/usr/src/usr.bin/bgplg/bgpctl/../../../usr.sbin/bgpctl/mrtparser.c

Bug Summary

File:	src/usr.bin/bgplg/bgpctl/../../../usr.sbin/bgpctl/mrtparser.c
Warning:	line 574, column 15 Assigned value is garbage or undefined
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name mrtparser.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.bin/bgplg/bgpctl/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.bin/bgplg/bgpctl/../../../usr.sbin/bgpctl -I /usr/src/usr.bin/bgplg/bgpctl/../../../usr.sbin/bgpctl/../bgpd -I /usr/src/usr.bin/bgplg/bgpctl -I /usr/src/usr.bin/bgplg/bgpctl/../bgpd -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.bin/bgplg/bgpctl/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.bin/bgplg/bgpctl/../../../usr.sbin/bgpctl/mrtparser.c
1/*	$OpenBSD: mrtparser.c,v 1.16 2021/09/22 18:17:49 claudio Exp $ */
2/*
* Copyright (c) 2011 Claudio Jeker <claudio@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
17#include <sys/types.h>
18#include <sys/socket.h>
19#include <netinet/in.h>
20#include <err.h>
21#include <errno(*__errno()).h>
22#include <limits.h>
23#include <stdlib.h>
24#include <stdio.h>
25#include <string.h>
26#include <time.h>
27#include <unistd.h>

29#include "mrt.h"
30#include "mrtparser.h"

32void	*mrt_read_msg(int, struct mrt_hdr *);
33size_t	 mrt_read_buf(int, void *, size_t);

35struct mrt_peer	*mrt_parse_v2_peer(struct mrt_hdr *, void *);
36struct mrt_rib	*mrt_parse_v2_rib(struct mrt_hdr *, void *, int);
37int	mrt_parse_dump(struct mrt_hdr *, void *, struct mrt_peer **,
   struct mrt_rib **);
39int	mrt_parse_dump_mp(struct mrt_hdr *, void *, struct mrt_peer **,
   struct mrt_rib **, int);
41int	mrt_extract_attr(struct mrt_rib_entry *, u_char *, int, u_int8_t,
   int);

44void	mrt_free_peers(struct mrt_peer *);
45void	mrt_free_rib(struct mrt_rib *);
46void	mrt_free_bgp_state(struct mrt_bgp_state *);
47void	mrt_free_bgp_msg(struct mrt_bgp_msg *);

49u_char *mrt_aspath_inflate(void *, u_int16_t, u_int16_t *);
50int	mrt_extract_addr(void *, u_int, struct bgpd_addr *, u_int8_t);
51int	mrt_extract_prefix(void *, u_int, u_int8_t, struct bgpd_addr *,
   u_int8_t *, int);

54struct mrt_bgp_state	*mrt_parse_state(struct mrt_hdr *, void *, int);
55struct mrt_bgp_msg	*mrt_parse_msg(struct mrt_hdr *, void *, int);

57void *
58mrt_read_msg(int fd, struct mrt_hdr *hdr)
59{
void *buf;

bzero(hdr, sizeof(*hdr));
if (mrt_read_buf(fd, hdr, sizeof(*hdr)) != sizeof(*hdr))
2
←
Assuming the condition is false→
3
←
Taking false branch→
return (NULL((void *)0));

if ((buf = malloc(ntohl(hdr->length)(__uint32_t)(__builtin_constant_p(hdr->length) ? (__uint32_t
)(((__uint32_t)(hdr->length) & 0xff) << 24 | ((__uint32_t
)(hdr->length) & 0xff00) << 8 | ((__uint32_t)(hdr
->length) & 0xff0000) >> 8 | ((__uint32_t)(hdr->
length) & 0xff000000) >> 24) : __swap32md(hdr->length
)))) == NULL((void *)0))
4
←
'?' condition is false→
5
←
Storing uninitialized value→
6
←
Assuming the condition is false→
7
←
Taking false branch→
err(1, "malloc(%d)", hdr->length);

if (mrt_read_buf(fd, buf, ntohl(hdr->length)(__uint32_t)(__builtin_constant_p(hdr->length) ? (__uint32_t
)(((__uint32_t)(hdr->length) & 0xff) << 24 | ((__uint32_t
)(hdr->length) & 0xff00) << 8 | ((__uint32_t)(hdr
->length) & 0xff0000) >> 8 | ((__uint32_t)(hdr->
length) & 0xff000000) >> 24) : __swap32md(hdr->length
))) != ntohl(hdr->length)(__uint32_t)(__builtin_constant_p(hdr->length) ? (__uint32_t
)(((__uint32_t)(hdr->length) & 0xff) << 24 | ((__uint32_t
)(hdr->length) & 0xff00) << 8 | ((__uint32_t)(hdr
->length) & 0xff0000) >> 8 | ((__uint32_t)(hdr->
length) & 0xff000000) >> 24) : __swap32md(hdr->length
))) {
8
←
'?' condition is false→
9
←
Calling 'mrt_read_buf'→
12
←
Returning from 'mrt_read_buf'→
13
←
'?' condition is false→
14
←
Assuming the condition is false→
15
←
Taking false branch→
free(buf);
return (NULL((void *)0));
}
return (buf);
74}

76size_t
77mrt_read_buf(int fd, void *buf, size_t len)
78{
char *b = buf;
ssize_t n;

while (len > 0) {
10
←
Assuming 'len' is <= 0→
11
←
Loop condition is false. Execution continues on line 94→
if ((n = read(fd, b, len)) == -1) {
	if (errno(*__errno()) == EINTR4)
		continue;
	err(1, "read");
}
if (n == 0)
	break;
b += n;
len -= n;
}

return (b - (char *)buf);
95}

97void
98mrt_parse(int fd, struct mrt_parser *p, int verbose)
99{
struct mrt_hdr		h;
struct mrt_peer		*pctx = NULL((void *)0);
struct mrt_rib		*r;
struct mrt_bgp_state	*s;
struct mrt_bgp_msg	*m;
void			*msg;

