lldpd_alloc_mgmt: 264| 27|{ 265| 27| struct lldpd_mgmt *mgmt; 266| | 267| 27| log_debug("alloc", "allocate a new management address (family: %d)", family); 268| | 269| 27| if (family <= LLDPD_AF_UNSPEC || family >= LLDPD_AF_LAST) { ------------------ | Branch (269:6): [True: 0, False: 27] | Branch (269:35): [True: 0, False: 27] ------------------ 270| 0| errno = EAFNOSUPPORT; 271| 0| return NULL; 272| 0| } 273| 27| if (addrsize > LLDPD_MGMT_MAXADDRSIZE) { ------------------ | | 157| 27|#define LLDPD_MGMT_MAXADDRSIZE 16 /* sizeof(struct in6_addr) */ ------------------ | Branch (273:6): [True: 0, False: 27] ------------------ 274| 0| errno = EOVERFLOW; 275| 0| return NULL; 276| 0| } 277| 27| mgmt = calloc(1, sizeof(struct lldpd_mgmt)); 278| 27| if (mgmt == NULL) { ------------------ | Branch (278:6): [True: 0, False: 27] ------------------ 279| 0| errno = ENOMEM; 280| 0| return NULL; 281| 0| } 282| 27| mgmt->m_family = family; 283| 27| memcpy(&mgmt->m_addr, addrptr, addrsize); 284| 27| mgmt->m_addrsize = addrsize; 285| 27| mgmt->m_iface = iface; 286| 27| return mgmt; 287| 27|} sonmp_decode: 280| 141|{ 281| 141| const u_int8_t mcastaddr[] = SONMP_MULTICAST_ADDR; ------------------ | | 22| 141| { \ | | 23| 141| 0x01, 0x00, 0x81, 0x00, 0x01, 0x00 \ | | 24| 141| } ------------------ 282| 141| struct lldpd_chassis *chassis; 283| 141| struct lldpd_port *port; 284| 141| struct lldpd_mgmt *mgmt; 285| 141| int length, i; 286| 141| u_int8_t *pos; 287| 141| u_int8_t seg[3], rchassis; 288| 141| struct in_addr address; 289| | 290| 141| log_debug("sonmp", "decode SONMP PDU from %s", hardware->h_ifname); 291| | 292| 141| if ((chassis = calloc(1, sizeof(struct lldpd_chassis))) == NULL) { ------------------ | Branch (292:6): [True: 0, False: 141] ------------------ 293| 0| log_warn("sonmp", "failed to allocate remote chassis"); 294| 0| return -1; 295| 0| } 296| 141| TAILQ_INIT(&chassis->c_mgmt); 297| 141| if ((port = calloc(1, sizeof(struct lldpd_port))) == NULL) { ------------------ | Branch (297:6): [True: 0, False: 141] ------------------ 298| 0| log_warn("sonmp", "failed to allocate remote port"); 299| 0| free(chassis); 300| 0| return -1; 301| 0| } 302| 141|# ifdef ENABLE_DOT1 303| 141| TAILQ_INIT(&port->p_vlans); 304| 141|# endif 305| | 306| 141| length = s; 307| 141| pos = (u_int8_t *)frame; 308| 141| if (length < SONMP_SIZE + 2 * ETHER_ADDR_LEN + sizeof(u_int16_t)) { ------------------ | | 31| 141|#define SONMP_SIZE 19 ------------------ | Branch (308:6): [True: 12, False: 129] ------------------ 309| 12| log_warnx("sonmp", "too short SONMP frame received on %s", 310| 12| hardware->h_ifname); 311| 12| goto malformed; 312| 12| } 313| 129| if (PEEK_CMP(mcastaddr, sizeof(mcastaddr)) != 0) ------------------ | | 80| 129| (length -= (bytes), pos += (bytes), memcmp(pos - bytes, value, bytes)) ------------------ | Branch (313:6): [True: 66, False: 63] ------------------ 314| | /* There is two multicast address. We just handle only