Merge remote-tracking branch 'origin/mq-static-analysis'

9 files changed, 37 insertions, 25 deletions

diff --git a/proto/babel/babel.c b/proto/babel/babel.c
index a915e8fa..ebd5f7cc 100644
--- a/proto/babel/babel.c
+++ b/proto/babel/babel.c
@@ -1852,7 +1852,7 @@ babel_get_route_info(rte *rte, byte *buf)
 }
 
 static int
-babel_get_attr(eattr *a, byte *buf, int buflen UNUSED)
+babel_get_attr(const eattr *a, byte *buf, int buflen UNUSED)
 {
   switch (a->id)
   {
diff --git a/proto/bgp/attrs.c b/proto/bgp/attrs.c
index 655ddb62..4710bfba 100644
--- a/proto/bgp/attrs.c
+++ b/proto/bgp/attrs.c
@@ -72,7 +72,7 @@ struct bgp_attr_desc {
   void (*export)(struct bgp_export_state *s, eattr *a);
   int  (*encode)(struct bgp_write_state *s, eattr *a, byte *buf, uint size);
   void (*decode)(struct bgp_parse_state *s, uint code, uint flags, byte *data, uint len, ea_list **to);
-  void (*format)(eattr *ea, byte *buf, uint size);
+  void (*format)(const eattr *ea, byte *buf, uint size);
 };
 
 static const struct bgp_attr_desc bgp_attr_table[];
@@ -396,7 +396,7 @@ bgp_decode_origin(struct bgp_parse_state *s, uint code UNUSED, uint flags, byte
 }
 
 static void
-bgp_format_origin(eattr *a, byte *buf, uint size UNUSED)
+bgp_format_origin(const eattr *a, byte *buf, uint size UNUSED)
 {
   static const char *bgp_origin_names[] = { "IGP", "EGP", "Incomplete" };
 
@@ -510,7 +510,7 @@ bgp_decode_next_hop(struct bgp_parse_state *s, uint code UNUSED, uint flags UNUS
 
 /* TODO: This function should use AF-specific hook */
 static void
-bgp_format_next_hop(eattr *a, byte *buf, uint size UNUSED)
+bgp_format_next_hop(const eattr *a, byte *buf, uint size UNUSED)
 {
   ip_addr *nh = (void *) a->u.ptr->data;
   uint len = a->u.ptr->length;
@@ -601,7 +601,7 @@ bgp_decode_aggregator(struct bgp_parse_state *s, uint code UNUSED, uint flags, b
 }
 
 static void
-bgp_format_aggregator(eattr *a, byte *buf, uint size UNUSED)
+bgp_format_aggregator(const eattr *a, byte *buf, uint size UNUSED)
 {
   const byte *data = a->u.ptr->data;
 
@@ -676,7 +676,7 @@ bgp_decode_cluster_list(struct bgp_parse_state *s, uint code UNUSED, uint flags,
 }
 
 static void
-bgp_format_cluster_list(eattr *a, byte *buf, uint size)
+bgp_format_cluster_list(const eattr *a, byte *buf, uint size)
 {
   /* Truncates cluster lists larger than buflen, probably not a problem */
   int_set_format(a->u.ptr, 0, -1, buf, size);
@@ -831,7 +831,7 @@ bgp_decode_aigp(struct bgp_parse_state *s, uint code UNUSED, uint flags, byte *d
 }
 
 static void
-bgp_format_aigp(eattr *a, byte *buf, uint size UNUSED)
+bgp_format_aigp(const eattr *a, byte *buf, uint size UNUSED)
 {
   const byte *b = bgp_aigp_get_tlv(a->u.ptr, BGP_AIGP_METRIC);
 