while ((msg = mrt_read_msg(fd, &h))) {
1
Calling 'mrt_read_msg'→
16
←
Returning from 'mrt_read_msg'→
17
←
Loop condition is true.  Entering loop body→
switch (ntohs(h.type)(__uint16_t)(__builtin_constant_p(h.type) ? (__uint16_t)(((__uint16_t
)(h.type) & 0xffU) << 8 | ((__uint16_t)(h.type) &
 0xff00U) >> 8) : __swap16md(h.type))) {
18
←
'?' condition is false→
19
←
Control jumps to 'case MSG_TABLE_DUMP:'  at line 133→
case MSG_NULL:
case MSG_START:
case MSG_DIE:
case MSG_I_AM_DEAD:
case MSG_PEER_DOWN:
case MSG_PROTOCOL_BGP:
case MSG_PROTOCOL_IDRP:
case MSG_PROTOCOL_BGP4PLUS:
case MSG_PROTOCOL_BGP4PLUS1:
	if (verbose)
		printf("deprecated MRT type %d\n",
		    ntohs(h.type)(__uint16_t)(__builtin_constant_p(h.type) ? (__uint16_t)(((__uint16_t
)(h.type) & 0xffU) << 8 | ((__uint16_t)(h.type) &
 0xff00U) >> 8) : __swap16md(h.type)));
	break;
case MSG_PROTOCOL_RIP:
case MSG_PROTOCOL_RIPNG:
case MSG_PROTOCOL_OSPF:
case MSG_PROTOCOL_ISIS_ET:
case MSG_PROTOCOL_ISIS:
case MSG_PROTOCOL_OSPFV3_ET:
case MSG_PROTOCOL_OSPFV3:
	if (verbose)
		printf("unsuported MRT type %d\n",
		    ntohs(h.type)(__uint16_t)(__builtin_constant_p(h.type) ? (__uint16_t)(((__uint16_t
)(h.type) & 0xffU) << 8 | ((__uint16_t)(h.type) &
 0xff00U) >> 8) : __swap16md(h.type)));
	break;
case MSG_TABLE_DUMP:
	switch (ntohs(h.subtype)(__uint16_t)(__builtin_constant_p(h.subtype) ? (__uint16_t)((
(__uint16_t)(h.subtype) & 0xffU) << 8 | ((__uint16_t
)(h.subtype) & 0xff00U) >> 8) : __swap16md(h.subtype
))) {
20
←
'?' condition is false→
21
←
Control jumps to 'case MRT_DUMP_AFI_IPv6:'  at line 136→
	case MRT_DUMP_AFI_IP:
	case MRT_DUMP_AFI_IPv6:
		if (p->dump == NULL((void *)0))
22
←
Assuming field 'dump' is not equal to NULL→
23
←
Taking false branch→
			break;
		if (mrt_parse_dump(&h, msg, &pctx, &r) == 0) {
24
←
Calling 'mrt_parse_dump'→
			if (p->dump)
				p->dump(r, pctx, p->arg);
			mrt_free_rib(r);
		}
		break;
	default:
		if (verbose)
			printf("unknown AFI %d in table dump\n",
			    ntohs(h.subtype)(__uint16_t)(__builtin_constant_p(h.subtype) ? (__uint16_t)((
(__uint16_t)(h.subtype) & 0xffU) << 8 | ((__uint16_t
)(h.subtype) & 0xff00U) >> 8) : __swap16md(h.subtype
)));
		break;
	}
	break;
case MSG_TABLE_DUMP_V2:
	switch (ntohs(h.subtype)(__uint16_t)(__builtin_constant_p(h.subtype) ? (__uint16_t)((
(__uint16_t)(h.subtype) & 0xffU) << 8 | ((__uint16_t
)(h.subtype) & 0xff00U) >> 8) : __swap16md(h.subtype
))) {
	case MRT_DUMP_V2_PEER_INDEX_TABLE:
		if (p->dump == NULL((void *)0))
			break;
		if (pctx)
			mrt_free_peers(pctx);
		pctx = mrt_parse_v2_peer(&h, msg);
		break;
	case MRT_DUMP_V2_RIB_IPV4_UNICAST:
	case MRT_DUMP_V2_RIB_IPV4_MULTICAST:
	case MRT_DUMP_V2_RIB_IPV6_UNICAST:
	case MRT_DUMP_V2_RIB_IPV6_MULTICAST:
	case MRT_DUMP_V2_RIB_GENERIC:
	case MRT_DUMP_V2_RIB_IPV4_UNICAST_ADDPATH:
	case MRT_DUMP_V2_RIB_IPV4_MULTICAST_ADDPATH:
	case MRT_DUMP_V2_RIB_IPV6_UNICAST_ADDPATH:
	case MRT_DUMP_V2_RIB_IPV6_MULTICAST_ADDPATH:
	case MRT_DUMP_V2_RIB_GENERIC_ADDPATH:
		if (p->dump == NULL((void *)0))
			break;
		r = mrt_parse_v2_rib(&h, msg, verbose);
		if (r) {
			if (p->dump)
				p->dump(r, pctx, p->arg);
			mrt_free_rib(r);
		}
		break;
	default:
		if (verbose)
			printf("unhandled DUMP_V2 subtype %d\n",
			    ntohs(h.subtype)(__uint16_t)(__builtin_constant_p(h.subtype) ? (__uint16_t)((
(__uint16_t)(h.subtype) & 0xffU) << 8 | ((__uint16_t
)(h.subtype) & 0xff00U) >> 8) : __swap16md(h.subtype
)));
		break;
	}
	break;
case MSG_PROTOCOL_BGP4MP_ET:
case MSG_PROTOCOL_BGP4MP:
	switch (ntohs(h.subtype)(__uint16_t)(__builtin_constant_p(h.subtype) ? (__uint16_t)((
(__uint16_t)(h.subtype) & 0xffU) << 8 | ((__uint16_t
)(h.subtype) & 0xff00U) >> 8) : __swap16md(h.subtype
))) {
	case BGP4MP_STATE_CHANGE:
	case BGP4MP_STATE_CHANGE_AS4:
		if ((s = mrt_parse_state(&h, msg, verbose))) {
			if (p->state)
				p->state(s, p->arg);
			free(s);
		}
		break;
	case BGP4MP_MESSAGE:
	case BGP4MP_MESSAGE_AS4:
	case BGP4MP_MESSAGE_LOCAL:
	case BGP4MP_MESSAGE_AS4_LOCAL:
	case BGP4MP_MESSAGE_ADDPATH:
	case BGP4MP_MESSAGE_AS4_ADDPATH:
	case BGP4MP_MESSAGE_LOCAL_ADDPATH:
	case BGP4MP_MESSAGE_AS4_LOCAL_ADDPATH:
		if ((m = mrt_parse_msg(&h, msg, verbose))) {
			if (p->message)
				p->message(m, p->arg);
			free(m->msg);
			free(m);
		}
		break;
	case BGP4MP_ENTRY:
		if (p->dump == NULL((void *)0))
			break;
		if (mrt_parse_dump_mp(&h, msg, &pctx, &r,
		    verbose) == 0) {
			if (p->dump)
				p->dump(r, pctx, p->arg);
			mrt_free_rib(r);
		}
		break;
	default:
		if (verbose)
			printf("unhandled BGP4MP subtype %d\n",
			    ntohs(h.subtype)(__uint16_t)(__builtin_constant_p(h.subtype) ? (__uint16_t)((
(__uint16_t)(h.subtype) & 0xffU) << 8 | ((__uint16_t
)(h.subtype) & 0xff00U) >> 8) : __swap16md(h.subtype
)));
		break;
	}
	break;
default:
	if (verbose)
		printf("unknown MRT type %d\n", ntohs(h.type)(__uint16_t)(__builtin_constant_p(h.type) ? (__uint16_t)(((__uint16_t
)(h.type) & 0xffU) << 8 | ((__uint16_t)(h.type) &
 0xff00U) >> 8) : __swap16md(h.type)));
	break;
}
free(msg);
}
if (pctx)
mrt_free_peers(pctx);
239}

241static int
242mrt_afi2aid(int afi, int safi, int verbose)
243{
switch (afi) {
case MRT_DUMP_AFI_IP:
if (safi == -1 || safi == 1 || safi == 2)
	return AID_INET1;
else if (safi == 128)
	return AID_VPN_IPv43;
break;
case MRT_DUMP_AFI_IPv6:
if (safi == -1 || safi == 1 || safi == 2)
	return AID_INET62;
else if (safi == 128)
	return AID_VPN_IPv64;
break;
default:
break;
}
if (verbose)
printf("unhandled AFI/SAFI %d/%d\n", afi, safi);
return AID_UNSPEC0;
263}

265struct mrt_peer *
266mrt_parse_v2_peer(struct mrt_hdr *hdr, void *msg)
267{
struct mrt_peer_entry	*peers = NULL((void *)0);
struct mrt_peer	*p;
u_int8_t	*b = msg;
u_int32_t	bid, as4;
u_int16_t	cnt, i, as2;
u_int		len = ntohl(hdr->length)(__uint32_t)(__builtin_constant_p(hdr->length) ? (__uint32_t
)(((__uint32_t)(hdr->length) & 0xff) << 24 | ((__uint32_t
)(hdr->length) & 0xff00) << 8 | ((__uint32_t)(hdr
->length) & 0xff0000) >> 8 | ((__uint32_t)(hdr->
length) & 0xff000000) >> 24) : __swap32md(hdr->length
));

if (len < 8)	/* min msg size */
return NULL((void *)0);

p = calloc(1, sizeof(struct mrt_peer));
if (p == NULL((void *)0))
err(1, "calloc");

/* collector bgp id */
memcpy(&bid, b, sizeof(bid));
b += sizeof(bid);
len -= sizeof(bid);
p->bgp_id = ntohl(bid)(__uint32_t)(__builtin_constant_p(bid) ? (__uint32_t)(((__uint32_t
)(bid) & 0xff) << 24 | ((__uint32_t)(bid) & 0xff00
) << 8 | ((__uint32_t)(bid) & 0xff0000) >> 8 |
 ((__uint32_t)(bid) & 0xff000000) >> 24) : __swap32md
(bid));

