<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> <body> <div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Hi Team,</div> <div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> This is a gentle follow-up on my earlier mail regarding the Fortify static analysis findings in DPDK, for which I had also raised Bug 1748.</div> <div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Could you please let us know if there is any update or guidance from the community/maintainers on whether these are known false positives or if they need further investigation.</div> <div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Thank you for your time and support.</div> <div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Regards,</div> <div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Nagendra</div> <div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div id="ms-outlook-mobile-signature" dir="ltr"></div> <div id="mail-editor-reference-message-container"> <div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> </div> <div class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left; padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; font-family: Aptos; font-size: 12pt; color: black;"> <b><br> <p style="font-family:Calibri;font-size:10pt;color:#000000;margin:5pt;font-style:normal;font-weight:normal;text-decoration:none;" align="Left"> Confidential – Oracle Internal<br> </p> From: </b>NAGENDRA BALAGANI <nagendra.balagani@oracle.com><br> <b>Date: </b>Friday, 10 October 2025 at 4:46 PM<br> <b>To: </b>users@dpdk.org <users@dpdk.org><br> <b>Cc: </b>Kapil Kumar Jain <kapil.k.jain@oracle.com><br> <b>Subject: </b>Clarification on Possible Buffer Overflow Issues Reported by Fortify Tool<br> <br> </div> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Hi Team,</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> </p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> While running Fortify static code analysis on our codebase, which uses DPDK, we noticed some potential buffer overflow issues being flagged in DPDK library calls. These seem like false positives at first glance, but we want to double-check with the community and maintainers to make sure there are no hidden issues.</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> </p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Could you please review these findings or let us know if there are any known false positives related to this. I raised a Bug <span style="color: rgb(5, 99, 193);"><u><a href="https://bugs.dpdk.org/show_bug.cgi?id=1748" data-outlook-id="18b6545e-c485-45fc-bc41-0fd6c2e8e202" style="color: rgb(5, 99, 193); margin-top: 0px; margin-bottom: 0px;">https://bugs.dpdk.org/show_bug.cgi?id=1748</a></u></span> for the same.</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> </p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> here are the detailed Fortify reports with exact file paths and line numbers for your reference.</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> <b>### Instance 1: rte_crypto.h Line 207</b></p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> memset(op->asym, 0, sizeof(struct rte_crypto_asym_op));</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> </p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Tool Description : The function __rte_crypto_op_reset() in rte_crypto.h writes outside the bounds of asym on line 207, which could corrupt data, cause the program to crash, or lead to the execution of malicious code.</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> </p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Analysis Trace</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> rte_crypto.h:181 - Buffer asym Declared</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> rte_crypto.h:207 - memset()</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Buffer Size: 0 bytes Write Length: 168 bytes</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> </p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> <b>### Instance 2: rte_crypto_sym.h: 885</b></p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> memset(op, 0, sizeof(*op));</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Tool Description: The program writes outside the bounds of allocated memory, which could corrupt data, crash the program, or lead to the execution of malicious code.</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Analysis Trace</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> rte_crypto.h:204 - Caller: __rte_crypto_op_reset</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Buffer Size: 0</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> rte_crypto_sym.h:885 - memset()</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Buffer Size: 0 bytes Write Length: 64 bytes [var 0] op.$offset: 0</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> </p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> <b>### Instance3: rte_lpm.h: 347</b></p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> tbl24_indexes[i] = ips[i] >> 8;</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Tool Description: The function rte_lpm_lookup_bulk_func() in rte_lpm.h writes outside the bounds of tbl24_indexes on line 347, which could corrupt data, cause the program to crash, or lead to the execution of malicious code.</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Analysis Trace</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> rte_lpm.h:339 - Buffer tbl24_indexes Allocated</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> rte_lpm.h:347 - Assignment to tbl24_indexes</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Buffer Size: 262143 bytes Write Length: 1048572 bytes [var 0] tbl24_indexes.$offset: 0 [var 1] i: 262142</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Thank you in advance for your support and guidance.</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> Regards,<br> Nagendra</p> <p class="MsoNormal" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 12pt;"> </p> </div> </body> </html>