@@ -909,7 +909,7 @@ bgp_decode_mpls_label_stack(struct bgp_parse_state *s, uint code UNUSED, uint fl
 }
 
 static void
-bgp_format_mpls_label_stack(eattr *a, byte *buf, uint size)
+bgp_format_mpls_label_stack(const eattr *a, byte *buf, uint size)
 {
   u32 *labels = (u32 *) a->u.ptr->data;
   uint lnum = a->u.ptr->length / 4;
@@ -2293,7 +2293,7 @@ bgp_process_as4_attrs(ea_list **attrs, struct linpool *pool)
 }
 
 int
-bgp_get_attr(eattr *a, byte *buf, int buflen)
+bgp_get_attr(const eattr *a, byte *buf, int buflen)
 {
   uint i = EA_ID(a->id);
   const struct bgp_attr_desc *d;
diff --git a/proto/bgp/bgp.h b/proto/bgp/bgp.h
index dc63e13e..455f04f9 100644
--- a/proto/bgp/bgp.h
+++ b/proto/bgp/bgp.h
@@ -552,7 +552,7 @@ static inline void
 bgp_set_attr_data(ea_list **to, struct linpool *pool, uint code, uint flags, void *data, uint len)
 {
   struct adata *a = lp_alloc_adata(pool, len);
-  memcpy(a->data, data, len);
+  bmemcpy(a->data, data, len);
   bgp_set_attr(to, pool, code, flags, (uintptr_t) a);
 }
 
@@ -581,7 +581,7 @@ int bgp_rte_recalculate(rtable *table, net *net, rte *new, rte *old, rte *old_be
 struct rte *bgp_rte_modify_stale(struct rte *r, struct linpool *pool);
 void bgp_rt_notify(struct proto *P, struct channel *C, net *n, rte *new, rte *old);
 int bgp_preexport(struct proto *, struct rte **, struct linpool *);
-int bgp_get_attr(struct eattr *e, byte *buf, int buflen);
+int bgp_get_attr(const struct eattr *e, byte *buf, int buflen);
 void bgp_get_route_info(struct rte *, byte *buf);
 int bgp_total_aigp_metric_(rte *e, u64 *metric, const struct adata **ad);
 
diff --git a/proto/ospf/neighbor.c b/proto/ospf/neighbor.c
index 30e80640..18692d6e 100644
--- a/proto/ospf/neighbor.c
+++ b/proto/ospf/neighbor.c
@@ -650,19 +650,20 @@ void
 ospf_dr_election(struct ospf_iface *ifa)
 {
   struct ospf_proto *p = ifa->oa->po;
-  struct ospf_neighbor *neigh, *ndr, *nbdr, me;
+  struct ospf_neighbor *neigh, *ndr, *nbdr;
   u32 myid = p->router_id;
 
   DBG("(B)DR election.\n");
 
-  me.state = NEIGHBOR_2WAY;
-  me.rid = myid;
-  me.priority = ifa->priority;
-  me.ip = ifa->addr->ip;
-
-  me.dr  = ospf_is_v2(p) ? ipa_to_u32(ifa->drip) : ifa->drid;
-  me.bdr = ospf_is_v2(p) ? ipa_to_u32(ifa->bdrip) : ifa->bdrid;
-  me.iface_id = ifa->iface_id;
+  struct ospf_neighbor me = {
+    .state = NEIGHBOR_2WAY,
+    .rid = myid,
+    .priority = ifa->priority,
+    .ip = ifa->addr->ip,
+    .dr  = ospf_is_v2(p) ? ipa_to_u32(ifa->drip) : ifa->drid,
+    .bdr = ospf_is_v2(p) ? ipa_to_u32(ifa->bdrip) : ifa->bdrid,
+    .iface_id = ifa->iface_id,
+  };
 
   add_tail(&ifa->neigh_list, NODE & me);
 
diff --git a/proto/ospf/ospf.c b/proto/ospf/ospf.c
index 29610f4a..c8ed0e06 100644
--- a/proto/ospf/ospf.c
+++ b/proto/ospf/ospf.c
@@ -620,7 +620,7 @@ ospf_get_route_info(rte * rte, byte * buf)
 }
 
