I managed to get collectd to segfault in a couple of places while playing with it a bit. The first is in the curl_xml module when the XPATH expression doesn't quite match the input. The crash occurs on line 407 when instance_node->nodeTab[0] is dereferenced. At this point, all members of instance_node are 0, so dereferencing the array isn't a good idea. This patch fixes the problem, although I'm not sure if this particular case actually deserves its own error message:
diff --git a/src/curl_xml.c b/src/curl_xml.c
index 2a36608..2b1d247 100644
--- a/src/curl_xml.c
+++ b/src/curl_xml.c
@@ -385,7 +385,7 @@ static int cx_handle_instance_xpath (xmlXPathContextPtr
xpath_ctx, /* {{{ */
instance_node = instance_node_obj->nodesetval;
tmp_size = (instance_node) ? instance_node->nodeNr : 0;
- if ( (tmp_size == 0) && (is_table) )
+ if (tmp_size == 0)
{
WARNING ("curl_xml plugin: "
"relative xpath expression for 'InstanceFrom' \"%s\" doesn't match "
The second problem occurred once in stop_write_threads() during shutdown, in
this
loop:
for (q = write_queue_head; q != NULL; q = q->next)
{
plugin_value_list_free (q->vl);
sfree (q);
i++;
}
Once q has been freed by sfree(), it's no longer safe to dereference in the
for statement. I'm attaching a fix for that.
On a side note, the check for NULL in sfree() isn't actually necessary--ANSI C
specifies that free() must be safe when given a NULL pointer.
>>> Dan
From 43ed73d243635a86e5e72da434092f578d593269 Mon Sep 17 00:00:00 2001
From: Dan Fandrich <d...@coneharvesters.com>
Date: Mon, 4 Feb 2013 23:59:41 +0100
Subject: [PATCH] Fix a NULL pointer dereference during shutdown
---
src/plugin.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/plugin.c b/src/plugin.c
index 7037234..942f8bf 100644
--- a/src/plugin.c
+++ b/src/plugin.c
@@ -810,10 +810,12 @@ static void stop_write_threads (void) /* {{{ */
pthread_mutex_lock (&write_lock);
i = 0;
- for (q = write_queue_head; q != NULL; q = q->next)
+ for (q = write_queue_head; q != NULL; )
{
+ write_queue_t *q1 = q;
plugin_value_list_free (q->vl);
- sfree (q);
+ q = q->next;
+ sfree (q1);
i++;
}
write_queue_head = NULL;
--
1.7.10
pgpV4CmAY7ouh.pgp
Description: PGP signature
_______________________________________________ collectd mailing list collectd@verplant.org http://mailman.verplant.org/listinfo/collectd
