lldpd_alloc_mgmt: 265| 46|{ 266| 46| struct lldpd_mgmt *mgmt; 267| | 268| 46| log_debug("alloc", "allocate a new management address (family: %d)", family); 269| | 270| 46| if (family <= LLDPD_AF_UNSPEC || family >= LLDPD_AF_LAST) { ------------------ | Branch (270:6): [True: 0, False: 46] | Branch (270:35): [True: 0, False: 46] ------------------ 271| 0| errno = EAFNOSUPPORT; 272| 0| return NULL; 273| 0| } 274| 46| if (addrsize > LLDPD_MGMT_MAXADDRSIZE) { ------------------ | | 157| 46|#define LLDPD_MGMT_MAXADDRSIZE 16 /* sizeof(struct in6_addr) */ ------------------ | Branch (274:6): [True: 0, False: 46] ------------------ 275| 0| errno = EOVERFLOW; 276| 0| return NULL; 277| 0| } 278| 46| mgmt = calloc(1, sizeof(struct lldpd_mgmt)); 279| 46| if (mgmt == NULL) { ------------------ | Branch (279:6): [True: 0, False: 46] ------------------ 280| 0| errno = ENOMEM; 281| 0| return NULL; 282| 0| } 283| 46| mgmt->m_family = family; 284| 46| memcpy(&mgmt->m_addr, addrptr, addrsize); 285| 46| mgmt->m_addrsize = addrsize; 286| 46| mgmt->m_iface = iface; 287| 46| return mgmt; 288| 46|} sonmp_decode: 281| 134|{ 282| 134| const u_int8_t mcastaddr[] = SONMP_MULTICAST_ADDR; ------------------ | | 22| 134| { \ | | 23| 134| 0x01, 0x00, 0x81, 0x00, 0x01, 0x00 \ | | 24| 134| } ------------------ 283| 134| struct lldpd_chassis *chassis; 284| 134| struct lldpd_port *port; 285| 134| struct lldpd_mgmt *mgmt; 286| 134| int length, i; 287| 134| u_int8_t *pos; 288| 134| u_int8_t seg[3], rchassis; 289| 134| struct in_addr address; 290| 134| char ip_addr[INET_ADDRSTRLEN]; 291| | 292| 134| log_debug("sonmp", "decode SONMP PDU from %s", hardware->h_ifname); 293| | 294| 134| if ((chassis = calloc(1, sizeof(struct lldpd_chassis))) == NULL) { ------------------ | Branch (294:6): [True: 0, False: 134] ------------------ 295| 0| log_warn("sonmp", "failed to allocate remote chassis"); 296| 0| return -1; 297| 0| } 298| 134| TAILQ_INIT(&chassis->c_mgmt); ------------------ | Branch (298:2): [Folded, False: 134] ------------------ 299| 134| if ((port = calloc(1, sizeof(struct lldpd_port))) == NULL) { ------------------ | Branch (299:6): [True: 0, False: 134] ------------------ 300| 0| log_warn("sonmp", "failed to allocate remote port"); 301| 0| free(chassis); 302| 0| return -1; 303| 0| } 304| 134|# ifdef ENABLE_DOT1 305| 134| TAILQ_INIT(&port->p_vlans); ------------------ | Branch (305:2): [Folded, False: 134] ------------------ 306| 134|# endif 307| | 308| 134| length = s; 309| 134| pos = (u_int8_t *)frame; 310| 134| if (length < SONMP_SIZE + 2 * ETHER_ADDR_LEN + sizeof(u_int16_t)) { ------------------ | | 31| 134|#define SONMP_SIZE 19 ------------------ | Branch (310:6): [True: 12, False: 122] ------------------ 311| 12| log_warnx("sonmp", "too short SONMP frame received on %s", 312| 12| hardware->h_ifname); 313| 12| goto malformed; 314| 12| } 315| 122| if (PEEK_CMP(mcastaddr, sizeof(mcastaddr)) != 0) ------------------ | | 80| 122| (length -= (bytes), pos += (bytes), memcmp(pos - bytes, value, bytes)) ------------------ | Branch (315:6): [True: 50, False: 72] ------------------ 316| | /* There is two multicast address. We just handle only one of 317| | * them. */ 