/* view name length */
memcpy(&cnt, b, sizeof(cnt));
b += sizeof(cnt);
len -= sizeof(cnt);
cnt = ntohs(cnt)(__uint16_t)(__builtin_constant_p(cnt) ? (__uint16_t)(((__uint16_t
)(cnt) & 0xffU) << 8 | ((__uint16_t)(cnt) & 0xff00U
) >> 8) : __swap16md(cnt));

/* view name */
if (cnt > len)
goto fail;
if (cnt != 0) {
if ((p->view = malloc(cnt + 1)) == NULL((void *)0))
	err(1, "malloc");
memcpy(p->view, b, cnt);
p->view[cnt] = 0;
} else
if ((p->view = strdup("")) == NULL((void *)0))
	err(1, "strdup");
b += cnt;
len -= cnt;

/* peer_count */
if (len < sizeof(cnt))
goto fail;
memcpy(&cnt, b, sizeof(cnt));
b += sizeof(cnt);
len -= sizeof(cnt);
cnt = ntohs(cnt)(__uint16_t)(__builtin_constant_p(cnt) ? (__uint16_t)(((__uint16_t
)(cnt) & 0xffU) << 8 | ((__uint16_t)(cnt) & 0xff00U
) >> 8) : __swap16md(cnt));

/* peer entries */
if ((peers = calloc(cnt, sizeof(struct mrt_peer_entry))) == NULL((void *)0))
err(1, "calloc");
for (i = 0; i < cnt; i++) {
u_int8_t type;

if (len < sizeof(u_int8_t) + sizeof(u_int32_t))
	goto fail;
type = *b++;
len -= 1;
memcpy(&bid, b, sizeof(bid));
b += sizeof(bid);
len -= sizeof(bid);
peers[i].bgp_id = ntohl(bid)(__uint32_t)(__builtin_constant_p(bid) ? (__uint32_t)(((__uint32_t
)(bid) & 0xff) << 24 | ((__uint32_t)(bid) & 0xff00
) << 8 | ((__uint32_t)(bid) & 0xff0000) >> 8 |
 ((__uint32_t)(bid) & 0xff000000) >> 24) : __swap32md
(bid));

if (type & MRT_DUMP_V2_PEER_BIT_I0x1) {
	if (mrt_extract_addr(b, len, &peers[i].addr,
	    AID_INET62) == -1)
		goto fail;
	b += sizeof(struct in6_addr);
	len -= sizeof(struct in6_addr);
} else {
	if (mrt_extract_addr(b, len, &peers[i].addr,
	    AID_INET1) == -1)
		goto fail;
	b += sizeof(struct in_addr);
	len -= sizeof(struct in_addr);
}

if (type & MRT_DUMP_V2_PEER_BIT_A0x2) {
	memcpy(&as4, b, sizeof(as4));
	b += sizeof(as4);
	len -= sizeof(as4);
	as4 = ntohl(as4)(__uint32_t)(__builtin_constant_p(as4) ? (__uint32_t)(((__uint32_t
)(as4) & 0xff) << 24 | ((__uint32_t)(as4) & 0xff00
) << 8 | ((__uint32_t)(as4) & 0xff0000) >> 8 |
 ((__uint32_t)(as4) & 0xff000000) >> 24) : __swap32md
(as4));
} else {
	memcpy(&as2, b, sizeof(as2));
	b += sizeof(as2);
	len -= sizeof(as2);
	as4 = ntohs(as2)(__uint16_t)(__builtin_constant_p(as2) ? (__uint16_t)(((__uint16_t
)(as2) & 0xffU) << 8 | ((__uint16_t)(as2) & 0xff00U
) >> 8) : __swap16md(as2));
}
peers[i].asnum = as4;
}
p->peers = peers;
p->npeers = cnt;
return (p);
361fail:
mrt_free_peers(p);
free(peers);
return (NULL((void *)0));
365}

367struct mrt_rib *
368mrt_parse_v2_rib(struct mrt_hdr *hdr, void *msg, int verbose)
369{
struct mrt_rib_entry *entries = NULL((void *)0);
struct mrt_rib	*r;
u_int8_t	*b = msg;
u_int		len = ntohl(hdr->length)(__uint32_t)(__builtin_constant_p(hdr->length) ? (__uint32_t
)(((__uint32_t)(hdr->length) & 0xff) << 24 | ((__uint32_t
)(hdr->length) & 0xff00) << 8 | ((__uint32_t)(hdr
->length) & 0xff0000) >> 8 | ((__uint32_t)(hdr->
length) & 0xff000000) >> 24) : __swap32md(hdr->length
));
u_int32_t	snum, path_id = 0;
u_int16_t	cnt, i, afi;
u_int8_t	safi, aid;
int		ret;

if (len < sizeof(snum) + 1)
return NULL((void *)0);

r = calloc(1, sizeof(struct mrt_rib));
if (r == NULL((void *)0))
err(1, "calloc");

/* seq_num */
memcpy(&snum, b, sizeof(snum));
b += sizeof(snum);
len -= sizeof(snum);
r->seqnum = ntohl(snum)(__uint32_t)(__builtin_constant_p(snum) ? (__uint32_t)(((__uint32_t
)(snum) & 0xff) << 24 | ((__uint32_t)(snum) & 0xff00
) << 8 | ((__uint32_t)(snum) & 0xff0000) >> 8
 | ((__uint32_t)(snum) & 0xff000000) >> 24) : __swap32md
(snum));

switch (ntohs(hdr->subtype)(__uint16_t)(__builtin_constant_p(hdr->subtype) ? (__uint16_t
)(((__uint16_t)(hdr->subtype) & 0xffU) << 8 | ((
__uint16_t)(hdr->subtype) & 0xff00U) >> 8) : __swap16md
(hdr->subtype))) {
case MRT_DUMP_V2_RIB_IPV4_UNICAST_ADDPATH:
case MRT_DUMP_V2_RIB_IPV4_MULTICAST_ADDPATH:
r->add_path = 1;
/* FALLTHROUGH */
case MRT_DUMP_V2_RIB_IPV4_UNICAST:
case MRT_DUMP_V2_RIB_IPV4_MULTICAST:
/* prefix */
ret = mrt_extract_prefix(b, len, AID_INET1, &r->prefix,
    &r->prefixlen, verbose);
if (ret == 1)
	goto fail;
break;
case MRT_DUMP_V2_RIB_IPV6_UNICAST_ADDPATH:
case MRT_DUMP_V2_RIB_IPV6_MULTICAST_ADDPATH:
r->add_path = 1;
/* FALLTHROUGH */
case MRT_DUMP_V2_RIB_IPV6_UNICAST:
case MRT_DUMP_V2_RIB_IPV6_MULTICAST:
/* prefix */
ret = mrt_extract_prefix(b, len, AID_INET62, &r->prefix,
    &r->prefixlen, verbose);
if (ret == 1)
	goto fail;
break;
case MRT_DUMP_V2_RIB_GENERIC_ADDPATH:
/*
 * RFC8050 handling for add-path has special handling for
 * RIB_GENERIC_ADDPATH but nobody implements it that way.
 * So just use the same way as for the other _ADDPATH types.
 */
r->add_path = 1;
/* FALLTHROUGH */
case MRT_DUMP_V2_RIB_GENERIC:
/* fetch AFI/SAFI pair */
if (len < 3)
	goto fail;
memcpy(&afi, b, sizeof(afi));
b += sizeof(afi);
len -= sizeof(afi);
afi = ntohs(afi)(__uint16_t)(__builtin_constant_p(afi) ? (__uint16_t)(((__uint16_t
)(afi) & 0xffU) << 8 | ((__uint16_t)(afi) & 0xff00U
) >> 8) : __swap16md(afi));

safi = *b++;
len -= 1;

if ((aid = mrt_afi2aid(afi, safi, verbose)) == AID_UNSPEC0)
	goto fail;

/* prefix */
ret = mrt_extract_prefix(b, len, aid, &r->prefix,
    &r->prefixlen, verbose);
if (ret == 1)
	goto fail;
break;
default:
errx(1, "unknonw subtype %hd", ntohs(hdr->subtype)(__uint16_t)(__builtin_constant_p(hdr->subtype) ? (__uint16_t
)(((__uint16_t)(hdr->subtype) & 0xffU) << 8 | ((
__uint16_t)(hdr->subtype) & 0xff00U) >> 8) : __swap16md
(hdr->subtype)));
}

