuit->interface->name,
                 adj_state2string (old_state),
                 adj_state2string (new_state),
                 reason ? reason : "unspecified");
@@ -427,7 +427,7 @@ isis_adj_print_vty (struct isis_adjacency *adj, struct vty *vty, char detail)
       vty_out (vty, ", Speaks: %s", nlpid2string (&adj->nlpids));
       vty_out (vty, "%s", VTY_NEWLINE);
       vty_out (vty, "    SNPA: %s", snpa_print (adj->snpa));
-      if (adj->circuit->circ_type == CIRCUIT_T_BROADCAST)
+      if (adj->circuit && (adj->circuit->circ_type == CIRCUIT_T_BROADCAST))
       {
         dyn = dynhn_find_by_id (adj->lanid);
         if (dyn)

diff --git a/isisd/isis_circuit.c b/isisd/isis_circuit.c
index c09c3a2826c0a0ed23d45f5a9f853356342db4f8..3d9fb47390b9334e67e34ceb0ddf1f18f830824f 100644 (file)
--- a/isisd/isis_circuit.c
+++ b/isisd/isis_circuit.c
@@ -327,6 +327,8 @@ isis_circuit_del_addr (struct isis_circuit *circuit,
          zlog_warn ("Nonexitant ip address %s removal attempt from \
                       circuit %d", buf, circuit->circuit_id);
        }
+
+      prefix_ipv4_free (ipv4);
     }
 #ifdef HAVE_IPV6
   if (connected->address->family == AF_INET6)
@@ -370,6 +372,8 @@ isis_circuit_del_addr (struct isis_circuit *circuit,
        }
       else if (circuit->area)
          lsp_regenerate_schedule (circuit->area, circuit->is_type, 0);
+
+      prefix_ipv6_free (ipv6);
     }
 #endif /* HAVE_IPV6 */
   return;

diff --git a/isisd/isis_csm.c b/isisd/isis_csm.c
index 5d74a71be967f61060c84e6633b316c0cca6196b..a58ba49072354a886643ed57ff153dfcd15d0f06 100644 (file)
--- a/isisd/isis_csm.c
+++ b/isisd/isis_csm.c
@@ -101,6 +101,7 @@ isis_csm_state_change (int event, struct isis_circuit *circuit, void *arg)
          break;
        case ISIS_DISABLE:
          zlog_warn ("circuit already disabled");
+         break;
        case IF_DOWN_FROM_Z:
          zlog_warn ("circuit already disconnected");
          break;

diff --git a/isisd/isis_lsp.c b/isisd/isis_lsp.c
index 082e9dcd1c6a536316bf0e19e4e8c7bf84f53b59..f2a7923d577ef0b65139def54a7613c95251d9e5 100644 (file)
--- a/isisd/isis_lsp.c
+++ b/isisd/isis_lsp.c
@@ -1631,7 +1631,7 @@ lsp_generate (struct isis_area *area, int level)
 static int
 lsp_regenerate (struct isis_area *area, int level)
 {
-  dict_t *lspdb = area->lspdb[level - 1];
+  dict_t *lspdb;
   struct isis_lsp *lsp, *frag;
   struct listnode *node;
   u_char lspid[ISIS_SYS_ID_LEN + 2];
@@ -1640,6 +1640,8 @@ lsp_regenerate (struct isis_area *area, int level)
   if ((area == NULL) || (area->is_type & level) != level)
     return ISIS_ERROR;
 
+  lspdb = area->lspdb[level - 1];
+
   memset (lspid, 0, ISIS_SYS_ID_LEN + 2);
   memcpy (lspid, isis->sysid, ISIS_SYS_ID_LEN);
 

diff --git a/isisd/isis_pfpacket.c b/isisd/isis_pfpacket.c
index e5589aea40bfa18bf15fbbc8ac43b3e21d7d96c9..4bc8717a9b2d93728a2ca22fe341adb06ed964c4 100644 (file)
--- a/isisd/isis_pfpacket.c
+++ b/isisd/isis_pfpacket.c
@@ -129,6 +129,7 @@ open_packet_socket (struct isis_circuit *circuit)
            sizeof (struct sockaddr_ll)) < 0)
     {
       zlog_warn ("open_packet_socket(): bind() failed: %s", safe_strerror (errno));
+      close (fd);
       return ISIS_WARNING;
     }
 

diff --git a/isisd/isis_route.c b/isisd/isis_route.c
index c99d95831e5e16c1221474d320138baf4149ade1..8ab470cefcd70e8f971dc2c9ed273cdf83ee887a 100644 (file)
--- a/isisd/isis_route.c
+++ b/isisd/isis_route.c
@@ -438,7 +438,11 @@ isis_route_create (struct prefix *prefix, u_int32_t cost, u_int32_t depth,
     route_node = route_node_get (area->route_table6[level - 1], prefix);
 #endif /* HAVE_IPV6 */
   else
-    return NULL;
+    {
+      isis_route_info_delete (rinfo_new);
+      return NULL;
+    }
+
   rinfo_old = route_node->info;
   if (!rinfo_old)
     {

diff --git a/isisd/isis_routemap.c b/isisd/isis_routemap.c
index 558d3910231f03230d64feb0a6e80e20eab42848..84a14ac573e5f89bf7b483562709e0ae0e1d2364 100644 (file)
--- a/isisd/isis_routemap.c
+++ b/isisd/isis_routemap.c
@@ -69,8 +69,7 @@ isis_route_map_upd (const char *name)
   for (i = 0; i <= ZEBRA_ROUTE_MAX; i++)
     {
       if (isis->rmap[i].name)
-       isis->rmap[i].map = isis->rmap[i].map =
-         route_map_lookup_by_name (isis->rmap[i].name);
+       isis->rmap[i].map = route_map_lookup_by_name (isis->rmap[i].name);
       else
        isis->rmap[i].map = NULL;
     }

diff --git a/isisd/isis_spf.c b/isisd/isis_spf.c
index 1cb51138119cd9527dad7ff7ab23b4e3a2a2fb28..e0a8d01cca9c00f4255d16a0923e19da7775b160 100644 (file)
--- a/isisd/isis_spf.c
+++ b/isisd/isis_spf.c
@@ -1492,7 +1492,7 @@ isis_print_paths (struct vty *vty, struct list *paths, u_char *root_sysid)
   struct listnode *anode;
   struct isis_vertex *vertex;
   struct isis_adjacency *adj;
-  u_char buff[255];
+  u_char buff[BUFSIZ];
 
   vty_out (vty, "Vertex               Type         Metric "
                 "Next-Hop             Interface Parent%s", VTY_NEWLINE);

diff --git a/isisd/isis_tlv.c b/isisd/isis_tlv.c
index ed3e0e81c33e30e55aea49db96a3139507ae5f35..2c2415ae022d3bfc108f3c368be3e426c6bf0fae 100644 (file)
--- a/isisd/isis_tlv.c
+++ b/isisd/isis_tlv.c
@@ -712,6 +712,7 @@ parse_tlvs (char *areatag, u_char * stream, int size, u_int32_t * expected,
             Neighbor Extended Local Circuit ID (four octets, if Neighbor
               System ID is present) */
                  pnt += length;
+                 value_len += length;
                }
            }
          else