From: Tetsuya Murakami <tetsuya.mrk@gmail.com>
Date: Sun, 22 Mar 2020 20:19:43 +0000 (-0700)
Subject: srv6-mobile: Fix the coverity issues
X-Git-Tag: v20.09-rc0~356
X-Git-Url: https://gerrit.fd.io/r/gitweb?p=vpp.git;a=commitdiff_plain;h=c33c0ec96cfb2e82fc0f1ec952796c86a56a8064

srv6-mobile: Fix the coverity issues

Fix for the coverity issues.

Type: fix

Signed-off-by: Tetsuya Murakami <tetsuya.mrk@gmail.com>
Change-Id: I6bf8a874a9a94b9b7d62da047a401eda8a448567
Signed-off-by: Tetsuya Murakami <tetsuya.mrk@gmail.com>
---

diff --git a/src/plugins/srv6-mobile/node.c b/src/plugins/srv6-mobile/node.c
index 6d3240e77c4..d79ad707232 100644
--- a/src/plugins/srv6-mobile/node.c
+++ b/src/plugins/srv6-mobile/node.c
@@ -768,7 +768,7 @@ VLIB_NODE_FN (srv6_t_m_gtp4_d) (vlib_main_t * vm,
 	      u32 offset, shift, index;
 	      ip6srv_combo_header_t *ip6srv;
 	      gtpu_pdu_session_t *sess = NULL;
-	      u16 ie_size = 0;
+	      int ie_size = 0;
 	      u16 tlv_siz = 0;
 	      u8 ie_buf[GTPU_IE_MAX_SIZ];
 
@@ -901,16 +901,18 @@ VLIB_NODE_FN (srv6_t_m_gtp4_d) (vlib_main_t * vm,
 		  u16 payload_len;
 
 		  payload_len = clib_net_to_host_u16 (hdr->gtpu.length);
-		  if (payload_len != 0
-		      && payload_len > hdr_len - sizeof (ip4_gtpu_header_t))
+		  if (payload_len != 0)
 		    {
-		      u8 *ies;
-
-		      ies = (u8 *) ((u8 *) hdr + hdr_len);
 		      ie_size =
 			payload_len - (hdr_len - sizeof (ip4_gtpu_header_t));
-		      clib_memcpy_fast (ie_buf, ies, ie_size);
-		      hdr_len += ie_size;
+		      if (ie_size > 0)
+			{
+			  u8 *ies;
+
+			  ies = (u8 *) ((u8 *) hdr + hdr_len);
+			  clib_memcpy_fast (ie_buf, ies, ie_size);
+			  hdr_len += ie_size;
+			}
 		    }
 		}
 
@@ -1163,15 +1165,15 @@ VLIB_NODE_FN (srv6_t_m_gtp4_d) (vlib_main_t * vm,
 		  tlv =
 		    (ip6_sr_tlv_t *) ((u8 *) ip6srv + (hdr_len - tlv_siz));
 		  tlv->type = SRH_TLV_USER_PLANE_CONTAINER;
-		  tlv->length = tlv_siz - sizeof (ip6_sr_tlv_t);
+		  tlv->length = (u8) (tlv_siz - sizeof (ip6_sr_tlv_t));
 		  clib_memset (tlv->value, 0, tlv->length);
 
 		  sub_tlv = (user_plane_sub_tlv_t *) tlv->value;
 		  sub_tlv->type = USER_PLANE_SUB_TLV_IE;
-		  sub_tlv->length = ie_size;
+		  sub_tlv->length = (u8) ie_size;
 		  clib_memcpy_fast (sub_tlv->value, ie_buf, ie_size);
 
-		  ip6srv->sr.length += tlv_siz / 8;
+		  ip6srv->sr.length += (u8) (tlv_siz / 8);
 		}
 
 	      ip6srv->ip.payload_length =
@@ -1609,7 +1611,7 @@ VLIB_NODE_FN (srv6_end_m_gtp6_d) (vlib_main_t * vm,
 	  u32 hdrlen;
 	  ip6_header_t *encap = NULL;
 	  gtpu_pdu_session_t *sess = NULL;
-	  u16 ie_size = 0;
+	  int ie_size = 0;
 	  u16 tlv_siz = 0;
 	  u8 ie_buf[GTPU_IE_MAX_SIZ];
 