/* adjust length */
b += ret;
len -= ret;

/* entries count */
if (len < sizeof(cnt))
goto fail;
memcpy(&cnt, b, sizeof(cnt));
b += sizeof(cnt);
len -= sizeof(cnt);
cnt = ntohs(cnt)(__uint16_t)(__builtin_constant_p(cnt) ? (__uint16_t)(((__uint16_t
)(cnt) & 0xffU) << 8 | ((__uint16_t)(cnt) & 0xff00U
) >> 8) : __swap16md(cnt));
r->nentries = cnt;

/* entries */
if ((entries = calloc(cnt, sizeof(struct mrt_rib_entry))) == NULL((void *)0))
err(1, "calloc");
for (i = 0; i < cnt; i++) {
u_int32_t	otm;
u_int16_t	pix, alen;
if (len < 2 * sizeof(u_int16_t) + sizeof(u_int32_t))
	goto fail;
/* peer index */
memcpy(&pix, b, sizeof(pix));
b += sizeof(pix);
len -= sizeof(pix);
entries[i].peer_idx = ntohs(pix)(__uint16_t)(__builtin_constant_p(pix) ? (__uint16_t)(((__uint16_t
)(pix) & 0xffU) << 8 | ((__uint16_t)(pix) & 0xff00U
) >> 8) : __swap16md(pix));

/* originated */
memcpy(&otm, b, sizeof(otm));
b += sizeof(otm);
len -= sizeof(otm);
entries[i].originated = ntohl(otm)(__uint32_t)(__builtin_constant_p(otm) ? (__uint32_t)(((__uint32_t
)(otm) & 0xff) << 24 | ((__uint32_t)(otm) & 0xff00
) << 8 | ((__uint32_t)(otm) & 0xff0000) >> 8 |
 ((__uint32_t)(otm) & 0xff000000) >> 24) : __swap32md
(otm));

if (r->add_path) {
	if (len < sizeof(path_id) + sizeof(alen))
		goto fail;
	memcpy(&path_id, b, sizeof(path_id));
	b += sizeof(path_id);
	len -= sizeof(path_id);
	path_id = ntohl(path_id)(__uint32_t)(__builtin_constant_p(path_id) ? (__uint32_t)(((__uint32_t
)(path_id) & 0xff) << 24 | ((__uint32_t)(path_id) &
 0xff00) << 8 | ((__uint32_t)(path_id) & 0xff0000) >>
| ((__uint32_t)(path_id) & 0xff000000) >> 24) : __swap32md
(path_id));
}
entries[i].path_id = path_id;

/* attr_len */
memcpy(&alen, b, sizeof(alen));
b += sizeof(alen);
len -= sizeof(alen);
alen = ntohs(alen)(__uint16_t)(__builtin_constant_p(alen) ? (__uint16_t)(((__uint16_t
)(alen) & 0xffU) << 8 | ((__uint16_t)(alen) & 0xff00U
) >> 8) : __swap16md(alen));

/* attr */
if (len < alen)
	goto fail;
if (mrt_extract_attr(&entries[i], b, alen,
    r->prefix.aid, 1) == -1)
	goto fail;
b += alen;
len -= alen;
}
r->entries = entries;
return (r);
510fail:
mrt_free_rib(r);
free(entries);
return (NULL((void *)0));
514}

516int
517mrt_parse_dump(struct mrt_hdr *hdr, void *msg, struct mrt_peer **pp,
  struct mrt_rib **rp)
519{
struct mrt_peer		*p;
struct mrt_rib		*r;
struct mrt_rib_entry	*re;
u_int8_t		*b = msg;
u_int			 len = ntohl(hdr->length)(__uint32_t)(__builtin_constant_p(hdr->length) ? (__uint32_t
)(((__uint32_t)(hdr->length) & 0xff) << 24 | ((__uint32_t
)(hdr->length) & 0xff00) << 8 | ((__uint32_t)(hdr
->length) & 0xff0000) >> 8 | ((__uint32_t)(hdr->
length) & 0xff000000) >> 24) : __swap32md(hdr->length
));
25
←
'?' condition is false→
u_int16_t		 asnum, alen;

if (*pp == NULL((void *)0)) {
26
←
Taking true branch→
*pp = calloc(1, sizeof(struct mrt_peer));
if (*pp == NULL((void *)0))
27
←
Assuming the condition is false→
28
←
Taking false branch→
	err(1, "calloc");
(*pp)->peers = calloc(1, sizeof(struct mrt_peer_entry));
if ((*pp)->peers == NULL((void *)0))
29
←
Assuming field 'peers' is not equal to NULL→
30
←
Taking false branch→
	err(1, "calloc");
(*pp)->npeers = 1;
}
p = *pp;

*rp = r = calloc(1, sizeof(struct mrt_rib));
if (r == NULL((void *)0))
31
←
Assuming 'r' is not equal to NULL→
32
←
Taking false branch→
err(1, "calloc");
re = calloc(1, sizeof(struct mrt_rib_entry));
if (re == NULL((void *)0))
33
←
Assuming 're' is not equal to NULL→
34
←
Taking false branch→
err(1, "calloc");
r->nentries = 1;
r->entries = re;

if (len < 2 * sizeof(u_int16_t))
35
←
Assuming the condition is false→
36
←
Taking false branch→
goto fail;
/* view */
b += sizeof(u_int16_t);
len -= sizeof(u_int16_t);
/* seqnum */
memcpy(&r->seqnum, b, sizeof(u_int16_t));
b += sizeof(u_int16_t);
len -= sizeof(u_int16_t);
r->seqnum = ntohs(r->seqnum)(__uint16_t)(__builtin_constant_p(r->seqnum) ? (__uint16_t
)(((__uint16_t)(r->seqnum) & 0xffU) << 8 | ((__uint16_t
)(r->seqnum) & 0xff00U) >> 8) : __swap16md(r->
seqnum));
37
←
'?' condition is false→

switch (ntohs(hdr->subtype)(__uint16_t)(__builtin_constant_p(hdr->subtype) ? (__uint16_t
)(((__uint16_t)(hdr->subtype) & 0xffU) << 8 | ((
__uint16_t)(hdr->subtype) & 0xff00U) >> 8) : __swap16md
(hdr->subtype))) {
38
←
'?' condition is false→
39
←
'Default' branch taken. Execution continues on line 572→
case MRT_DUMP_AFI_IP:
if (mrt_extract_addr(b, len, &r->prefix, AID_INET1) == -1)
	goto fail;
b += sizeof(struct in_addr);
len -= sizeof(struct in_addr);
break;
case MRT_DUMP_AFI_IPv6:
if (mrt_extract_addr(b, len, &r->prefix, AID_INET62) == -1)
	goto fail;
b += sizeof(struct in6_addr);
len -= sizeof(struct in6_addr);
break;
}
if (len < 2 * sizeof(u_int32_t) + 2 * sizeof(u_int16_t) + 2)
40
←
Assuming the condition is false→
41
←
Taking false branch→
goto fail;
r->prefixlen = *b++;
42
←
Assigned value is garbage or undefined
len -= 1;
/* status */
b += 1;
len -= 1;
/* originated */
memcpy(&re->originated, b, sizeof(u_int32_t));
b += sizeof(u_int32_t);
len -= sizeof(u_int32_t);
re->originated = ntohl(re->originated)(__uint32_t)(__builtin_constant_p(re->originated) ? (__uint32_t
)(((__uint32_t)(re->originated) & 0xff) << 24 | (
(__uint32_t)(re->originated) & 0xff00) << 8 | ((
__uint32_t)(re->originated) & 0xff0000) >> 8 | (
(__uint32_t)(re->originated) & 0xff000000) >> 24
) : __swap32md(re->originated));
/* peer ip */
switch (ntohs(hdr->subtype)(__uint16_t)(__builtin_constant_p(hdr->subtype) ? (__uint16_t
)(((__uint16_t)(hdr->subtype) & 0xffU) << 8 | ((
__uint16_t)(hdr->subtype) & 0xff00U) >> 8) : __swap16md
(hdr->subtype))) {
case MRT_DUMP_AFI_IP:
if (mrt_extract_addr(b, len, &p->peers->addr, AID_INET1) == -1)
	goto fail;
b += sizeof(struct in_addr);
len -= sizeof(struct in_addr);
break;
case MRT_DUMP_AFI_IPv6:
if (mrt_extract_addr(b, len, &p->peers->addr, AID_INET62) == -1)
	goto fail;
b += sizeof(struct in6_addr);
len -= sizeof(struct in6_addr);
break;
}
memcpy(&asnum, b, sizeof(asnum));
b += sizeof(asnum);
len -= sizeof(asnum);
p->peers->asnum = ntohs(asnum)(__uint16_t)(__builtin_constant_p(asnum) ? (__uint16_t)(((__uint16_t
)(asnum) & 0xffU) << 8 | ((__uint16_t)(asnum) &
 0xff00U) >> 8) : __swap16md(asnum));

