[ net-snmp-Bugs-2873858 ] Segfault on 5.4.2.1 (Redhat) when using DISMAN-SCHEDULE-MIB

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 454-5900

Bugs item #2873858, was opened at 2009-10-06 23:38
Message generated for change (Tracker Item Submitted) made by perldork
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112694&aid=2873858&group_id=12694

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Max Schubert (perldork)
Assigned to: Nobody/Anonymous (nobody)
Summary: Segfault on 5.4.2.1 (Redhat) when using DISMAN-SCHEDULE-MIB 

Initial Comment:
Potential patch attached.   Code pre-patch assumed that a macro was a function and passed in a conditional as an argument .. the conditional was being interpreted incorrectly and passing a truth value to the function when it was a expecting a (u_char *).

Problem details below.

Trying to schedule the agent to call an SNMP set on a module that is
implemented through the agent using the pass_persist framework:
* We can call the SET from the command line using snmpset without issue
* Using symbolic OIDs for built-in MIBs does *NOT* trigger the
segfault (for example, the example in the Net-SNMP documentation to
trigger the agent to re-read it's configuration works fine).
* Using either a numeric or symbolic OID for our pass_persist module
triggers the error

If I remove the schedule entry (either repeat or cron) the agent
starts and runs as expected.

This happens on both the CentOS and RHEL versions of the 5.4.2.1 agent.

I have searched and am not finding other people having this issue.

Am I doing something wrong?  What would you recommend I do next to try
and troubleshoot / debug this, the DISMAN-SCHEDULE-MIB is
functionality we really want to use :) and I would be happy to help
fix this if this is indeed a bug and not just another user error :p.

Example:

snmpd.conf:
repeat 30 .1.3.6.1.4.1.1720.21.2.1.1.2.1.1.1 = 1

   strace -o snmpd.out /usr/sbin/snmpd -f -Lf /dev/stdout \
       -Ducd-snmp/pass_persist \
       -Dschedule

>From the agent:
registered debug token ucd-snmp/pass_persist, 1
registered debug token schedule, 1
(SEGFAULT)

Strace output (last 50 lines):

