ospfd: Correct Coverity defects

When browsing or parsing OSPF LSA TLVs, we need to use the LSA length which is
part of the LSA header. This length, encoded in 16 bits, must be first
converted to host byte order with ntohs() function. However, Coverity Scan
considers that ntohs() function return TAINTED data. Thus, when the length is
used to control for() loop, Coverity Scan marks this part of the code as defect
with "Untrusted Loop Bound" due to the usage of Tainted variable. Similar
problems occur when browsing sub-TLV where length is extracted with ntohs().

To overcome this limitation, a size attribute has been added to the ospf_lsa
structure. The size is set when lsa->data buffer is allocated. In addition,
when an OSPF packet is received, the size of the payload is controlled before
contains is processed. For OSPF LSA, this allow a secure buffer allocation.
Thus, new size attribute contains the exact buffer allocation allowing a
strict control during TLV browsing.

This patch adds extra control to bound for() loop during TLV browsing to
avoid potential problem as suggested by Coverity Scan. Controls are based
on new size attribute of the ospf_lsa structure to avoid any ambiguity.

Signed-off-by: Olivier Dugeon <olivier.dugeon@orange.com>

1 files changed, 11 insertions, 8 deletions

diff --git a/ospfd/ospf_ri.h b/ospfd/ospf_ri.h
index 4729677bca..bbad896280 100644
--- a/ospfd/ospf_ri.h
+++ b/ospfd/ospf_ri.h
@@ -75,7 +75,7 @@
 
 /* RFC4970: Router Information Capabilities TLV */ /* Mandatory */
 #define RI_TLV_CAPABILITIES		1
-
+#define RI_TLV_CAPABILITIES_SIZE	4
 struct ri_tlv_router_cap {
 	struct tlv_header header; /* Value length is 4 bytes. */
 	uint32_t value;
@@ -105,12 +105,12 @@ struct ri_tlv_pce {
 struct ri_pce_subtlv_address {
 	/* Type = 1; Length is 8 (IPv4) or 20 (IPv6) bytes. */
 	struct tlv_header header;
-#define	PCE_ADDRESS_LENGTH_IPV4		8
-#define	PCE_ADDRESS_LENGTH_IPV6		20
+#define	PCE_ADDRESS_IPV4_SIZE		8
+#define	PCE_ADDRESS_IPV6_SIZE		20
 	struct {
 		uint16_t type; /* Address type: 1 = IPv4, 2 = IPv6 */
-#define	PCE_ADDRESS_TYPE_IPV4		1
-#define	PCE_ADDRESS_TYPE_IPV6		2
+#define	PCE_ADDRESS_IPV4		1
+#define	PCE_ADDRESS_IPV6		2
 		uint16_t reserved;
 		struct in_addr value; /* PCE address */
 	} address;
@@ -118,6 +118,7 @@ struct ri_pce_subtlv_address {
 
 /* PCE Path-Scope Sub-TLV */ /* Mandatory */
 #define	RI_PCE_SUBTLV_PATH_SCOPE	2
+#define	RI_PCE_SUBTLV_PATH_SCOPE_SIZE	4
 struct ri_pce_subtlv_path_scope {
 	struct tlv_header header; /* Type = 2; Length = 4 bytes. */
 	/*
@@ -128,11 +129,11 @@ struct ri_pce_subtlv_path_scope {
 };
 
 /* PCE Domain Sub-TLV */ /* Optional */
-#define	RI_PCE_SUBTLV_DOMAIN		3
-
 #define	PCE_DOMAIN_TYPE_AREA		1
-#define	PCE_DOMAIN_TYPE_AS			2
+#define	PCE_DOMAIN_TYPE_AS		2
 
+#define	RI_PCE_SUBTLV_DOMAIN		3
+#define	RI_PCE_SUBTLV_DOMAIN_SIZE	8
 struct ri_pce_subtlv_domain {
 	struct tlv_header header; /* Type = 3; Length = 8 bytes. */
 	uint16_t type; /* Domain type: 1 = OSPF Area ID, 2 = AS Number */
@@ -142,6 +143,7 @@ struct ri_pce_subtlv_domain {
 
 /* PCE Neighbor Sub-TLV */ /* Mandatory if R or S bit is set */
 #define RI_PCE_SUBTLV_NEIGHBOR		4
+#define RI_PCE_SUBTLV_NEIGHBOR_SIZE	8
 struct ri_pce_subtlv_neighbor {
 	struct tlv_header header; /* Type = 4; Length = 8 bytes. */
 	uint16_t type; /* Domain type: 1 = OSPF Area ID, 2 = AS Number */
@@ -151,6 +153,7 @@ struct ri_pce_subtlv_neighbor {
 
 /* PCE Capabilities Flags Sub-TLV */ /* Optional */
 #define RI_PCE_SUBTLV_CAP_FLAG		5
+#define RI_PCE_SUBTLV_CAP_FLAG_SIZE	4
 
 #define PCE_CAP_GMPLS_LINK		0x0001
 #define PCE_CAP_BIDIRECTIONAL		0x0002