Fixes 2026 03

src/dpipe.c

@@ -57,7 +57,7 @@ static void alternate_fd()
 {
 	char numstr[10];
 	alternate_stdin=open("/dev/null",O_RDONLY);
-	alternate_stdout=open("/dev/null",O_RDONLY);
+	alternate_stdout=open("/dev/null",O_WRONLY);
 	close(alternate_stdin);
 	close(alternate_stdout);
 	snprintf(numstr,10,"%d",alternate_stdin);

src/vde_autolink.c

@@ -410,13 +410,15 @@ void insert_job(void (*f)(struct autolink *al), struct autolink *al, int gap)
 
 	/* remove other jobs for same alink, if any */
 	while(j){
+		struct job *next = j->n;
 		if (al == j->al) {
 			if (jq == j) jq=j->n;
 			else pj->n=j->n;
 			free(j);
 		}
-		pj = j;
-		j = j->n;
+		else
+			pj = j;
+		j = next;
 	}
 
 	/* insert job, ordered by time */
@@ -1475,4 +1477,3 @@ int main(int argc,char **argv)
 
 	}
 }
-

src/vde_plug2tap.c

@@ -384,8 +384,13 @@ int main(int argc, char **argv)
 	}
 
 	for(;;) {
-		poll(pollv,3,-1);
-		if ((pollv[0].revents | pollv[1].revents | pollv[2].revents) & POLLHUP ||
+		int hup_revents;
+
+		poll(pollv,npollv,-1);
+		hup_revents = pollv[0].revents | pollv[1].revents;
+		if (npollv > 2)
+			hup_revents |= pollv[2].revents;
+		if ((hup_revents & POLLHUP) ||
 				(npollv > 2 && pollv[2].revents & POLLIN)) 
 			break;
 		if (pollv[0].revents & POLLIN) {

src/vde_router/vder_arp.c

@@ -136,28 +136,14 @@ int vder_parse_arp(struct vder_iface *vif, struct vde_buff *vdb)
 struct vder_arp_entry *vder_arp_get_record_by_macaddr(struct vder_iface *vif, uint8_t *mac)
 {
 	struct rb_node *node;
-	struct vder_arp_entry *found=NULL;
-	node = vif->arp_table.rb_node;
-	while(node) {
-		struct vder_arp_entry *entry = rb_entry(node, struct vder_arp_entry, rb_node);
-		if (memcmp(entry->macaddr, mac, ETHERNET_ADDRESS_SIZE) == 0) {
-			found = entry;
-			break;
-		}
-		node = node->rb_left;
-	}
-	if (found)
-		return found;
-	node = vif->arp_table.rb_node;
-	while(node) {
+
+	for (node = rb_first(&vif->arp_table); node; node = rb_next(node)) {
 		struct vder_arp_entry *entry = rb_entry(node, struct vder_arp_entry, rb_node);
-		if (memcmp(entry->macaddr, mac, ETHERNET_ADDRESS_SIZE) == 0) {
-			found = entry;
-			break;
-		}
-		node = node->rb_right;
+		if (memcmp(entry->macaddr, mac, ETHERNET_ADDRESS_SIZE) == 0)
+			return entry;
 	}
-	return found;
+
+	return NULL;
 }
 
 int vder_arp_get_neighbors(struct vder_iface *vif, uint32_t *neighbors, int vector_size)
@@ -167,24 +153,12 @@ int vder_arp_get_neighbors(struct vder_iface *vif, uint32_t *neighbors, int vect
 	if (vector_size <= 0)
 		return -EINVAL;
 
-	node = vif->arp_table.rb_node;
-	while(node) {
+	for (node = rb_first(&vif->arp_table); node; node = rb_next(node)) {
 		struct vder_arp_entry *entry = rb_entry(node, struct vder_arp_entry, rb_node);
 		neighbors[i++] = entry->ipaddr;
 		if (i == vector_size)
 			return i;
-		node = node->rb_left;
-	}
-	node = vif->arp_table.rb_node;
-	if (!node)
-		return i;
-	node = node->rb_right;
-	while(node) {
-		struct vder_arp_entry *entry = rb_entry(node, struct vder_arp_entry, rb_node);
-		neighbors[i++] = entry->ipaddr;
-		if (i == vector_size)
-			return i;
-		node = node->rb_right;
 	}
+
 	return i;
 }