318| 50| goto malformed; 319| | /* We skip to LLC PID */ 320| 72| PEEK_DISCARD(ETHER_ADDR_LEN); ------------------ | | 72| 72| do { \ | | 73| 72| length -= (bytes); \ | | 74| 72| pos += (bytes); \ | | 75| 72| } while (0) | | ------------------ | | | Branch (75:12): [Folded, False: 72] | | ------------------ ------------------ 321| 72| PEEK_DISCARD_UINT16; ------------------ | | 77| 72|#define PEEK_DISCARD_UINT16 PEEK_DISCARD(2) | | ------------------ | | | | 72| 72| do { \ | | | | 73| 72| length -= (bytes); \ | | | | 74| 72| pos += (bytes); \ | | | | 75| 72| } while (0) | | | | ------------------ | | | | | Branch (75:12): [Folded, False: 72] | | | | ------------------ | | ------------------ ------------------ 322| 72| PEEK_DISCARD(6); ------------------ | | 72| 72| do { \ | | 73| 72| length -= (bytes); \ | | 74| 72| pos += (bytes); \ | | 75| 72| } while (0) | | ------------------ | | | Branch (75:12): [Folded, False: 72] | | ------------------ ------------------ 323| 72| if (PEEK_UINT16 != LLC_PID_SONMP_HELLO) { ------------------ | | 63| 72|#define PEEK_UINT16 PEEK(types.f_uint16, ntohs) | | ------------------ | | | | 60| 72| (memcpy(&type, pos, sizeof(type)), length -= sizeof(type), pos += sizeof(type), \ | | | | 61| 72| func(type)) | | | | ------------------ | | | | | | 63| 72|#define PEEK_UINT16 PEEK(types.f_uint16, ntohs) | | | | ------------------ | | ------------------ ------------------ if (PEEK_UINT16 != LLC_PID_SONMP_HELLO) { ------------------ | | 29| 72|#define LLC_PID_SONMP_HELLO 0x01a2 ------------------ | Branch (323:6): [True: 26, False: 46] ------------------ 324| 26| log_debug("sonmp", "incorrect LLC protocol ID received for SONMP on %s", 325| 26| hardware->h_ifname); 326| 26| goto malformed; 327| 26| } 328| | 329| 46| chassis->c_id_subtype = LLDP_CHASSISID_SUBTYPE_ADDR; ------------------ | | 35| 46|#define LLDP_CHASSISID_SUBTYPE_ADDR 5 ------------------ 330| 46| if ((chassis->c_id = calloc(1, sizeof(struct in_addr) + 1)) == NULL) { ------------------ | Branch (330:6): [True: 0, False: 46] ------------------ 331| 0| log_warn("sonmp", "unable to allocate memory for chassis id on %s", 332| 0| hardware->h_ifname); 333| 0| goto malformed; 334| 0| } 335| 46| chassis->c_id_len = sizeof(struct in_addr) + 1; 336| 46| chassis->c_id[0] = 1; 337| 46| PEEK_BYTES(&address, sizeof(struct in_addr)); ------------------ | | 66| 46| do { \ | | 67| 46| memcpy(value, pos, bytes); \ | | 68| 46| length -= (bytes); \ | | 69| 46| pos += (bytes); \ | | 70| 46| } while (0) | | ------------------ | | | Branch (70:12): [Folded, False: 46] | | ------------------ ------------------ 338| 46| memcpy(chassis->c_id + 1, &address, sizeof(struct in_addr)); 339| 46| if (inet_ntop(AF_INET, &address, ip_addr, sizeof(ip_addr)) == NULL) { ------------------ | Branch (339:6): [True: 0, False: 46] ------------------ 340| 0| log_warnx("sonmp", "unable to convert chassis address for %s", 341| 0| hardware->h_ifname); 342| 0| goto malformed; 343| 0| } 344| 46| if (asprintf(&chassis->c_name, "%s", ip_addr) == -1) { ------------------ | Branch (344:6): [True: 0, False: 46] ------------------ 345| 0| log_warnx("sonmp", "unable to write chassis name for %s", 