memcpy(&alen, b, sizeof(alen));
b += sizeof(alen);
len -= sizeof(alen);
alen = ntohs(alen)(__uint16_t)(__builtin_constant_p(alen) ? (__uint16_t)(((__uint16_t
)(alen) & 0xffU) << 8 | ((__uint16_t)(alen) & 0xff00U
) >> 8) : __swap16md(alen));

/* attr */
if (len < alen)
goto fail;
if (mrt_extract_attr(re, b, alen, r->prefix.aid, 0) == -1)
goto fail;
b += alen;
len -= alen;

return (0);
618fail:
mrt_free_rib(r);
return (-1);
621}

623int
624mrt_parse_dump_mp(struct mrt_hdr *hdr, void *msg, struct mrt_peer **pp,
  struct mrt_rib **rp, int verbose)
626{
struct mrt_peer		*p;
struct mrt_rib		*r;
struct mrt_rib_entry	*re;
u_int8_t		*b = msg;
u_int			 len = ntohl(hdr->length)(__uint32_t)(__builtin_constant_p(hdr->length) ? (__uint32_t
)(((__uint32_t)(hdr->length) & 0xff) << 24 | ((__uint32_t
)(hdr->length) & 0xff00) << 8 | ((__uint32_t)(hdr
->length) & 0xff0000) >> 8 | ((__uint32_t)(hdr->
length) & 0xff000000) >> 24) : __swap32md(hdr->length
));
u_int16_t		 asnum, alen, afi;
u_int8_t		 safi, nhlen, aid;
int			 ret;

/* just ignore the microsec field for _ET header for now */
if (ntohs(hdr->type)(__uint16_t)(__builtin_constant_p(hdr->type) ? (__uint16_t
)(((__uint16_t)(hdr->type) & 0xffU) << 8 | ((__uint16_t
)(hdr->type) & 0xff00U) >> 8) : __swap16md(hdr->
type)) == MSG_PROTOCOL_BGP4MP_ET) {
b = (char *)b + sizeof(u_int32_t);
len -= sizeof(u_int32_t);
}

if (*pp == NULL((void *)0)) {
*pp = calloc(1, sizeof(struct mrt_peer));
if (*pp == NULL((void *)0))
	err(1, "calloc");
(*pp)->peers = calloc(1, sizeof(struct mrt_peer_entry));
if ((*pp)->peers == NULL((void *)0))
	err(1, "calloc");
(*pp)->npeers = 1;
}
p = *pp;

*rp = r = calloc(1, sizeof(struct mrt_rib));
if (r == NULL((void *)0))
err(1, "calloc");
re = calloc(1, sizeof(struct mrt_rib_entry));
if (re == NULL((void *)0))
err(1, "calloc");
r->nentries = 1;
r->entries = re;

if (len < 4 * sizeof(u_int16_t))
goto fail;
/* source AS */
b += sizeof(u_int16_t);
len -= sizeof(u_int16_t);
/* dest AS */
memcpy(&asnum, b, sizeof(asnum));
b += sizeof(asnum);
len -= sizeof(asnum);
p->peers->asnum = ntohs(asnum)(__uint16_t)(__builtin_constant_p(asnum) ? (__uint16_t)(((__uint16_t
)(asnum) & 0xffU) << 8 | ((__uint16_t)(asnum) &
 0xff00U) >> 8) : __swap16md(asnum));
/* iface index */
b += sizeof(u_int16_t);
len -= sizeof(u_int16_t);
/* afi */
memcpy(&afi, b, sizeof(afi));
b += sizeof(afi);
len -= sizeof(afi);
afi = ntohs(afi)(__uint16_t)(__builtin_constant_p(afi) ? (__uint16_t)(((__uint16_t
)(afi) & 0xffU) << 8 | ((__uint16_t)(afi) & 0xff00U
) >> 8) : __swap16md(afi));

/* source + dest ip */
switch (afi) {
case MRT_DUMP_AFI_IP:
if (len < 2 * sizeof(struct in_addr))
	goto fail;
/* source IP */
b += sizeof(struct in_addr);
len -= sizeof(struct in_addr);
/* dest IP */
if (mrt_extract_addr(b, len, &p->peers->addr, AID_INET1) == -1)
	goto fail;
b += sizeof(struct in_addr);
len -= sizeof(struct in_addr);
break;
case MRT_DUMP_AFI_IPv6:
if (len < 2 * sizeof(struct in6_addr))
	goto fail;
/* source IP */
b += sizeof(struct in6_addr);
len -= sizeof(struct in6_addr);
/* dest IP */
if (mrt_extract_addr(b, len, &p->peers->addr, AID_INET62) == -1)
	goto fail;
b += sizeof(struct in6_addr);
len -= sizeof(struct in6_addr);
break;
}

if (len < 2 * sizeof(u_int16_t) + 2 * sizeof(u_int32_t))
goto fail;
/* view + status */
b += 2 * sizeof(u_int16_t);
len -= 2 * sizeof(u_int16_t);
/* originated */
memcpy(&re->originated, b, sizeof(u_int32_t));
b += sizeof(u_int32_t);
len -= sizeof(u_int32_t);
re->originated = ntohl(re->originated)(__uint32_t)(__builtin_constant_p(re->originated) ? (__uint32_t
)(((__uint32_t)(re->originated) & 0xff) << 24 | (
(__uint32_t)(re->originated) & 0xff00) << 8 | ((
__uint32_t)(re->originated) & 0xff0000) >> 8 | (
(__uint32_t)(re->originated) & 0xff000000) >> 24
) : __swap32md(re->originated));

/* afi */
memcpy(&afi, b, sizeof(afi));
b += sizeof(afi);
len -= sizeof(afi);
afi = ntohs(afi)(__uint16_t)(__builtin_constant_p(afi) ? (__uint16_t)(((__uint16_t
)(afi) & 0xffU) << 8 | ((__uint16_t)(afi) & 0xff00U
) >> 8) : __swap16md(afi));

/* safi */
safi = *b++;
len -= 1;

if ((aid = mrt_afi2aid(afi, safi, verbose)) == AID_UNSPEC0)
goto fail;

/* nhlen */
nhlen = *b++;
len -= 1;

/* nexthop */
if (mrt_extract_addr(b, len, &re->nexthop, aid) == -1)
goto fail;
if (len < nhlen)
goto fail;
b += nhlen;
len -= nhlen;

/* prefix */
ret = mrt_extract_prefix(b, len, aid, &r->prefix, &r->prefixlen,
   verbose);
if (ret == 1)
goto fail;
b += ret;
len -= ret;

memcpy(&alen, b, sizeof(alen));
b += sizeof(alen);
len -= sizeof(alen);
alen = ntohs(alen)(__uint16_t)(__builtin_constant_p(alen) ? (__uint16_t)(((__uint16_t
)(alen) & 0xffU) << 8 | ((__uint16_t)(alen) & 0xff00U
) >> 8) : __swap16md(alen));