src/vde_router/vder_datalink.c

@@ -396,6 +396,7 @@ int vder_iface_address_del(struct vder_iface *iface, uint32_t addr)
 	uint32_t netmask = 0U;
 	pthread_mutex_lock(&Router.global_config_lock);
 	while(cur) {
+		struct vder_ip4address *next = cur->next;
 		if (cur->address == addr) {
 			if (prev) {
 				prev->next = cur->next;
@@ -404,9 +405,10 @@ int vder_iface_address_del(struct vder_iface *iface, uint32_t addr)
 			}
 			netmask = cur->netmask;
 			free(cur);
+			break;
 		}
 		prev = cur;
-		cur = cur->next;
+		cur = next;
 	}
 	pthread_mutex_unlock(&Router.global_config_lock);
 

src/vde_router/vder_dhcp.c

@@ -37,7 +37,7 @@ static uint8_t dhcp_get_next_option(uint8_t *begin, uint8_t *data, int *len, uin
 	*nextopt = ++p;
 	if ((type == DHCPOPT_END) || (type == DHCPOPT_PAD)) {
 		memset(data, 0, *len);
-		len = 0;
+		*len = 0;
 		return type;
 	}
 	opt_len = *p;

src/vde_router/vder_icmp.c

@@ -69,21 +69,27 @@ int vder_icmp_filter(uint32_t dst, uint8_t *foot)
 int vder_icmp_recv(struct vde_buff *vdb)
 {
 	struct icmp *ich;
-	struct iphdr *iph;
-	uint32_t tmp_ipaddr;
-	struct vde_buff *vdb_copy = malloc(vdb->len + sizeof(struct vde_buff));
 	ich = (struct icmp *) payload(vdb);
-	iph = iphead(vdb);
 	if (ich->icmp_type == ICMP_ECHO){
-		tmp_ipaddr = iph->saddr;
-		iph->saddr = iph->daddr;
-		iph->daddr = tmp_ipaddr;
-		ich->icmp_type = ICMP_ECHOREPLY;
-		ich->icmp_cksum = 0;
-		ich->icmp_cksum = htons(net_checksum(payload(vdb), vdb->len - sizeof(struct iphdr) - 14));
-		iph->check = htons(vder_ip_checksum(iph));
+		struct vde_buff *vdb_copy = malloc(vdb->len + sizeof(struct vde_buff));
+		struct icmp *ich_copy;
+		struct iphdr *iph_copy;
+		uint32_t tmp_ipaddr;
+
+		if (!vdb_copy)
+			return -1;
+		memcpy(vdb_copy, vdb, sizeof(struct vde_buff) + vdb->len);
+
+		ich_copy = (struct icmp *) payload(vdb_copy);
+		iph_copy = iphead(vdb_copy);
+		tmp_ipaddr = iph_copy->saddr;
+		iph_copy->saddr = iph_copy->daddr;
+		iph_copy->daddr = tmp_ipaddr;
+		ich_copy->icmp_type = ICMP_ECHOREPLY;
+		ich_copy->icmp_cksum = 0;
+		ich_copy->icmp_cksum = htons(net_checksum(payload(vdb_copy), vdb_copy->len - sizeof(struct iphdr) - 14));
+		iph_copy->check = htons(vder_ip_checksum(iph_copy));
+		vder_packet_send(vdb_copy, iph_copy->daddr, PROTO_ICMP);
 	}
-	memcpy(vdb_copy, vdb, sizeof(struct vde_buff) + vdb->len);
-	vder_packet_send(vdb_copy, iph->daddr, PROTO_ICMP);
 	return 0;
 }

src/vde_router/vder_packet.c

@@ -197,7 +197,7 @@ void vder_packet_recv(struct vder_iface *vif, int timeout)
 
 			if (vder_ip_input(packet)) {
 				/* If the packet is for us, process it here. */
-				//free(packet);
+				free(packet);
 				return;
 			} else {
 				struct iphdr *hdr = iphead(packet);