 static int
-ospf_get_attr(eattr * a, byte * buf, int buflen UNUSED)
+ospf_get_attr(const eattr * a, byte * buf, int buflen UNUSED)
 {
   switch (a->id)
   {
@@ -1244,7 +1244,7 @@ ospf_sh_state(struct proto *P, int verbose, int reachable)
 
   uint num = p->gr->hash_entries;
   struct top_hash_entry *hea[num];
-  struct top_hash_entry *hex[verbose ? num : 0];
+  struct top_hash_entry **hex = verbose ? alloca(num * sizeof(struct top_hash_entry *)) : NULL;
   struct top_hash_entry *he;
   struct top_hash_entry *cnode = NULL;
 
@@ -1289,7 +1289,9 @@ ospf_sh_state(struct proto *P, int verbose, int reachable)
 
   lsa_compare_ospf3 = !ospf2;
   qsort(hea, j1, sizeof(struct top_hash_entry *), lsa_compare_for_state);
-  qsort(hex, jx, sizeof(struct top_hash_entry *), ext_compare_for_state);
+
+  if (verbose)
+    qsort(hex, jx, sizeof(struct top_hash_entry *), ext_compare_for_state);
 
   /*
    * This code is a bit tricky, we have a primary LSAs (router and
diff --git a/proto/ospf/topology.c b/proto/ospf/topology.c
index 2e9c3965..c8ec730a 100644
--- a/proto/ospf/topology.c
+++ b/proto/ospf/topology.c
@@ -329,6 +329,14 @@ ospf_originate_lsa(struct ospf_proto *p, struct ospf_new_lsa *lsa)
     en->next_lsa_opts = 0;
   }
 
+  /* The static analyzer complains here that en->lsa_body may be NULL.
+   * Yes, it may if ospf_hash_get() creates a new struct top_hash_entry.
+   * In this case, also en->lsa.length must be 0 and lsa_length is never
+   * equal to 0 while sizeof(struct ospf_lsa_header) is non-zero.
+   * Therefore memcmp() is never executed with NULL here.
+   * */
+  ASSUME((en->lsa.length == 0) == (en->lsa_body == NULL));
+
   /* Ignore the the new LSA if is the same as the current one */
   if ((en->lsa.age < LSA_MAXAGE) &&
       (lsa_length == en->lsa.length) &&
diff --git a/proto/radv/radv.c b/proto/radv/radv.c
index 622b3c3c..b4235917 100644
--- a/proto/radv/radv.c
+++ b/proto/radv/radv.c
@@ -740,7 +740,7 @@ radv_pref_str(u32 pref)
 
 /* The buffer has some minimal size */
 static int
-radv_get_attr(eattr *a, byte *buf, int buflen UNUSED)
+radv_get_attr(const eattr *a, byte *buf, int buflen UNUSED)
 {
   switch (a->id)
   {
diff --git a/proto/rip/rip.c b/proto/rip/rip.c
index f02d5071..ae8007d9 100644
--- a/proto/rip/rip.c
+++ b/proto/rip/rip.c
@@ -1190,7 +1190,7 @@ rip_get_route_info(rte *rte, byte *buf)
 }
 
 static int
-rip_get_attr(eattr *a, byte *buf, int buflen UNUSED)
+rip_get_attr(const eattr *a, byte *buf, int buflen UNUSED)
 {
   switch (a->id)
   {
diff --git a/proto/rpki/packets.c b/proto/rpki/packets.c
index 59a5efaf..e9d24fb8 100644
--- a/proto/rpki/packets.c
+++ b/proto/rpki/packets.c
@@ -1011,6 +1011,7 @@ rpki_send_error_pdu(struct rpki_cache *cache, const enum pdu_error_type error_co
   {
     va_start(args, fmt);
     msg_len = bvsnprintf(msg, sizeof(msg), fmt, args) + 1;
+    va_end(args);
   }
 
   u32 pdu_size = 16 + err_pdu_len + msg_len;