/* attr */
if (len < alen)
goto fail;
if (mrt_extract_attr(re, b, alen, r->prefix.aid, 0) == -1)
goto fail;
b += alen;
len -= alen;

return (0);
767fail:
mrt_free_rib(r);
return (-1);
770}

772int
773mrt_extract_attr(struct mrt_rib_entry *re, u_char *a, int alen, u_int8_t aid,
  int as4)
775{
struct mrt_attr	*ap;
u_int32_t	tmp;
u_int16_t	attr_len;
u_int8_t	type, flags, *attr;

do {
if (alen < 3)
	return (-1);
attr = a;
flags = *a++;
alen -= 1;
type = *a++;
alen -= 1;

if (flags & MRT_ATTR_EXTLEN0x10) {
	if (alen < 2)
		return (-1);
	memcpy(&attr_len, a, sizeof(attr_len));
	attr_len = ntohs(attr_len)(__uint16_t)(__builtin_constant_p(attr_len) ? (__uint16_t)(((
__uint16_t)(attr_len) & 0xffU) << 8 | ((__uint16_t)
(attr_len) & 0xff00U) >> 8) : __swap16md(attr_len));
	a += sizeof(attr_len);
	alen -= sizeof(attr_len);
} else {
	attr_len = *a++;
	alen -= 1;
}
switch (type) {
case MRT_ATTR_ORIGIN1:
	if (attr_len != 1)
		return (-1);
	re->origin = *a;
	break;
case MRT_ATTR_ASPATH2:
	if (as4) {
		re->aspath_len = attr_len;
		if ((re->aspath = malloc(attr_len)) == NULL((void *)0))
			err(1, "malloc");
		memcpy(re->aspath, a, attr_len);
	} else {
		re->aspath = mrt_aspath_inflate(a, attr_len,
		    &re->aspath_len);
		if (re->aspath == NULL((void *)0))
			return (-1);
	}
	break;
case MRT_ATTR_NEXTHOP3:
	if (attr_len != 4)
		return (-1);
	if (aid != AID_INET1)
		break;
	memcpy(&tmp, a, sizeof(tmp));
	re->nexthop.aid = AID_INET1;
	re->nexthop.v4ba.v4.s_addr = tmp;
	break;
case MRT_ATTR_MED4:
	if (attr_len != 4)
		return (-1);
	memcpy(&tmp, a, sizeof(tmp));
	re->med = ntohl(tmp)(__uint32_t)(__builtin_constant_p(tmp) ? (__uint32_t)(((__uint32_t
)(tmp) & 0xff) << 24 | ((__uint32_t)(tmp) & 0xff00
) << 8 | ((__uint32_t)(tmp) & 0xff0000) >> 8 |
 ((__uint32_t)(tmp) & 0xff000000) >> 24) : __swap32md
(tmp));
	break;
case MRT_ATTR_LOCALPREF5:
	if (attr_len != 4)
		return (-1);
	memcpy(&tmp, a, sizeof(tmp));
	re->local_pref = ntohl(tmp)(__uint32_t)(__builtin_constant_p(tmp) ? (__uint32_t)(((__uint32_t
)(tmp) & 0xff) << 24 | ((__uint32_t)(tmp) & 0xff00
) << 8 | ((__uint32_t)(tmp) & 0xff0000) >> 8 |
 ((__uint32_t)(tmp) & 0xff000000) >> 24) : __swap32md
(tmp));
	break;
case MRT_ATTR_MP_REACH_NLRI14:
	/*
	 * XXX horrible hack:
	 * Once again IETF and the real world differ in the
	 * implementation. In short the abbreviated MP_NLRI
	 * hack in the standard is not used in real life.
	 * Detect the two cases by looking at the first byte
	 * of the payload (either the nexthop addr length (RFC)
	 * or the high byte of the AFI (old form)). If the
	 * first byte matches the expected nexthop length it
	 * is expected to be the RFC 6396 encoding.
	 */
	if (*a != attr_len - 1) {
		a += 3;
		alen -= 3;
		attr_len -= 3;
	}
	switch (aid) {
	case AID_INET62:
		if (attr_len < sizeof(struct in6_addr) + 1)
			return (-1);
		re->nexthop.aid = aid;
		memcpy(&re->nexthop.v6ba.v6, a + 1,
		    sizeof(struct in6_addr));
		break;
	case AID_VPN_IPv43:
		if (attr_len < sizeof(u_int64_t) +
		    sizeof(struct in_addr))
			return (-1);
		re->nexthop.aid = aid;
		memcpy(&tmp, a + 1 + sizeof(u_int64_t),
		    sizeof(tmp));
		re->nexthop.v4ba.v4.s_addr = tmp;
		break;
	case AID_VPN_IPv64:
		if (attr_len < sizeof(u_int64_t) +
		    sizeof(struct in6_addr))
			return (-1);
		re->nexthop.aid = aid;
		memcpy(&re->nexthop.v6ba.v6,
		    a + 1 + sizeof(u_int64_t),
		    sizeof(struct in6_addr));
		break;
	}
	break;
case MRT_ATTR_AS4PATH17:
	if (!as4) {
		free(re->aspath);
		re->aspath_len = attr_len;
		if ((re->aspath = malloc(attr_len)) == NULL((void *)0))
			err(1, "malloc");
		memcpy(re->aspath, a, attr_len);
		break;
	}
	/* FALLTHROUGH */
default:
	re->nattrs++;
	if (re->nattrs >= UCHAR_MAX(127*2 +1))
		err(1, "too many attributes");
	ap = reallocarray(re->attrs,
	    re->nattrs, sizeof(struct mrt_attr));
	if (ap == NULL((void *)0))
		err(1, "realloc");
	re->attrs = ap;
	ap = re->attrs + re->nattrs - 1;
	ap->attr_len = a + attr_len - attr;
	if ((ap->attr = malloc(ap->attr_len)) == NULL((void *)0))
		err(1, "malloc");
	memcpy(ap->attr, attr, ap->attr_len);
	break;
}
a += attr_len;
alen -= attr_len;
} while (alen > 0);

return (0);
917}

919void
920mrt_free_peers(struct mrt_peer *p)
921{
free(p->peers);
free(p->view);
free(p);
925}

927void
928mrt_free_rib(struct mrt_rib *r)
929{
u_int16_t	i, j;

for (i = 0; i < r->nentries && r->entries; i++) {
for (j = 0; j < r->entries[i].nattrs; j++)
	 free(r->entries[i].attrs[j].attr);
free(r->entries[i].attrs);
free(r->entries[i].aspath);
}

free(r->entries);
free(r);
941}

943void
944mrt_free_bgp_state(struct mrt_bgp_state *s)
945{
free(s);
947}

949void
950mrt_free_bgp_msg(struct mrt_bgp_msg *m)
951{
free(m->msg);
free(m);
954}

956u_char *
957mrt_aspath_inflate(void *data, u_int16_t len, u_int16_t *newlen)
958{
u_int8_t	*seg, *nseg, *ndata;
u_int16_t	 seg_size, olen, nlen;
u_int8_t	 seg_len;

/* first calculate the length of the aspath */
seg = data;
nlen = 0;
for (olen = len; olen > 0; olen -= seg_size, seg += seg_size) {
seg_len = seg[1];
seg_size = 2 + sizeof(u_int16_t) * seg_len;
nlen += 2 + sizeof(u_int32_t) * seg_len;

if (seg_size > olen)
	return NULL((void *)0);
}

*newlen = nlen;
if ((ndata = malloc(nlen)) == NULL((void *)0))
err(1, "malloc");

/* then copy the aspath */
seg = data;
for (nseg = ndata; nseg < ndata + nlen; ) {
*nseg++ = *seg++;
*nseg++ = seg_len = *seg++;
for (; seg_len > 0; seg_len--) {
	*nseg++ = 0;
	*nseg++ = 0;
	*nseg++ = *seg++;
	*nseg++ = *seg++;
}
}

return (ndata);
993}

995int
996mrt_extract_addr(void *msg, u_int len, struct bgpd_addr *addr, u_int8_t aid)
997{
u_int8_t	*b = msg;

memset(addr, 0, sizeof(*addr));
switch (aid) {
case AID_INET1:
if (len < sizeof(struct in_addr))
	return (-1);
addr->aid = aid;
memcpy(&addr->v4ba.v4, b, sizeof(struct in_addr));
return sizeof(struct in_addr);
case AID_INET62:
if (len < sizeof(struct in6_addr))
	return (-1);
addr->aid = aid;
memcpy(&addr->v6ba.v6, b, sizeof(struct in6_addr));
return sizeof(struct in6_addr);
case AID_VPN_IPv43:
if (len < sizeof(u_int64_t) + sizeof(struct in_addr))
	return (-1);
addr->aid = aid;
/* XXX labelstack and rd missing */
memcpy(&addr->v4ba.v4, b + sizeof(u_int64_t),
    sizeof(struct in_addr));
return (sizeof(u_int64_t) + sizeof(struct in_addr));
case AID_VPN_IPv64:
if (len < sizeof(u_int64_t) + sizeof(struct in6_addr))
	return (-1);
addr->aid = aid;
/* XXX labelstack and rd missing */
memcpy(&addr->v6ba.v6, b + sizeof(u_int64_t),
    sizeof(struct in6_addr));
return (sizeof(u_int64_t) + sizeof(struct in6_addr));
default:
return (-1);
}
1033}