src/vde_router/vder_queue.c

@@ -140,7 +140,7 @@ int qred_may_enqueue(struct vder_queue *q, struct vde_buff *b)
 		return 1;
 	} else if (q->policy_opt.red.max > q->size) {
 		red_probability = q->policy_opt.red.P *
-				((double)q->size - (double)q->policy_opt.red.min /
+				(((double)q->size - (double)q->policy_opt.red.min) /
 				((double)q->policy_opt.red.max - (double)q->policy_opt.red.min));
 	} else if (q->policy_opt.red.limit > q->size) {
 		red_probability = q->policy_opt.red.P;
@@ -199,4 +199,3 @@ void qtoken_setup(struct vder_queue *q, uint32_t bitrate, uint32_t limit)
 	q->may_enqueue = qtoken_may_enqueue;
 	pthread_mutex_unlock(&q->lock);
 }
-

src/vde_router/vder_udp.c

@@ -3,6 +3,7 @@
 #include "vder_udp.h"
 #include <stdio.h>
 #include <unistd.h>
+#include <limits.h>
 
 /* UDP header, rfc 768 */
 
@@ -18,21 +19,16 @@ int vder_udp_recv(struct vde_buff *buf)
 {
 	struct vder_udp_socket *cur = socket_list;
 	int found = 0;
-	struct vde_buff *copy = NULL;
 	uint16_t port = transport_dport(buf);
 
 	while(cur) {
 		if (cur->port == port) {
-			if (!found) {
-				enqueue(&cur->inq, buf);
-				found = 1;
-			} else {
-				copy = malloc(sizeof(struct vde_buff) + buf->len);
-				if (!copy)
-					break;
-				memcpy(copy, buf, sizeof(struct vde_buff) + buf->len);
-				enqueue(&cur->inq, copy);
-			}
+			struct vde_buff *copy = malloc(sizeof(struct vde_buff) + buf->len);
+			if (!copy)
+				break;
+			memcpy(copy, buf, sizeof(struct vde_buff) + buf->len);
+			enqueue(&cur->inq, copy);
+			found = 1;
 		}
 		cur = cur->next;
 	}
@@ -88,19 +84,30 @@ int vder_udpsocket_sendto(struct vder_udp_socket *sock, void *data, size_t len,
 	uint8_t *datagram;
 	struct vder_route *ro;
 	int bufsize;
-	if (len <= 0) {
+	size_t payload_len = len;
+	size_t udp_len;
+
+	if (payload_len <= 0) {
 		errno = EINVAL;
 		return -1;
 	}
-	len += sizeof(struct udphdr);
+	if (payload_len > INT_MAX) {
+		errno = EMSGSIZE;
+		return -1;
+	}
+	udp_len = payload_len + sizeof(struct udphdr);
+	if (udp_len > UINT16_MAX) {
+		errno = EMSGSIZE;
+		return -1;
+	}
 
 	ro = vder_get_route(dst);
 	if (!ro) {
 		errno = EHOSTUNREACH;
 		return -1;
 	}
 
-	bufsize = sizeof(struct vde_buff) + sizeof(struct vde_ethernet_header) + sizeof(struct iphdr) + sizeof(struct udphdr) + len;
+	bufsize = sizeof(struct vde_buff) + sizeof(struct vde_ethernet_header) + sizeof(struct iphdr) + udp_len;
 	b = malloc(bufsize);
 	if (!b)
 		return -1;
@@ -109,14 +116,14 @@ int vder_udpsocket_sendto(struct vder_udp_socket *sock, void *data, size_t len,
 	b->priority = PRIO_BESTEFFORT;
 	uh = (struct udphdr *) payload(b);
 	datagram = (uint8_t *)((payload(b) + sizeof(struct udphdr)));
-	memcpy(datagram, data, len);
+	memcpy(datagram, data, payload_len);
 
 	uh->sport = sock->port;
 	uh->dport = dstport;
-	uh->len = htons(len);
+	uh->len = htons(udp_len);
 	uh->crc = 0;
 	vder_packet_send(b, dst, PROTO_UDP);
-	return len;
+	return payload_len;
 }
 
 int vder_udpsocket_sendto_broadcast(struct vder_udp_socket *sock, void *data, size_t len,
@@ -126,13 +133,23 @@ int vder_udpsocket_sendto_broadcast(struct vder_udp_socket *sock, void *data, si
 	struct udphdr *uh;
 	uint8_t *datagram;
 	int bufsize;
+	size_t payload_len = len;
+	size_t udp_len;
 	if (len <= 0) {
 		errno = EINVAL;
 		return -1;
 	}
-	len += sizeof(struct udphdr);
+	if (payload_len > INT_MAX) {
+		errno = EMSGSIZE;
+		return -1;
+	}
+	udp_len = payload_len + sizeof(struct udphdr);
+	if (udp_len > UINT16_MAX) {
+		errno = EMSGSIZE;
+		return -1;
+	}
 