ead(11, "SNMP-NOTIFICATION-MIB DEFINITION"..., 4096) = 4096
read(11, "AX      SnmpAdminString (SIZE(1."..., 4096) = 4096
read(11, "orageType\n    MAX-ACCESS  read-c"..., 4096) = 4096
read(11, "        i.e., any sub-identifier"..., 4096) = 4096
read(11, "CCESS    read-only\n        DESCR"..., 4096) = 3630
read(11, "", 4096)                      = 0
close(11)                               = 0
munmap(0xb7381000, 4096)                = 0
open("/usr/share/snmp/mibs/SNMPv2-TM.txt", O_RDONLY|O_LARGEFILE) = 11
fstat64(11, {st_mode=S_IFREG|0644, st_size=5775, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0xb7381000
read(11, "SNMPv2-TM DEFINITIONS ::= BEGIN\n"..., 4096) = 4096
read(11, "'n' as an unsigned integer\n     "..., 4096) = 1679
read(11, "", 4096)                      = 0
close(11)                               = 0
munmap(0xb7381000, 4096)                = 0
open("/etc/snmp/snmpd.conf", O_RDONLY|O_LARGEFILE) = 11
fstat64(11, {st_mode=S_IFREG|0644, st_size=1079, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0xb7381000
read(11, "rwcommunity local\nagentaddress 0"..., 4096) = 1079
brk(0x8470000)                          = 0x8470000
brk(0x846f000)                          = 0x846f000
open("/etc/resolv.conf", O_RDONLY)      = 12
fstat64(12, {st_mode=S_IFREG|0644, st_size=151, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0xb7380000
read(12, "; generated by /sbin/dhclient-sc"..., 4096) = 151
read(12, "", 4096)                      = 0
close(12)                               = 0
munmap(0xb7380000, 4096)                = 0
ocket(PF_FILE, SOCK_STREAM, 0)         = 12
fcntl64(12, F_GETFL)                    = 0x2 (flags O_RDWR)
fcntl64(12, F_SETFL, O_RDWR|O_NONBLOCK) = 0
connect(12, {sa_family=AF_FILE, path="/var/run/nscd/socket"}, 110) = 0
poll([{fd=12, events=POLLOUT|POLLERR|POLLHUP}], 1, 5000) = 1 ([{fd=12,
revents=POLLOUT}]
)
send(12, "\2\0\0\0\r\0\0\0\6\0\0\0hosts\0", 18, MSG_NOSIGNAL) = 18
poll([{fd=12, events=POLLIN|POLLERR|POLLHUP}], 1, 5000) = 1 ([{fd=12,
revents=POLLIN}])
recvmsg(12, {msg_name(0)=NULL, msg_iov(1)=[{"hosts\0", 6}],
msg_controllen=16, {cmsg_len
=16, cmsg_level=SOL_SOCKET, cmsg_type=SCM_RIGHTS, {13}}, msg_flags=0}, 0) = 6
fstat64(13, {st_mode=S_IFREG|0600, st_size=217016, ...}) = 0
pread64(13, "\1\0\0\0h\0\0\0\0<\0\0\1\0\0\0\345\273\222J\0\0\0\0\323\0\0\0\0L\3\0"...,
1
04, 0) = 104
mmap2(NULL, 217016, PROT_READ, MAP_SHARED, 13, 0) = 0xb734c000
close(13)                               = 0
close(12)                               = 0
socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 12
uname({sys="Linux", node="vm-nagios-mschuber", ...}) = 0
getsockopt(12, SOL_SOCKET, SO_SNDBUF, [109568], [4]) = 0
getsockopt(12, SOL_SOCKET, SO_RCVBUF, [109568], [4]) = 0
bind(12, {sa_family=AF_INET, sin_port=htons(0),
sin_addr=inet_addr("127.0.0.1")}, 16) =
0
pipe([13, 14])                          = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV (core dumped) +++

0  0x006fe285 in memmove () from /lib/libc.so.6
#1  0x00cc1b22 in snmp_set_var_value (vars=0x95d19d0,
   value=0x1 <Address 0x1 out of bounds>, len=10) at snmp_client.c:895
#2  0x00cf1caa in snmp_varlist_add_variable (varlist=0x9583300, name=0x0,
   name_length=0, type=4 '\004', value=0x1 <Address 0x1 out of bounds>, len=10)
   at snmp_api.c:6564
#3  0x0017a88b in schedTable_createEntry (schedOwner=0x1fc438 "snmpd.conf",
   schedName=0xbf89507c "_conf001") at disman/schedule/schedCore.c:468
#4  0x0017aec2 in parse_sched_periodic (token=0xbf895920 "repeat", line=0x0)
   at disman/schedule/schedConf.c:90
#5  0x00d0426b in run_config_handler (lptr=0x9525100, token=0xbf895920 "repeat",
   cptr=0xbf895d27 "30 .1.3.6.1.4.1.1720.21.2.1.1.2.1.1.1 = 1", when=0)
   at read_config.c:507
#6  0x00d051a2 in read_config (filename=0x95986a8 "/etc/snmp/snmpd.conf",
   line_handler=0x94cd398, when=0) at read_config.c:797
#7  0x00d03f91 in read_config_with_type_when (
   filename=0x95986a8 "/etc/snmp/snmpd.conf", type=0x94cd008 "snmpd", when=0)
   at read_config.c:456
#8  0x00d05512 in read_configs_optional (
   optional_config=0x94cd1f0 "/etc/snmp/snmpd.conf", when=0) at
read_config.c:844
#9  0x00d05671 in read_configs () at read_config.c:871
#10 0x00cdfa53 in init_snmp (type=0x804d890 "snmpd") at snmp_api.c:811
#11 0x0804bd3b in main (argc=9, argv=0xbf896434) at snmpd.c:925

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112694&aid=2873858&group_id=12694