346| 0| hardware->h_ifname); 347| 0| goto malformed; 348| 0| } 349| 46| PEEK_BYTES(seg, sizeof(seg)); ------------------ | | 66| 46| do { \ | | 67| 46| memcpy(value, pos, bytes); \ | | 68| 46| length -= (bytes); \ | | 69| 46| pos += (bytes); \ | | 70| 46| } while (0) | | ------------------ | | | Branch (70:12): [Folded, False: 46] | | ------------------ ------------------ 350| 46| rchassis = PEEK_UINT8; ------------------ | | 62| 46|#define PEEK_UINT8 PEEK(types.f_uint8, ) | | ------------------ | | | | 60| 46| (memcpy(&type, pos, sizeof(type)), length -= sizeof(type), pos += sizeof(type), \ | | | | 61| 46| func(type)) | | ------------------ ------------------ 351| 4.20k| for (i = 0; sonmp_chassis_types[i].type != 0; i++) { ------------------ | Branch (351:14): [True: 4.18k, False: 18] ------------------ 352| 4.18k| if (sonmp_chassis_types[i].type == rchassis) break; ------------------ | Branch (352:7): [True: 28, False: 4.15k] ------------------ 353| 4.18k| } 354| 46| if (asprintf(&chassis->c_descr, "%s", sonmp_chassis_types[i].description) == ------------------ | Branch (354:6): [True: 0, False: 46] ------------------ 355| 46| -1) { 356| 0| log_warnx("sonmp", "unable to write chassis description for %s", 357| 0| hardware->h_ifname); 358| 0| goto malformed; 359| 0| } 360| 46| mgmt = lldpd_alloc_mgmt(LLDPD_AF_IPV4, &address, sizeof(struct in_addr), 0); 361| 46| if (mgmt == NULL) { ------------------ | Branch (361:6): [True: 0, False: 46] ------------------ 362| 0| if (errno == ENOMEM) ------------------ | Branch (362:7): [True: 0, False: 0] ------------------ 363| 0| log_warn("sonmp", 364| 0| "unable to allocate memory for management address"); 365| 0| else 366| 0| log_warn("sonmp", "too large management address received on %s", 367| 0| hardware->h_ifname); 368| 0| goto malformed; 369| 0| } 370| 46| TAILQ_INSERT_TAIL(&chassis->c_mgmt, mgmt, m_entries); ------------------ | Branch (370:2): [Folded, False: 46] ------------------ 371| 46| port->p_ttl = 372| 46| cfg ? (cfg->g_config.c_tx_interval * cfg->g_config.c_tx_hold) : LLDPD_TTL; ------------------ | | 69| 46|#define LLDPD_TTL LLDPD_TX_INTERVAL *LLDPD_TX_HOLD | | ------------------ | | | | 67| 46|#define LLDPD_TX_INTERVAL 30 | | ------------------ | | #define LLDPD_TTL LLDPD_TX_INTERVAL *LLDPD_TX_HOLD | | ------------------ | | | | 68| 92|#define LLDPD_TX_HOLD 4 | | ------------------ ------------------ | Branch (372:6): [True: 0, False: 46] ------------------ 373| 46| port->p_ttl = MIN((port->p_ttl + 999) / 1000, 65535); ------------------ | Branch (373:16): [True: 46, False: 0] ------------------ 374| | 375| 46| port->p_id_subtype = LLDP_PORTID_SUBTYPE_LOCAL; ------------------ | | 47| 46|#define LLDP_PORTID_SUBTYPE_LOCAL 7 ------------------ 376| | 377| 46| port->p_id_len = 378| 46| asprintf(&port->p_id, "%02x-%02x-%02x", seg[0], seg[1], seg[2]); 379| 46| if (port->p_id_len == -1) { ------------------ | Branch (379:6): [True: 0, False: 46] ------------------ 380| 0| log_warn("sonmp", "unable to allocate memory for port id on %s", 381| 0| hardware->h_ifname); 382| 0| goto malformed; 383| 0| } 384| | 385| | /* Port description depend on the number of segments */ 386| 46| if ((seg[0] == 0) && (seg[1] == 0)) { ------------------ | Branch (386:6): [True: 20, False: 26] | Branch (386:23): [True: 8, False: 12] ------------------ 387| 8| if (asprintf(&port->p_descr, "port %d", seg[2]) == -1) { ------------------ | Branch (387:7): [True: 0, False: 8] ------------------ 388| 0| log_warnx("sonmp", "unable to write port description for %s", 389| 0| hardware->h_ifname); 390| 0| goto malformed; 391| 0| } 392| 38| } else if (seg[0] == 0) { ------------------ | Branch (392:13): [True: 12, False: 26] ------------------ 393| 12| if (asprintf(&port->p_descr, "port %d/%d", seg[1], seg[2]) == -1) { ------------------ | Branch (393:7): [True: 0, False: 12] ------------------ 394| 0| log_warnx("sonmp", "unable to write port description for %s", 395| 0| hardware->h_ifname); 396| 0| goto malformed; 397| 0| } 398| 26| } else { 399| 26| if (asprintf(&port->p_descr, "port %x:%x:%x", seg[0], seg[1], seg[2]) == ------------------ | Branch (399:7): [True: 0, False: 26] ------------------ 400| 26| -1) { 401| 0| log_warnx("sonmp", "unable to write port description for %s", 402| 0| hardware->h_ifname); 403| 0| goto malformed; 404| 0| } 405| 26| } 406| 46| *newchassis = chassis; 407| 46| *newport = port; 408| 46| return 1; 409| | 410| 88|malformed: 411| 88| lldpd_chassis_cleanup(chassis, 1); 412| 88| lldpd_port_cleanup(port, 1); 413| 88| free(port); 414| 88| return -1; 415| 46|} lldpd_chassis_mgmt_cleanup: 26| 134|{ 27| 134| struct lldpd_mgmt *mgmt, *mgmt_next; 28| | 29| 134| log_debug("alloc", "cleanup management addresses for chassis %s", 30| 134| chassis->c_name ? chassis->c_name : "(unknown)"); ------------------ | Branch (30:6): [True: 46, False: 88] ------------------ 31| | 32| 180| for (mgmt = TAILQ_FIRST(&chassis->c_mgmt); mgmt != NULL; mgmt = mgmt_next) { ------------------ | Branch (32:45): [True: 46, False: 134] ------------------ 33| 46| mgmt_next = TAILQ_NEXT(mgmt, m_entries); 34| 46| free(mgmt); 35| 46| } 36| | TAILQ_INIT(&chassis->c_mgmt); ------------------ | Branch (36:2): [Folded, False: 134] ------------------ 37| 134|} lldpd_chassis_cleanup: 41| 134|{ 42| 134| lldpd_chassis_mgmt_cleanup(chassis); 43| 134| log_debug("alloc", "cleanup chassis %s", 44| 134| chassis->c_name ? chassis->c_name : "(unknown)"); ------------------ | Branch (44:6): [True: 46, False: 88] ------------------ 45| 134|#ifdef ENABLE_LLDPMED 46| 134| free(chassis->c_med_hw); 47| 134| free(chassis->c_med_sw); 48| 134| free(chassis->c_med_fw); 49| 134| free(chassis->c_med_sn); 50| 134| free(chassis->c_med_manuf); 51| 134| free(chassis->c_med_model); 52| 134| free(chassis->c_med_asset); 53| 134|#endif 54| 134| free(chassis->c_id); 55| 134| free(chassis->c_name); 56| 134| free(chassis->c_descr); 57| 134| if (all) free(chassis); ------------------ | Branch (57:6): [True: 134, False: 0] ------------------ 58| 134|} lldpd_vlan_cleanup: 63| 134|{ 64| 134| struct lldpd_vlan *vlan, *vlan_next; 65| 134| for (vlan = TAILQ_FIRST(&port->p_vlans); vlan != NULL; vlan = vlan_next) { ------------------ | Branch (65:43): [True: 0, False: 134] ------------------ 66| 0| free(vlan->v_name); 67| 0| vlan_next = TAILQ_NEXT(vlan, v_entries); 68| 0| free(vlan); 69| 0| } 