one of 315| | * them. */ 316| 66| goto malformed; 317| | /* We skip to LLC PID */ 318| 63| PEEK_DISCARD(ETHER_ADDR_LEN); ------------------ | | 72| 63| do { \ | | 73| 63| length -= (bytes); \ | | 74| 63| pos += (bytes); \ | | 75| 63| } while (0) | | ------------------ | | | Branch (75:12): [Folded - Ignored] | | ------------------ ------------------ 319| 63| PEEK_DISCARD_UINT16; ------------------ | | 77| 63|#define PEEK_DISCARD_UINT16 PEEK_DISCARD(2) | | ------------------ | | | | 72| 63| do { \ | | | | 73| 63| length -= (bytes); \ | | | | 74| 63| pos += (bytes); \ | | | | 75| 63| } while (0) | | | | ------------------ | | | | | Branch (75:12): [Folded - Ignored] | | | | ------------------ | | ------------------ ------------------ 320| 63| PEEK_DISCARD(6); ------------------ | | 72| 63| do { \ | | 73| 63| length -= (bytes); \ | | 74| 63| pos += (bytes); \ | | 75| 63| } while (0) | | ------------------ | | | Branch (75:12): [Folded - Ignored] | | ------------------ ------------------ 321| 63| if (PEEK_UINT16 != LLC_PID_SONMP_HELLO) { ------------------ | | 63| 63|#define PEEK_UINT16 PEEK(types.f_uint16, ntohs) | | ------------------ | | | | 60| 63| (memcpy(&type, pos, sizeof(type)), length -= sizeof(type), pos += sizeof(type), \ | | | | 61| 63| func(type)) | | | | ------------------ | | | | | | 63| 63|#define PEEK_UINT16 PEEK(types.f_uint16, ntohs) | | | | ------------------ | | ------------------ ------------------ if (PEEK_UINT16 != LLC_PID_SONMP_HELLO) { ------------------ | | 29| 63|#define LLC_PID_SONMP_HELLO 0x01a2 ------------------ | Branch (321:6): [True: 36, False: 27] ------------------ 322| 36| log_debug("sonmp", "incorrect LLC protocol ID received for SONMP on %s", 323| 36| hardware->h_ifname); 324| 36| goto malformed; 325| 36| } 326| | 327| 27| chassis->c_id_subtype = LLDP_CHASSISID_SUBTYPE_ADDR; ------------------ | | 35| 27|#define LLDP_CHASSISID_SUBTYPE_ADDR 5 ------------------ 328| 27| if ((chassis->c_id = calloc(1, sizeof(struct in_addr) + 1)) == NULL) { ------------------ | Branch (328:6): [True: 0, False: 27] ------------------ 329| 0| log_warn("sonmp", "unable to allocate memory for chassis id on %s", 330| 0| hardware->h_ifname); 331| 0| goto malformed; 332| 0| } 333| 27| chassis->c_id_len = sizeof(struct in_addr) + 1; 334| 27| chassis->c_id[0] = 1; 335| 27| PEEK_BYTES(&address, sizeof(struct in_addr)); ------------------ | | 66| 27| do { \ | | 67| 27| memcpy(value, pos, bytes); \ | | 68| 27| length -= (bytes); \ | | 69| 27| pos += (bytes); \ | | 70| 27| } while (0) | | ------------------ | | | Branch (70:12): [Folded - Ignored] | | ------------------ ------------------ 336| 27| memcpy(chassis->c_id + 1, &address, sizeof(struct in_addr)); 337| 27| if (asprintf(&chassis->c_name, "%s", inet_ntoa(address)) == -1) { ------------------ | Branch (337:6): [True: 0, False: 27] ------------------ 338| 0| log_warnx("sonmp", "unable to write chassis name for %s", 339| 0| hardware->h_ifname); 340| 