commit 9dec76be0f7a255f60ed64ed3f8dad7edc4fb83e
author Dave Wallace <dwallacelf@gmail.com> Mon Jan 22 23:05:39 2024 -0500
committer Damjan Marion <dmarion@0xa5.net> Tue Apr 02 11:12:23 2024 +0000
tree cf2510ee254ec665bdf7214036d4d1afbebb8a32
parent 966049986a34c047daf558d18b3582f7123657e9

fib: coverity 335348 out-of-bounds access

- also fix memory leak in adj_glean_walk_proto()

Type: fix

Change-Id: I3cd72b14506e6bfc9d8d77a65d7b9b2703992367
Signed-off-by: Dave Wallace <dwallacelf@gmail.com>

src/vnet/adj/adj_glean.c

diff --git a/src/vnet/adj/adj_glean.c b/src/vnet/adj/adj_glean.c
index 0313407..ceece0d 100644
--- a/src/vnet/adj/adj_glean.c
+++ b/src/vnet/adj/adj_glean.c
@@ -45,7 +45,7 @@
 {
     uword *p;
 
-    if (vec_len(adj_gleans[proto]) <= sw_if_index)
+    if ((proto >= FIB_PROTOCOL_IP_MAX) || vec_len(adj_gleans[proto]) <= sw_if_index)
         return (ADJ_INDEX_INVALID);
 
     p = hash_get_mem (adj_gleans[proto][sw_if_index], nh_addr);
@@ -66,6 +66,7 @@
 
     vlib_worker_thread_barrier_sync(vm);
 
+    ASSERT(proto < FIB_PROTOCOL_IP_MAX);
     vec_validate(adj_gleans[proto], sw_if_index);
 
     if (NULL == adj_gleans[proto][sw_if_index])
@@ -195,6 +196,7 @@
     adj_index_t ai, *aip, *ais = NULL;
     ip46_address_t *conn;
 
+    ASSERT(proto < FIB_PROTOCOL_IP_MAX);
     if (vec_len(adj_gleans[proto]) <= sw_if_index ||
         NULL == adj_gleans[proto][sw_if_index])
         return;
@@ -212,7 +214,7 @@
     vec_foreach(aip, ais)
     {
         if (ADJ_WALK_RC_STOP == cb(*aip, data))
-            return;
+            break;
     }
     vec_free(ais);
 }
@@ -244,6 +246,7 @@
         ip46_address_t *conn;
         adj_index_t ai;
 
+        ASSERT(proto < FIB_PROTOCOL_IP_MAX);
         if (vec_len(adj_gleans[proto]) <= sw_if_index ||
             NULL == adj_gleans[proto][sw_if_index])
             return (ADJ_INDEX_INVALID);
@@ -265,6 +268,7 @@
     const ip_adjacency_t *adj;
     adj_index_t ai;
 
+    ASSERT(proto < FIB_PROTOCOL_IP_MAX);
     if (vec_len(adj_gleans[proto]) <= sw_if_index ||
         NULL == adj_gleans[proto][sw_if_index])
         return (NULL);