1035int
1036mrt_extract_prefix(void *msg, u_int len, u_int8_t aid,
  struct bgpd_addr *prefix, u_int8_t *prefixlen, int verbose)
1038{
int r;

switch (aid) {
case AID_INET1:
r = nlri_get_prefix(msg, len, prefix, prefixlen);
break;
case AID_INET62:
r = nlri_get_prefix6(msg, len, prefix, prefixlen);
break;
case AID_VPN_IPv43:
r = nlri_get_vpn4(msg, len, prefix, prefixlen, 0);
break;
case AID_VPN_IPv64:
r = nlri_get_vpn6(msg, len, prefix, prefixlen, 0);
break;
default:
if (verbose)
	printf("unknown prefix AID %d\n", aid);
return -1;
}
if (r == -1 && verbose)
printf("failed to parse prefix of AID %d\n", aid);
return r;
1062}

1064struct mrt_bgp_state *
1065mrt_parse_state(struct mrt_hdr *hdr, void *msg, int verbose)
1066{
struct timespec		 t;
struct mrt_bgp_state	*s;
u_int8_t		*b = msg;
u_int			 len = ntohl(hdr->length)(__uint32_t)(__builtin_constant_p(hdr->length) ? (__uint32_t
)(((__uint32_t)(hdr->length) & 0xff) << 24 | ((__uint32_t
)(hdr->length) & 0xff00) << 8 | ((__uint32_t)(hdr
->length) & 0xff0000) >> 8 | ((__uint32_t)(hdr->
length) & 0xff000000) >> 24) : __swap32md(hdr->length
));
u_int32_t		 sas, das, usec;
u_int16_t		 tmp16, afi;
int			 r;
u_int8_t		 aid;

t.tv_sec = ntohl(hdr->timestamp)(__uint32_t)(__builtin_constant_p(hdr->timestamp) ? (__uint32_t
)(((__uint32_t)(hdr->timestamp) & 0xff) << 24 | (
(__uint32_t)(hdr->timestamp) & 0xff00) << 8 | ((
__uint32_t)(hdr->timestamp) & 0xff0000) >> 8 | (
(__uint32_t)(hdr->timestamp) & 0xff000000) >> 24
) : __swap32md(hdr->timestamp));
t.tv_nsec = 0;

/* handle the microsec field for _ET header */
if (ntohs(hdr->type)(__uint16_t)(__builtin_constant_p(hdr->type) ? (__uint16_t
)(((__uint16_t)(hdr->type) & 0xffU) << 8 | ((__uint16_t
)(hdr->type) & 0xff00U) >> 8) : __swap16md(hdr->
type)) == MSG_PROTOCOL_BGP4MP_ET) {
memcpy(&usec, b, sizeof(usec));
b += sizeof(usec);
len -= sizeof(usec);
t.tv_nsec = ntohl(usec)(__uint32_t)(__builtin_constant_p(usec) ? (__uint32_t)(((__uint32_t
)(usec) & 0xff) << 24 | ((__uint32_t)(usec) & 0xff00
) << 8 | ((__uint32_t)(usec) & 0xff0000) >> 8
 | ((__uint32_t)(usec) & 0xff000000) >> 24) : __swap32md
(usec)) * 1000;
}

switch (ntohs(hdr->subtype)(__uint16_t)(__builtin_constant_p(hdr->subtype) ? (__uint16_t
)(((__uint16_t)(hdr->subtype) & 0xffU) << 8 | ((
__uint16_t)(hdr->subtype) & 0xff00U) >> 8) : __swap16md
(hdr->subtype))) {
case BGP4MP_STATE_CHANGE:
if (len < 8)
	return (0);
/* source as */
memcpy(&tmp16, b, sizeof(tmp16));
b += sizeof(tmp16);
len -= sizeof(tmp16);
sas = ntohs(tmp16)(__uint16_t)(__builtin_constant_p(tmp16) ? (__uint16_t)(((__uint16_t
)(tmp16) & 0xffU) << 8 | ((__uint16_t)(tmp16) &
 0xff00U) >> 8) : __swap16md(tmp16));
/* dest as */
memcpy(&tmp16, b, sizeof(tmp16));
b += sizeof(tmp16);
len -= sizeof(tmp16);
das = ntohs(tmp16)(__uint16_t)(__builtin_constant_p(tmp16) ? (__uint16_t)(((__uint16_t
)(tmp16) & 0xffU) << 8 | ((__uint16_t)(tmp16) &
 0xff00U) >> 8) : __swap16md(tmp16));
/* if_index, ignored */
b += sizeof(tmp16);
len -= sizeof(tmp16);
/* afi */
memcpy(&tmp16, b, sizeof(tmp16));
b += sizeof(tmp16);
len -= sizeof(tmp16);
afi = ntohs(tmp16)(__uint16_t)(__builtin_constant_p(tmp16) ? (__uint16_t)(((__uint16_t
)(tmp16) & 0xffU) << 8 | ((__uint16_t)(tmp16) &
 0xff00U) >> 8) : __swap16md(tmp16));
break;
case BGP4MP_STATE_CHANGE_AS4:
if (len < 12)
	return (0);
/* source as */
memcpy(&sas, b, sizeof(sas));
b += sizeof(sas);
len -= sizeof(sas);
sas = ntohl(sas)(__uint32_t)(__builtin_constant_p(sas) ? (__uint32_t)(((__uint32_t
)(sas) & 0xff) << 24 | ((__uint32_t)(sas) & 0xff00
) << 8 | ((__uint32_t)(sas) & 0xff0000) >> 8 |
 ((__uint32_t)(sas) & 0xff000000) >> 24) : __swap32md
(sas));
/* dest as */
memcpy(&das, b, sizeof(das));
b += sizeof(das);
len -= sizeof(das);
das = ntohl(das)(__uint32_t)(__builtin_constant_p(das) ? (__uint32_t)(((__uint32_t
)(das) & 0xff) << 24 | ((__uint32_t)(das) & 0xff00
) << 8 | ((__uint32_t)(das) & 0xff0000) >> 8 |
 ((__uint32_t)(das) & 0xff000000) >> 24) : __swap32md
(das));
/* if_index, ignored */
b += sizeof(tmp16);
len -= sizeof(tmp16);
/* afi */
memcpy(&tmp16, b, sizeof(tmp16));
b += sizeof(tmp16);
len -= sizeof(tmp16);
afi = ntohs(tmp16)(__uint16_t)(__builtin_constant_p(tmp16) ? (__uint16_t)(((__uint16_t
)(tmp16) & 0xffU) << 8 | ((__uint16_t)(tmp16) &
 0xff00U) >> 8) : __swap16md(tmp16));
break;
default:
errx(1, "mrt_parse_state: bad subtype");
}

/* src & dst addr */
if ((aid = mrt_afi2aid(afi, -1, verbose)) == AID_UNSPEC0)
return (NULL((void *)0));

if ((s = calloc(1, sizeof(struct mrt_bgp_state))) == NULL((void *)0))
err(1, "calloc");
s->time = t;
s->src_as = sas;
s->dst_as = das;

if ((r = mrt_extract_addr(b, len, &s->src, aid)) == -1)
goto fail;
b += r;
len -= r;
if ((r = mrt_extract_addr(b, len, &s->dst, aid)) == -1)
goto fail;
b += r;
len -= r;