0| goto malformed; 341| 0| } 342| 27| PEEK_BYTES(seg, sizeof(seg)); ------------------ | | 66| 27| do { \ | | 67| 27| memcpy(value, pos, bytes); \ | | 68| 27| length -= (bytes); \ | | 69| 27| pos += (bytes); \ | | 70| 27| } while (0) | | ------------------ | | | Branch (70:12): [Folded - Ignored] | | ------------------ ------------------ 343| 27| rchassis = PEEK_UINT8; ------------------ | | 62| 27|#define PEEK_UINT8 PEEK(types.f_uint8, ) | | ------------------ | | | | 60| 27| (memcpy(&type, pos, sizeof(type)), length -= sizeof(type), pos += sizeof(type), \ | | | | 61| 27| func(type)) | | ------------------ ------------------ 344| 2.03k| for (i = 0; sonmp_chassis_types[i].type != 0; i++) { ------------------ | Branch (344:14): [True: 2.02k, False: 10] ------------------ 345| 2.02k| if (sonmp_chassis_types[i].type == rchassis) break; ------------------ | Branch (345:7): [True: 17, False: 2.00k] ------------------ 346| 2.02k| } 347| 27| if (asprintf(&chassis->c_descr, "%s", sonmp_chassis_types[i].description) == ------------------ | Branch (347:6): [True: 0, False: 27] ------------------ 348| 27| -1) { 349| 0| log_warnx("sonmp", "unable to write chassis description for %s", 350| 0| hardware->h_ifname); 351| 0| goto malformed; 352| 0| } 353| 27| mgmt = lldpd_alloc_mgmt(LLDPD_AF_IPV4, &address, sizeof(struct in_addr), 0); 354| 27| if (mgmt == NULL) { ------------------ | Branch (354:6): [True: 0, False: 27] ------------------ 355| 0| if (errno == ENOMEM) ------------------ | Branch (355:7): [True: 0, False: 0] ------------------ 356| 0| log_warn("sonmp", 357| 0| "unable to allocate memory for management address"); 358| 0| else 359| 0| log_warn("sonmp", "too large management address received on %s", 360| 0| hardware->h_ifname); 361| 0| goto malformed; 362| 0| } 363| 27| TAILQ_INSERT_TAIL(&chassis->c_mgmt, mgmt, m_entries); 364| 27| port->p_ttl = 365| 27| cfg ? (cfg->g_config.c_tx_interval * cfg->g_config.c_tx_hold) : LLDPD_TTL; ------------------ | | 69| 27|#define LLDPD_TTL LLDPD_TX_INTERVAL *LLDPD_TX_HOLD | | ------------------ | | | | 67| 27|#define LLDPD_TX_INTERVAL 30 | | ------------------ | | #define LLDPD_TTL LLDPD_TX_INTERVAL *LLDPD_TX_HOLD | | ------------------ | | | | 68| 54|#define LLDPD_TX_HOLD 4 | | ------------------ ------------------ | Branch (365:6): [True: 0, False: 27] ------------------ 366| 27| port->p_ttl = (port->p_ttl + 999) / 1000; 367| | 368| 27| port->p_id_subtype = LLDP_PORTID_SUBTYPE_LOCAL; ------------------ | | 47| 27|#define LLDP_PORTID_SUBTYPE_LOCAL 7 ------------------ 369| | 370| 27| port->p_id_len = 371| 27| asprintf(&port->p_id, "%02x-%02x-%02x", seg[0], seg[1], seg[2]); 372| 27| if (port->p_id_len == -1) { ------------------ | Branch (372:6): [True: 0, False: 27] ------------------ 373| 0| log_warn("sonmp", "unable to allocate memory for port id on %s", 374| 0| hardware->h_ifname); 375| 0| goto malformed; 376| 0| } 377| | 378| | /* Port description depend on the number of segments */ 379| 27| if ((seg[0] == 0) && (seg[1] == 0)) { ------------------ | Branch (379:6): [True: 14, False: 13] | Branch (379:23): [True: 3, False: 11] ------------------ 380| 3| if (asprintf(&port->p_descr, "port %d", seg[2]) == -1) { ------------------ | Branch (380:7): [True: 0, False: 3] ------------------ 381| 0| log_warnx("sonmp", "unable to write port description for %s", 382| 0| hardware->h_ifname); 383| 0| goto malformed; 384| 0| } 385| 24| } else if (seg[0] == 0) { ------------------ | Branch (385:13): [True: 11, False: 13] ------------------ 386| 11| if (asprintf(&port->p_descr, "port %d/%d", seg[1], seg[2]) == -1) { ------------------ | Branch (386:7): [True: 0, False: 11] ------------------ 387| 0| log_warnx("sonmp", "unable to write port description for %s", 388| 0| hardware->h_ifname); 389| 0| goto malformed; 390| 0| } 391| 13| } else { 392| 13| if (asprintf(&port->p_descr, "port %x:%x:%x", seg[0], seg[1], seg[2]) == ------------------ | Branch (392:7): [True: 0, False: 13] ------------------ 393| 13| -1) { 394| 0| log_warnx("sonmp", "unable to write port description for %s", 395| 0| hardware->h_ifname); 396| 0| goto malformed; 397| 0| } 398| 13| } 399| 27| *newchassis = chassis; 400| 27| *newport = port; 401| 27| return 1; 402| | 403| 114|malformed: 404| 114| lldpd_chassis_cleanup(chassis, 1); 405| 114| lldpd_port_cleanup(port, 1); 406| 114| free(port); 407| 114| return -1; 408| 27|} lldpd_chassis_mgmt_cleanup: 26| 141|{ 27| 141| struct lldpd_mgmt *mgmt, *mgmt_next; 28| | 29| 141| log_debug("alloc", "cleanup management addresses for chassis %s", 30| 141| chassis->c_name ? chassis->c_name : "(unknown)"); ------------------ | Branch (30:6): [True: 27, False: 114] ------------------ 31| | 32| 168| for (mgmt = TAILQ_FIRST(&chassis->c_mgmt); mgmt != NULL; mgmt = mgmt_next) { ------------------ | Branch (32:45): [True: 27, False: 141] ------------------ 33| 27| mgmt_next = TAILQ_NEXT(mgmt, m_entries); 34| 27| free(mgmt); 35| 27| } 36| 141| TAILQ_INIT(&chassis->c_mgmt); 37| 141|} lldpd_chassis_cleanup: 41| 141|{ 42| 141| lldpd_chassis_mgmt_cleanup(chassis); 43| 141| log_debug("alloc", "cleanup chassis %s", 44| 141| chassis->c_name ? chassis->c_name : "(unknown)"); ------------------ | Branch (44:6): [True: 27, False: 114] ------------------ 45| 141|#ifdef ENABLE_LLDPMED 46| 141| free(chassis->c_med_hw); 47| 141| free(chassis->c_med_sw); 48| 141| free(chassis->c_med_fw); 49| 141| free(chassis->c_med_sn); 50| 141| free(chassis->c_med_manuf); 51| 141| free(chassis->c_med_model); 52| 141| free(chassis->c_med_asset); 53| 141|#endif 54| 141| free(chassis->c_id); 55| 141| free(chassis->c_name); 56| 141| free(chassis->c_descr); 57| 141| if (all) free(chassis); ------------------ | Branch (57:6): [True: 141, False: 0] ------------------ 58| 141|} lldpd_vlan_cleanup: 63| 141|{ 64| 141| struct lldpd_vlan *vlan, *vlan_next; 65| 141| for (vlan = TAILQ_FIRST(&port->p_vlans); vlan != NULL; vlan = vlan_next) { ------------------ | Branch (65:43): [True: 0, False: 141] ------------------ 66| 0| free(vlan->v_name); 67| 0| vlan_next = TAILQ_NEXT(vlan, v_entries); 68| 0| free(vlan); 69| 0| } 70| 141| TAILQ_INIT(&port->p_vlans); 71| 141| port->p_pvid = 0; 72| 141|} lldpd_ppvid_cleanup: 76| 141|{ 77| 141| struct lldpd_ppvid *ppvid, *ppvid_next; 78| 141| for (ppvid = TAILQ_FIRST(&port->p_ppvids); ppvid != NULL; ppvid = ppvid_next) { ------------------ | Branch (78:45): [True: 0, False: 141] ------------------ 79| 0| ppvid_next = TAILQ_NEXT(ppvid, p_entries); 80| 0| free(ppvid); 81| 0| } 82| 141| TAILQ_INIT(&port->p_ppvids); 83| 141|} lldpd_pi_cleanup: 87| 141|{ 88| 141| struct lldpd_pi *pi, *pi_next; 89| 141| for (pi = TAILQ_FIRST(&port->p_pids); pi != NULL; pi = pi_next) { ------------------ | Branch (89:40): [True: 0, False: 141] ------------------ 90| 0| free(pi->p_pi); 91| 0| pi_next = TAILQ_NEXT(pi, p_entries); 92| 0| free(pi); 93| 0| } 94| 141| TAILQ_INIT(&port->p_pids); 95| 141|} lldpd_custom_list_cleanup: 135| 141|{ 136| 141| struct lldpd_custom *custom, *custom_next; 137| 141| for (custom = TAILQ_FIRST(&port->p_custom_list); custom != NULL; ------------------ | Branch (137:51): [True: 0, False: 141] ------------------ 138| 141| custom = custom_next) { 139| 0| custom_next = TAILQ_NEXT(custom, next); 140| 0| free(custom->oui_info); 141| 0| free(custom); 142| 0| } 143| 141| TAILQ_INIT(&port->p_custom_list); 144| 141|} lldpd_port_cleanup: 190| 141|{ 191| 141|#ifdef ENABLE_LLDPMED 192| 141| int i; 193| 141| if (all) ------------------ | Branch (193:6): [True: 141, False: 0] ------------------ 194| 564| for (i = 0; i < LLDP_MED_LOCFORMAT_LAST; i++) ------------------ | | 292| 564|#define LLDP_MED_LOCFORMAT_LAST LLDP_MED_LOCFORMAT_ELIN | | ------------------ | | | | 291| 564|#define LLDP_MED_LOCFORMAT_ELIN 3 | | ------------------ ------------------ | Branch (194:15): [True: 423, False: 141] ------------------ 195| 423| free(port->p_med_location[i].data); 196| 141|#endif 197| 141|#ifdef ENABLE_DOT1 198| 141| lldpd_vlan_cleanup(port); 199| 141| lldpd_ppvid_cleanup(port); 200| 141| lldpd_pi_cleanup(port); 201| 141|#endif 202| | /* will set these to NULL so we don't free wrong memory */ 203| | 204| 141| if (all) { ------------------ | Branch (204:6): [True: 141, False: 0] ------------------ 205| 141| free(port->p_id); 206| 141| port->p_id = NULL; 207| 141| free(port->p_descr); 208| 141| port->p_descr = NULL; 209| 141| free(port->p_lastframe); 210| 141| if (port->p_chassis) { /* chassis may not have been attributed, yet */ ------------------ | Branch (210:7): [True: 0, False: 141] ------------------ 211| 0| port->p_chassis->c_refcount--; 212| 0| port->p_chassis = NULL; 213| 0| } 214| 141|#ifdef ENABLE_CUSTOM 215| 141| lldpd_custom_list_cleanup(port); 216| 141|#endif 217| 141| } 218| 141|} log_register: 63| 141|{ 64| 141| logh = cb; 65| 141|} log_warnx: 216| 12|{ 217| 12| va_list ap; 218| | 219| 12| va_start(ap, emsg); 220| 