Skip to content

Commit

Permalink
pim6d: valgrind issue fixes
Browse files Browse the repository at this point in the history
Problem Statement:
===================
Syscall param sendmsg(msg.msg_iov[0]) points to uninitialised byte(s)
at 0x4975157: sendmsg (sendmsg.c:28)
==2263111==    by 0x1413BE: pim_msg_send_frame (pim_pim.c:629)
==2263111==    by 0x1413BE: pim_msg_send (pim_pim.c:743)
==2263111==    by 0x1425DC: pim_register_send (pim_register.c:332)
==2263111==    by 0x1427EE: pim_null_register_send (pim_register.c:443)
==2263111==    by 0x14D228: pim_upstream_register_stop_timer (pim_upstream.c:1608)
==2263111==    by 0x48CE6DF: thread_call (thread.c:1693)
==2263111==    by 0x4899EFF: frr_run (libfrr.c:1068)
==2263111==    by 0x11D035: main (pim6_main.c:190)
==2263111==  Address 0x1ffeffdcb1 is on thread 1's stack
==2263111==  in frame #2, created by pim_register_send (pim_register.c:273)
==2263111==  Uninitialised value was created by a stack allocation
==2263111==    at 0x142690: pim_null_register_send (pim_register.c:389)

RCA:
====================
1. All members of struct pim_msg_header were not initiliased while sending
null register packet. Therefore when the pointers are assigned while
sending the msg via sendmsg, it complains the pointer points to
uninitialised byte.
2. struct ipv6_ph ph was also not initialised.

Fix:
====================
Initialised all the members using memset.

Signed-off-by: Mobashshera Rasool <[email protected]>
(cherry picked from commit 1064818)
  • Loading branch information
mobash-rasool authored and mergify[bot] committed Oct 17, 2023
1 parent 5c2e63d commit 564697e
Showing 1 changed file with 2 additions and 5 deletions.
7 changes: 2 additions & 5 deletions pimd/pim_register.c
Original file line number Diff line number Diff line change
Expand Up @@ -416,11 +416,8 @@ void pim_null_register_send(struct pim_upstream *up)
memset(buffer, 0, (sizeof(ip6_hdr) + sizeof(pim_msg_header)));
memcpy(buffer, &ip6_hdr, sizeof(ip6_hdr));

pim_msg_header.ver = 0;
pim_msg_header.type = 0;
pim_msg_header.reserved = 0;

pim_msg_header.checksum = 0;
memset(&pim_msg_header, 0, sizeof(pim_msg_header));
memset(&ph, 0, sizeof(ph));

ph.src = up->sg.src;
ph.dst = up->sg.grp;
Expand Down

0 comments on commit 564697e

Please sign in to comment.