70| | TAILQ_INIT(&port->p_vlans); ------------------ | Branch (70:2): [Folded, False: 134] ------------------ 71| 134| port->p_pvid = 0; 72| 134|} lldpd_ppvid_cleanup: 76| 134|{ 77| 134| struct lldpd_ppvid *ppvid, *ppvid_next; 78| 134| for (ppvid = TAILQ_FIRST(&port->p_ppvids); ppvid != NULL; ppvid = ppvid_next) { ------------------ | Branch (78:45): [True: 0, False: 134] ------------------ 79| 0| ppvid_next = TAILQ_NEXT(ppvid, p_entries); 80| 0| free(ppvid); 81| 0| } 82| | TAILQ_INIT(&port->p_ppvids); ------------------ | Branch (82:2): [Folded, False: 134] ------------------ 83| 134|} lldpd_pi_cleanup: 87| 134|{ 88| 134| struct lldpd_pi *pi, *pi_next; 89| 134| for (pi = TAILQ_FIRST(&port->p_pids); pi != NULL; pi = pi_next) { ------------------ | Branch (89:40): [True: 0, False: 134] ------------------ 90| 0| free(pi->p_pi); 91| 0| pi_next = TAILQ_NEXT(pi, p_entries); 92| 0| free(pi); 93| 0| } 94| | TAILQ_INIT(&port->p_pids); ------------------ | Branch (94:2): [Folded, False: 134] ------------------ 95| 134|} lldpd_custom_list_cleanup: 141| 134|{ 142| 134| struct lldpd_custom *custom, *custom_next; 143| 134| for (custom = TAILQ_FIRST(&port->p_custom_list); custom != NULL; ------------------ | Branch (143:51): [True: 0, False: 134] ------------------ 144| 134| custom = custom_next) { 145| 0| custom_next = TAILQ_NEXT(custom, next); 146| 0| free(custom->oui_info); 147| 0| free(custom); 148| 0| } 149| | TAILQ_INIT(&port->p_custom_list); ------------------ | Branch (149:2): [Folded, False: 134] ------------------ 150| 134|} lldpd_port_cleanup: 196| 134|{ 197| 134|#ifdef ENABLE_LLDPMED 198| 134| int i; 199| 134| if (all) ------------------ | Branch (199:6): [True: 134, False: 0] ------------------ 200| 536| for (i = 0; i < LLDP_MED_LOCFORMAT_LAST; i++) ------------------ | | 301| 536|#define LLDP_MED_LOCFORMAT_LAST LLDP_MED_LOCFORMAT_ELIN | | ------------------ | | | | 300| 536|#define LLDP_MED_LOCFORMAT_ELIN 3 | | ------------------ ------------------ | Branch (200:15): [True: 402, False: 134] ------------------ 201| 402| free(port->p_med_location[i].data); 202| 134|#endif 203| 134|#ifdef ENABLE_DOT1 204| 134| lldpd_vlan_cleanup(port); 205| 134| lldpd_ppvid_cleanup(port); 206| 134| lldpd_pi_cleanup(port); 207| 134|#endif 208| | /* will set these to NULL so we don't free wrong memory */ 209| | 210| 134| if (all) { ------------------ | Branch (210:6): [True: 134, False: 0] ------------------ 211| 134| free(port->p_id); 212| 134| port->p_id = NULL; 213| 134| free(port->p_descr); 214| 134| port->p_descr = NULL; 215| 134| free(port->p_lastframe); 216| 134| if (port->p_chassis) { /* chassis may not have been attributed, yet */ ------------------ | Branch (216:7): [True: 0, False: 134] ------------------ 217| 0| port->p_chassis->c_refcount--; 218| 0| port->p_chassis = NULL; 219| 0| } 220| 134| free(port->p_vlan_advertise_pattern); 221| | port->p_vlan_advertise_pattern = NULL; 222| 134|#ifdef ENABLE_CUSTOM 223| 134| lldpd_custom_list_cleanup(port); 224| 134|#endif 225| 134| } 226| 134|} log_register: 64| 134|{ 65| 134| logh = cb; 66| 134|} log_warnx: 214| 12|{ 215| 12| va_list ap; 216| | 217| 12| va_start(ap, emsg); 218| 12| vlog(LOG_WARNING, token, emsg, ap); 