From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 4CA9C46B1F; Mon, 7 Jul 2025 11:13:00 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id D46C940287; Mon, 7 Jul 2025 11:12:59 +0200 (CEST) Received: from inbox.dpdk.org (inbox.dpdk.org [95.142.172.178]) by mails.dpdk.org (Postfix) with ESMTP id DBF804025D for ; Mon, 7 Jul 2025 11:12:57 +0200 (CEST) Received: by inbox.dpdk.org (Postfix, from userid 33) id A710846B20; Mon, 7 Jul 2025 11:12:57 +0200 (CEST) From: bugzilla@dpdk.org To: dev@dpdk.org Subject: [DPDK/other Bug 1748] Clarification on Possible Buffer Overflow Issues Reported by Fortify Tool Date: Mon, 07 Jul 2025 09:12:57 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: DPDK X-Bugzilla-Component: other X-Bugzilla-Version: 23.11 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: nagendra.balagani@oracle.com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: Normal X-Bugzilla-Assigned-To: dev@dpdk.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter target_milestone Message-ID: Content-Type: multipart/alternative; boundary=17518795770.2d8FC7.4194189 Content-Transfer-Encoding: 7bit X-Bugzilla-URL: https://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org --17518795770.2d8FC7.4194189 Date: Mon, 7 Jul 2025 11:12:57 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All https://bugs.dpdk.org/show_bug.cgi?id=3D1748 Bug ID: 1748 Summary: Clarification on Possible Buffer Overflow Issues Reported by Fortify Tool Product: DPDK Version: 23.11 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: Normal Component: other Assignee: dev@dpdk.org Reporter: nagendra.balagani@oracle.com Target Milestone: --- Hello Team, While running Fortify static analysis on our code base that uses DPDK, we observed some potential buffer overflow issues being reported within DPDK library calls. At first glance, these instances appear to be false positive= s, but we would like to confirm with the community and maintainers to ensure t= here are no hidden risks. Could you please help review these findings or suggest if there are any kno= wn false positives in this area? here are the detailed Fortify reports with exact file paths and line numbers for your reference. ### Instance 1: rte_crypto.h Line 207 memset(op->asym, 0, sizeof(struct rte_crypto_asym_op)); Tool Description : The function __rte_crypto_op_reset() in rte_crypto.h wri= tes outside the bounds of asym on line 207, which could corrupt data, cause the program to crash, or lead to the execution of malicious code. Analysis Trace rte_crypto.h:181 - Buffer asym Declared rte_crypto.h:207 - memset() Buffer Size: 0 bytes Write Length: 168 bytes ### Instance 2: rte_crypto_sym.h: 885 memset(op, 0, sizeof(*op)); Tool Description: The program writes outside the bounds of allocated memory, which could corrupt data, crash the program, or lead to the execution of malicious code. Analysis Trace rte_crypto.h:204 - Caller: __rte_crypto_op_reset Buffer Size: 0 rte_crypto_sym.h:885 - memset() Buffer Size: 0 bytes Write Length: 64 bytes [var 0] op.$offset: 0 ### Instance3: rte_lpm.h: 347 tbl24_indexes[i] =3D ips[i] >> 8; Tool Description: The function rte_lpm_lookup_bulk_func() in rte_lpm.h writ= es outside the bounds of tbl24_indexes on line 347, which could corrupt data, cause the program to crash, or lead to the execution of malicious code. Analysis Trace rte_lpm.h:339 - Buffer tbl24_indexes Allocated rte_lpm.h:347 - Assignment to tbl24_indexes Buffer Size: 262143 bytes Write Length: 1048572 bytes [var 0] tbl24_indexes.$offset: 0 [var 1] i: 262142 Thank you in advance for your support and guidance. Regards, Nagendra --=20 You are receiving this mail because: You are the assignee for the bug.= --17518795770.2d8FC7.4194189 Date: Mon, 7 Jul 2025 11:12:57 +0200 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All
Bug ID 1748
Summary Clarification on Possible Buffer Overflow Issues Reported by = Fortify Tool
Product DPDK
Version 23.11
Hardware All
OS All
Status UNCONFIRMED
Severity normal
Priority Normal
Component other
Assignee dev@dpdk.org
Reporter nagendra.balagani@oracle.com
Target Milestone --- 

Hello Team,

While running Fortify static analysis on our code base that uses DPDK, we
observed some potential buffer overflow issues being reported within DPDK
library calls. At first glance, these instances appear to be false positive=
s,
but we would like to confirm with the community and maintainers to ensure t=
here
are no hidden risks.
Could you please help review these findings or suggest if there are any kno=
wn
false positives in this area?

here are the detailed Fortify reports with exact file paths and line numbers
for your reference.

### Instance 1:  rte_crypto.h Line 207
memset(op->asym, 0, sizeof(struct rte_crypto_asym_op));

Tool Description : The function __rte_crypto_op_reset() in rte_crypto.h wri=
tes
outside the bounds of asym on line 207, which could corrupt data, cause the
program to crash, or lead to the execution of malicious code.

Analysis Trace
rte_crypto.h:181 - Buffer asym Declared
rte_crypto.h:207 - memset()
Buffer Size: 0 bytes Write Length: 168 bytes


### Instance 2: rte_crypto_sym.h: 885
memset(op, 0, sizeof(*op));

Tool Description: The program writes outside the bounds of allocated memory,
which could corrupt data, crash the program, or lead to the execution of
malicious code.

Analysis Trace
rte_crypto.h:204 - Caller: __rte_crypto_op_reset
Buffer Size: 0
rte_crypto_sym.h:885 - memset()
Buffer Size: 0 bytes Write Length: 64 bytes [var 0] op.$offset: 0


### Instance3: rte_lpm.h: 347
            tbl24_indexes[i] =3D ips[i] >> 8;

Tool Description: The function rte_lpm_lookup_bulk_func() in rte_lpm.h writ=
es
outside the bounds of tbl24_indexes on line 347, which could corrupt data,
cause the program to crash, or lead to the execution of malicious code.

Analysis Trace
rte_lpm.h:339 - Buffer tbl24_indexes Allocated
rte_lpm.h:347 - Assignment to tbl24_indexes
Buffer Size: 262143 bytes Write Length: 1048572 bytes [var 0]
tbl24_indexes.$offset: 0 [var 1] i: 262142


Thank you in advance for your support and guidance.

Regards,
Nagendra

You are receiving this mail because:
  • You are the assignee for the bug.
=20=20=20=20=20=20=20=20=20=20
= --17518795770.2d8FC7.4194189--