12| vlog(LOG_WARNING, token, emsg, ap); 221| 12| va_end(ap); 222| 12|} log_debug: 249| 486|{ 250| 486| va_list ap; 251| | 252| 486| if ((debug > 1 && log_debug_accept_token(token)) || logh) { ------------------ | Branch (252:7): [True: 0, False: 486] | Branch (252:20): [True: 0, False: 0] | Branch (252:54): [True: 486, False: 0] ------------------ 253| 486| va_start(ap, emsg); 254| 486| vlog(LOG_DEBUG, token, emsg, ap); 255| 486| va_end(ap); 256| 486| } 257| 486|} log.c:vlog: 153| 498|{ 154| 498| if (logh) { ------------------ | Branch (154:6): [True: 498, False: 0] ------------------ 155| 498| char *result = NULL; 156| 498| if (vasprintf(&result, fmt, ap) != -1) { ------------------ | Branch (156:7): [True: 498, False: 0] ------------------ 157| 498| logh(pri, result); 158| 498| free(result); 159| 498| return; 160| 498| } 161| | /* Otherwise, abort. We don't know if "ap" is still OK. We could 162| | * have made a copy, but this is too much overhead for a 163| | * situation that shouldn't happen. */ 164| 0| return; 165| 498| } 166| | 167| | /* Log to syslog if requested */ 168| 0| if (use_syslog) { ------------------ | Branch (168:6): [True: 0, False: 0] ------------------ 169| 0| va_list ap2; 170| 0| va_copy(ap2, ap); 171| 0| vsyslog(pri, fmt, ap2); 172| 0| va_end(ap2); 173| 0| } 174| | 175| | /* Log to standard error in all cases */ 176| 0| char *nfmt; 177| | /* best effort in out of mem situations */ 178| 0| if (asprintf(&nfmt, "%s %s%s%s]%s %s\n", date(), translate(STDERR_FILENO, pri), ------------------ | Branch (178:6): [True: 0, False: 0] ------------------ 179| 0| token ? "/" : "", token ? token : "", 180| 0| isatty(STDERR_FILENO) ? "\033[0m" : "", fmt) == -1) { 181| 0| vfprintf(stderr, fmt, ap); 182| 0| fprintf(stderr, "\n"); 183| 0| } else { 184| 0| vfprintf(stderr, nfmt, ap); 185| 0| free(nfmt); 186| 0| } 187| 0| fflush(stderr); 188| 0|} donothing: 24| 498|void donothing(int pri, const char *msg) {}; LLVMFuzzerTestOneInput: 28| 167|{ 29| 167| if (Size < kMinInputLength || Size > kMaxInputLength) { ------------------ | | 20| 334|#define kMinInputLength 5 ------------------ if (Size < kMinInputLength || Size > kMaxInputLength) { ------------------ | | 21| 163|#define kMaxInputLength 2048 ------------------ | Branch (29:6): [True: 4, False: 163] | Branch (29:32): [True: 22, False: 141] ------------------ 30| 26| return 1; 31| 26| } 32| | 33| 141| struct lldpd_chassis *nchassis = NULL; 34| 141| struct lldpd_port *nport = NULL; 35| 141| struct lldpd_hardware hardware; 36| | 37| 141| log_register(donothing); 38| | 39| 141| sonmp_decode(NULL, (char *)Data, Size, &hardware, &nchassis, &nport); 40| | 41| 141| if (!nchassis || !nport) { ------------------ | Branch (41:6): [True: 114, False: 27] | Branch (41:19): [True: 0, False: 27] ------------------ 42| 114| return 1; 43| 114| } 44| | 45| 27| lldpd_port_cleanup(nport, 1); 46| 27| free(nport); 47| 27| lldpd_chassis_cleanup(nchassis, 1); 48| | 49| 27| return 0; 50| 141|}