219| | va_end(ap); 220| 12|} log_debug: 247| 474|{ 248| 474| va_list ap; 249| | 250| 474| if ((debug > 1 && log_debug_accept_token(token)) || logh) { ------------------ | Branch (250:7): [True: 0, False: 474] | Branch (250:20): [True: 0, False: 0] | Branch (250:54): [True: 474, False: 0] ------------------ 251| 474| va_start(ap, emsg); 252| 474| vlog(LOG_DEBUG, token, emsg, ap); 253| | va_end(ap); 254| 474| } 255| 474|} log.c:vlog: 154| 486|{ 155| 486| if (logh) { ------------------ | Branch (155:6): [True: 486, False: 0] ------------------ 156| 486| char *result = NULL; 157| 486| if (vasprintf(&result, fmt, ap) != -1) { ------------------ | Branch (157:7): [True: 486, False: 0] ------------------ 158| 486| logh(pri, result); 159| 486| free(result); 160| 486| return; 161| 486| } 162| | /* Otherwise, abort. We don't know if "ap" is still OK. We could 163| | * have made a copy, but this is too much overhead for a 164| | * situation that shouldn't happen. */ 165| 0| return; 166| 486| } 167| | 168| | /* Log to syslog if requested */ 169| 0| if (use_syslog) { ------------------ | Branch (169:6): [True: 0, False: 0] ------------------ 170| 0| va_list ap2; 171| 0| va_copy(ap2, ap); 172| 0| vsyslog(pri, fmt, ap2); 173| 0| va_end(ap2); 174| 0| } 175| | 176| | /* Log to standard error in all cases. Format the caller's message 177| | * first so it is not re-interpreted as a format string by the 178| | * surrounding fprintf. */ 179| 0| char *body = NULL; 180| 0| if (vasprintf(&body, fmt, ap) == -1) body = NULL; ------------------ | Branch (180:6): [True: 0, False: 0] ------------------ 181| 0| fprintf(stderr, "%s %s%s%s]%s %s\n", date(), translate(STDERR_FILENO, pri), 182| 0| token ? "/" : "", token ? token : "", ------------------ | Branch (182:6): [True: 0, False: 0] | Branch (182:24): [True: 0, False: 0] ------------------ 183| 0| isatty(STDERR_FILENO) ? "\033[0m" : "", body ? body : fmt); ------------------ | Branch (183:6): [True: 0, False: 0] | Branch (183:46): [True: 0, False: 0] ------------------ 184| 0| free(body); 185| | fflush(stderr); 186| 0|} donothing: 24| 486|void donothing(int pri, const char *msg) {}; LLVMFuzzerTestOneInput: 28| 160|{ 29| 160| if (Size < kMinInputLength || Size > kMaxInputLength) { ------------------ | | 20| 320|#define kMinInputLength 5 ------------------ if (Size < kMinInputLength || Size > kMaxInputLength) { ------------------ | | 21| 156|#define kMaxInputLength 2048 ------------------ | Branch (29:6): [True: 4, False: 156] | Branch (29:32): [True: 22, False: 134] ------------------ 30| 26| return 1; 31| 26| } 32| | 33| 134| struct lldpd_chassis *nchassis = NULL; 34| 134| struct lldpd_port *nport = NULL; 35| 134| struct lldpd_hardware hardware; 36| | 37| 134| log_register(donothing); 38| | 39| 134| sonmp_decode(NULL, (char *)Data, Size, &hardware, &nchassis, &nport); 40| | 41| 134| if (!nchassis || !nport) { ------------------ | Branch (41:6): [True: 88, False: 46] | Branch (41:19): [True: 0, False: 46] ------------------ 42| 88| return 1; 43| 88| } 44| | 45| 46| lldpd_port_cleanup(nport, 1); 46| 46| free(nport); 47| 46| lldpd_chassis_cleanup(nchassis, 1); 48| | 49| 46| return 0; 50| 134|}