/* states */
memcpy(&tmp16, b, sizeof(tmp16));
b += sizeof(tmp16);
len -= sizeof(tmp16);
s->old_state = ntohs(tmp16)(__uint16_t)(__builtin_constant_p(tmp16) ? (__uint16_t)(((__uint16_t
)(tmp16) & 0xffU) << 8 | ((__uint16_t)(tmp16) &
 0xff00U) >> 8) : __swap16md(tmp16));
memcpy(&tmp16, b, sizeof(tmp16));
b += sizeof(tmp16);
len -= sizeof(tmp16);
s->new_state = ntohs(tmp16)(__uint16_t)(__builtin_constant_p(tmp16) ? (__uint16_t)(((__uint16_t
)(tmp16) & 0xffU) << 8 | ((__uint16_t)(tmp16) &
 0xff00U) >> 8) : __swap16md(tmp16));

return (s);

1167fail:
free(s);
return (NULL((void *)0));
1170}

1172struct mrt_bgp_msg *
1173mrt_parse_msg(struct mrt_hdr *hdr, void *msg, int verbose)
1174{
struct timespec		 t;
struct mrt_bgp_msg	*m;
u_int8_t		*b = msg;
u_int			 len = ntohl(hdr->length)(__uint32_t)(__builtin_constant_p(hdr->length) ? (__uint32_t
)(((__uint32_t)(hdr->length) & 0xff) << 24 | ((__uint32_t
)(hdr->length) & 0xff00) << 8 | ((__uint32_t)(hdr
->length) & 0xff0000) >> 8 | ((__uint32_t)(hdr->
length) & 0xff000000) >> 24) : __swap32md(hdr->length
));
u_int32_t		 sas, das, usec;
u_int16_t		 tmp16, afi;
int			 r, addpath = 0;
u_int8_t		 aid;

t.tv_sec = ntohl(hdr->timestamp)(__uint32_t)(__builtin_constant_p(hdr->timestamp) ? (__uint32_t
)(((__uint32_t)(hdr->timestamp) & 0xff) << 24 | (
(__uint32_t)(hdr->timestamp) & 0xff00) << 8 | ((
__uint32_t)(hdr->timestamp) & 0xff0000) >> 8 | (
(__uint32_t)(hdr->timestamp) & 0xff000000) >> 24
) : __swap32md(hdr->timestamp));
t.tv_nsec = 0;

/* handle the microsec field for _ET header */
if (ntohs(hdr->type)(__uint16_t)(__builtin_constant_p(hdr->type) ? (__uint16_t
)(((__uint16_t)(hdr->type) & 0xffU) << 8 | ((__uint16_t
)(hdr->type) & 0xff00U) >> 8) : __swap16md(hdr->
type)) == MSG_PROTOCOL_BGP4MP_ET) {
memcpy(&usec, b, sizeof(usec));
b += sizeof(usec);
len -= sizeof(usec);
t.tv_nsec = ntohl(usec)(__uint32_t)(__builtin_constant_p(usec) ? (__uint32_t)(((__uint32_t
)(usec) & 0xff) << 24 | ((__uint32_t)(usec) & 0xff00
) << 8 | ((__uint32_t)(usec) & 0xff0000) >> 8
 | ((__uint32_t)(usec) & 0xff000000) >> 24) : __swap32md
(usec)) * 1000;
}

switch (ntohs(hdr->subtype)(__uint16_t)(__builtin_constant_p(hdr->subtype) ? (__uint16_t
)(((__uint16_t)(hdr->subtype) & 0xffU) << 8 | ((
__uint16_t)(hdr->subtype) & 0xff00U) >> 8) : __swap16md
(hdr->subtype))) {
case BGP4MP_MESSAGE_ADDPATH:
case BGP4MP_MESSAGE_LOCAL_ADDPATH:
addpath = 1;
/* FALLTHROUGH */
case BGP4MP_MESSAGE:
case BGP4MP_MESSAGE_LOCAL:
if (len < 8)
	return (0);
/* source as */
memcpy(&tmp16, b, sizeof(tmp16));
b += sizeof(tmp16);
len -= sizeof(tmp16);
sas = ntohs(tmp16)(__uint16_t)(__builtin_constant_p(tmp16) ? (__uint16_t)(((__uint16_t
)(tmp16) & 0xffU) << 8 | ((__uint16_t)(tmp16) &
 0xff00U) >> 8) : __swap16md(tmp16));
/* dest as */
memcpy(&tmp16, b, sizeof(tmp16));
b += sizeof(tmp16);
len -= sizeof(tmp16);
das = ntohs(tmp16)(__uint16_t)(__builtin_constant_p(tmp16) ? (__uint16_t)(((__uint16_t
)(tmp16) & 0xffU) << 8 | ((__uint16_t)(tmp16) &
 0xff00U) >> 8) : __swap16md(tmp16));
/* if_index, ignored */
b += sizeof(tmp16);
len -= sizeof(tmp16);
/* afi */
memcpy(&tmp16, b, sizeof(tmp16));
b += sizeof(tmp16);
len -= sizeof(tmp16);
afi = ntohs(tmp16)(__uint16_t)(__builtin_constant_p(tmp16) ? (__uint16_t)(((__uint16_t
)(tmp16) & 0xffU) << 8 | ((__uint16_t)(tmp16) &
 0xff00U) >> 8) : __swap16md(tmp16));
break;
case BGP4MP_MESSAGE_AS4_ADDPATH:
case BGP4MP_MESSAGE_AS4_LOCAL_ADDPATH:
addpath = 1;
/* FALLTHROUGH */
case BGP4MP_MESSAGE_AS4:
case BGP4MP_MESSAGE_AS4_LOCAL:
if (len < 12)
	return (0);
/* source as */
memcpy(&sas, b, sizeof(sas));
b += sizeof(sas);
len -= sizeof(sas);
sas = ntohl(sas)(__uint32_t)(__builtin_constant_p(sas) ? (__uint32_t)(((__uint32_t
)(sas) & 0xff) << 24 | ((__uint32_t)(sas) & 0xff00
) << 8 | ((__uint32_t)(sas) & 0xff0000) >> 8 |
 ((__uint32_t)(sas) & 0xff000000) >> 24) : __swap32md
(sas));
/* dest as */
memcpy(&das, b, sizeof(das));
b += sizeof(das);
len -= sizeof(das);
das = ntohl(das)(__uint32_t)(__builtin_constant_p(das) ? (__uint32_t)(((__uint32_t
)(das) & 0xff) << 24 | ((__uint32_t)(das) & 0xff00
) << 8 | ((__uint32_t)(das) & 0xff0000) >> 8 |
 ((__uint32_t)(das) & 0xff000000) >> 24) : __swap32md
(das));
/* if_index, ignored */
b += sizeof(tmp16);
len -= sizeof(tmp16);
/* afi */
memcpy(&tmp16, b, sizeof(tmp16));
b += sizeof(tmp16);
len -= sizeof(tmp16);
afi = ntohs(tmp16)(__uint16_t)(__builtin_constant_p(tmp16) ? (__uint16_t)(((__uint16_t
)(tmp16) & 0xffU) << 8 | ((__uint16_t)(tmp16) &
 0xff00U) >> 8) : __swap16md(tmp16));
break;
default:
errx(1, "mrt_parse_msg: bad subtype");
}

/* src & dst addr */
if ((aid = mrt_afi2aid(afi, -1, verbose)) == AID_UNSPEC0)
return (NULL((void *)0));

if ((m = calloc(1, sizeof(struct mrt_bgp_msg))) == NULL((void *)0))
err(1, "calloc");
m->time = t;
m->src_as = sas;
m->dst_as = das;
m->add_path = addpath;

if ((r = mrt_extract_addr(b, len, &m->src, aid)) == -1)
goto fail;
b += r;
len -= r;
if ((r = mrt_extract_addr(b, len, &m->dst, aid)) == -1)
goto fail;
b += r;
len -= r;

/* msg */
if (len > 0) {
m->msg_len = len;
if ((m->msg = malloc(len)) == NULL((void *)0))
	err(1, "malloc");
memcpy(m->msg, b, len);
}

return (m);

1284fail:
free(m->msg);
free(m);
return (NULL((void *)0));
1288}