@@ -1760,16 +1762,18 @@ VLIB_NODE_FN (srv6_end_m_gtp6_d) (vlib_main_t * vm,
 		  u16 payload_len;
 
 		  payload_len = clib_net_to_host_u16 (hdr0->gtpu.length);
-		  if (payload_len != 0
-		      && payload_len > hdrlen - sizeof (ip6_gtpu_header_t))
+		  if (payload_len != 0)
 		    {
-		      u8 *ies;
-
-		      ies = (u8 *) ((u8 *) hdr0 + hdrlen);
 		      ie_size =
 			payload_len - (hdrlen - sizeof (ip6_gtpu_header_t));
-		      clib_memcpy_fast (ie_buf, ies, ie_size);
-		      hdrlen += ie_size;
+		      if (ie_size > 0)
+			{
+			  u8 *ies;
+
+			  ies = (u8 *) ((u8 *) hdr0 + hdrlen);
+			  clib_memcpy_fast (ie_buf, ies, ie_size);
+			  hdrlen += ie_size;
+			}
 		    }
 		}
 
@@ -2011,15 +2015,15 @@ VLIB_NODE_FN (srv6_end_m_gtp6_d) (vlib_main_t * vm,
 		  tlv =
 		    (ip6_sr_tlv_t *) ((u8 *) ip6srv + (hdr_len - tlv_siz));
 		  tlv->type = SRH_TLV_USER_PLANE_CONTAINER;
-		  tlv->length = tlv_siz - sizeof (ip6_sr_tlv_t);
+		  tlv->length = (u8) (tlv_siz - sizeof (ip6_sr_tlv_t));
 		  clib_memset (tlv->value, 0, tlv->length);
 
 		  sub_tlv = (user_plane_sub_tlv_t *) tlv->value;
 		  sub_tlv->type = USER_PLANE_SUB_TLV_IE;
-		  sub_tlv->length = ie_size;
+		  sub_tlv->length = (u8) ie_size;
 		  clib_memcpy_fast (sub_tlv->value, ie_buf, ie_size);
 
-		  ip6srv->sr.length += tlv_siz / 8;
+		  ip6srv->sr.length += (u8) (tlv_siz / 8);
 		}
 
 	      ip6srv->ip.payload_length =
@@ -2112,7 +2116,7 @@ VLIB_NODE_FN (srv6_end_m_gtp6_d_di) (vlib_main_t * vm,
 	  u32 hdrlen;
 	  ip6_header_t *encap = NULL;
 	  gtpu_pdu_session_t *sess;
-	  u16 ie_size = 0;
+	  int ie_size = 0;
 	  u16 tlv_siz = 0;
 	  u8 ie_buf[GTPU_IE_MAX_SIZ];
 
@@ -2262,16 +2266,18 @@ VLIB_NODE_FN (srv6_end_m_gtp6_d_di) (vlib_main_t * vm,
 		  u16 payload_len;
 
 		  payload_len = clib_net_to_host_u16 (hdr0->gtpu.length);
-		  if (payload_len != 0
-		      && payload_len > hdrlen - sizeof (ip6_gtpu_header_t))
+		  if (payload_len != 0)
 		    {
-		      u8 *ies;
-
-		      ies = (u8 *) ((u8 *) hdr0 + hdrlen);
 		      ie_size =
 			payload_len - (hdrlen - sizeof (ip6_gtpu_header_t));
-		      clib_memcpy_fast (ie_buf, ies, ie_size);
-		      hdrlen += ie_size;
+		      if (ie_size > 0)
+			{
+			  u8 *ies;
+
+			  ies = (u8 *) ((u8 *) hdr0 + hdrlen);
+			  clib_memcpy_fast (ie_buf, ies, ie_size);
+			  hdrlen += ie_size;
+			}
 		    }
 		}
 
@@ -2417,14 +2423,14 @@ VLIB_NODE_FN (srv6_end_m_gtp6_d_di) (vlib_main_t * vm,
 		  tlv =
 		    (ip6_sr_tlv_t *) ((u8 *) ip6srv + (hdr_len - tlv_siz));
 		  tlv->type = SRH_TLV_USER_PLANE_CONTAINER;
-		  tlv->length = tlv_siz - sizeof (ip6_sr_tlv_t);
+		  tlv->length = (u8) (tlv_siz - sizeof (ip6_sr_tlv_t));
 		  clib_memset (tlv->value, 0, tlv->length);
 
 		  sub_tlv = (user_plane_sub_tlv_t *) tlv->value;
-		  sub_tlv->length = ie_size;
+		  sub_tlv->length = (u8) (ie_size);
 		  clib_memcpy_fast (sub_tlv->value, ie_buf, ie_size);
 
-		  ip6srv->sr.length += tlv_siz / 8;
+		  ip6srv->sr.length += (u8) (tlv_siz / 8);
 		}
 
 	      ip6srv->ip.payload_length =