ping
On 11/1/18 11:57 AM, Martijn van Duren wrote:
> When experimenting with snmpd I found the following crash:
> $ snmpctl snmp walk 127.0.0.1 oid 1
> Segmentation fault (core dumped)
>
> The problem is a NULL dereference in ber_free_elements:
> #0 0x00000370920d24ca in ber_free_elements (root=0x0) at
> /usr/src/usr.sbin/snmpctl/../snmpd/ber.c:897
> #1 0x00000370920d4386 in ber_printf_elements (ber=0x0, fmt=0x370920c79b9
> "0}}") at /usr/src/usr.sbin/snmpctl/../snmpd/ber.c:645
> #2 0x00000370920dbd0d in snmpc_sendreq (sc=0x7f7ffffbdcf0, type=1) at
> /usr/src/usr.sbin/snmpctl/snmpclient.c:413
> #3 0x00000370920dba93 in snmpc_request (sc=0x7f7ffffbdcf0, type=1) at
> /usr/src/usr.sbin/snmpctl/snmpclient.c:217
> #4 0x00000370920dba38 in snmpc_run (sc=0x7f7ffffbdcf0, action=WALK,
> oid=0x373171110e0 "1") at /usr/src/usr.sbin/snmpctl/snmpclient.c:207
> #5 0x00000370920db891 in snmpclient (res=0x3709211f4e8) at
> /usr/src/usr.sbin/snmpctl/snmpclient.c:175
> #6 0x00000370920dc8b4 in main (argc=5, argv=0x7f7ffffbe1a0) at
> /usr/src/usr.sbin/snmpctl/snmpctl.c:133
>
> A simple NULL-check fixes the issue, but since I'm new to BER and snmp
> I'm not sure if this is the right approach or whether there's a logic-
> fault somewhere else.
>
> $ ./snmpctl snmp walk 127.0.0.1 oid 1
> snmpctl: request failed: Invalid argument
>
> martijn@
>
> Index: ber.c
> ===================================================================
> RCS file: /cvs/src/usr.sbin/snmpd/ber.c,v
> retrieving revision 1.48
> diff -u -p -r1.48 ber.c
> --- ber.c 12 Aug 2018 22:04:09 -0000 1.48
> +++ ber.c 1 Nov 2018 10:56:47 -0000
> @@ -894,6 +894,8 @@ ber_free_element(struct ber_element *roo
> void
> ber_free_elements(struct ber_element *root)
> {
> + if (root == NULL)
> + return;
> if (root->be_sub && (root->be_encoding == BER_TYPE_SEQUENCE ||
> root->be_encoding == BER_TYPE_SET))
> ber_free_elements(root->be_sub);
>