-	bufsize = sizeof(struct vde_buff) + sizeof(struct vde_ethernet_header) + sizeof(struct iphdr) + sizeof(struct udphdr) + len;
+	bufsize = sizeof(struct vde_buff) + sizeof(struct vde_ethernet_header) + sizeof(struct iphdr) + udp_len;
 	b = malloc(bufsize);
 	if (!b)
 		return -1;
@@ -141,14 +158,14 @@ int vder_udpsocket_sendto_broadcast(struct vder_udp_socket *sock, void *data, si
 	b->priority = PRIO_BESTEFFORT;
 	uh = (struct udphdr *) payload(b);
 	datagram = (uint8_t *)((payload(b) + sizeof(struct udphdr)));
-	memcpy(datagram, data, len);
+	memcpy(datagram, data, payload_len);
 
 	uh->sport = sock->port;
 	uh->dport = dstport;
-	uh->len = htons(len);
+	uh->len = htons(udp_len);
 	uh->crc = 0;
 	vder_packet_broadcast(b, iface, dst, PROTO_UDP);
-	return len;
+	return payload_len;
 }
 
 
@@ -183,5 +200,6 @@ int vder_udpsocket_recvfrom(struct vder_udp_socket *sock, void *data, size_t len
 		len = ntohs(uh->len) - sizeof (struct udphdr);
 	memcpy(data, datagram, len);
 	*fromport = uh->sport;
+	free(b);
 	return len;
 }

src/vde_switch/plugins/iplog.c

@@ -160,8 +160,8 @@ static void ip_find_in_hash_update(int len, unsigned char *addr, unsigned char *
 	struct ip_hash_entry *e;
 	int k = ip_hash(len, addr);
 	time_t now;
-	for(e = iph[k]; e && memcmp(e->ipaddr, addr, len) && e->len == len && 
-			e->vlan == vlan; e = e->next)
+	for(e = iph[k]; e && (e->len != len || e->vlan != vlan ||
+			memcmp(e->ipaddr, addr, len) != 0); e = e->next)
 		;
 	if(e == NULL) {
 		e = (struct ip_hash_entry *) malloc(sizeof(*e)+(len-4));

src/vde_switch/qtimer.c

@@ -73,7 +73,7 @@ unsigned int qtimer_add(time_t period,int times,void (*call)(),void *arg)
 		n=activeqt++;
 		if (qtf == NULL) {
 			qtf=malloc(sizeof(struct qt_timer));
-			if (qth == NULL) {
+			if (qtf == NULL) {
 				return -1;
 			}
 			/*all the fields but qt_arg get initialized */

src/vde_switch/vde_switch.c

@@ -126,7 +126,7 @@ unsigned char add_type(struct swmodule *mgr,int prio)
 			printlog(LOG_ERR,"realloc fdtypes %s",strerror(errno));
 			exit(1);
 		}
-		memset(fdtypes+ntypes,0,sizeof(struct swmodule *) * maxtypes-ntypes);
+		memset(fdtypes+ntypes,0,sizeof(struct swmodule *) * (maxtypes-ntypes));
 		i=ntypes;
 	} else
 		for(i=0; fdtypes[i] != NULL; i++)

src/vde_vxlan/vxlan.c

@@ -140,6 +140,7 @@ void vxlan_process() {
 	switch (dest_addr) {
 		case 0:
 			printlog(LOG_DEBUG, "Not found");
+			break;
 		case 1:
 			plug_send(&pkt.pkt,len-offsetof(struct vxlan_pkt,pkt));
 			printlog(LOG_DEBUG, "Send to VDE");