Menu

#2823 Python: session.get(vars) segfaults if not a List

debian
open
nobody
None
5
2018-05-07
2018-02-01
No

Hi,
we happened to find that:

>>> import netsnmp
>>> session = netsnmp.Session( DestHost='demo.snmplabs.com', Version=2, Community='public' )
>>> vars = netsnmp.Varbind('1.3.6.1.2.1.43.10.2.1.4.1.1')
>>> session.get(vars)
Segmentation fault (core dumped)

The same with a list works:

>>> vars = netsnmp.VarList( netsnmp.Varbind('1.3.6.1.2.1.43.10.2.1.4.1.1') )
[...]

Looking at the code in python/netsnmp/client_intf.c I think I found the reason.
If it is not an object it can get an iterator from it unconditionally tries to dereference a NULL pointer.

The following patch would fix that:

--- a/python/netsnmp/client_intf.c
+++ b/python/netsnmp/client_intf.c
@@ -1559,6 +1559,13 @@ netsnmp_getnext(PyObject *self, PyObject *args)

     if (varlist) {
       PyObject *varlist_iter = PyObject_GetIter(varlist);
+      if (varlist_iter == NULL) {
+        if (verbose) {
+          printf("error: can't get iterator for varlist");
+          snmp_free_pdu(pdu);
+          goto done;
+        }
+      }

       while (varlist_iter && (varbind = PyIter_Next(varlist_iter))) {
        if (py_netsnmp_attr_string(varbind, "tag", &tag, NULL) < 0 ||

Please consider adding that to the next minor release as a bug fix.

Discussion

  • Bill Fenner

    Bill Fenner - 2018-03-28
    • Description has changed:

    Diff:

    --- old
    +++ new
    @@ -1,19 +1,24 @@
     Hi,
     we happened to find that:
    +~~~
     >>> import netsnmp
     >>> session = netsnmp.Session( DestHost='demo.snmplabs.com', Version=2, Community='public' )
     >>> vars = netsnmp.Varbind('1.3.6.1.2.1.43.10.2.1.4.1.1')
     >>> session.get(vars)
     Segmentation fault (core dumped)
    +~~~
    
     The same with a list works:
    +~~~
     >>> vars = netsnmp.VarList( netsnmp.Varbind('1.3.6.1.2.1.43.10.2.1.4.1.1') )
     [...]
    +~~~
    
     Looking at the code in python/netsnmp/client_intf.c I think I found the reason.
     If it is not an object it can get an iterator from it unconditionally tries to dereference a NULL pointer.
    
     The following patch would fix that:
    +~~~
     --- a/python/netsnmp/client_intf.c
     +++ b/python/netsnmp/client_intf.c
     @@ -1559,6 +1559,13 @@ netsnmp_getnext(PyObject *self, PyObject *args)
    @@ -31,4 +36,5 @@
            while (varlist_iter && (varbind = PyIter_Next(varlist_iter))) {
             if (py_netsnmp_attr_string(varbind, "tag", &tag, NULL) < 0 ||
    
    +~~~
     Please consider adding that to the next minor release as a bug fix.
    
     
  • Ian Bruene

    Ian Bruene - 2018-04-02

    There is a fix for this in patch 1356

     
  • Bart Van Assche

    Bart Van Assche - 2018-05-06

    With which Net-SNMP version did this occur? The Python code mentioned above runs fine against the Net-SNMP 5.7 Python extension code.

     
  • Christian Ehrhardt

    Thanks Ian to spin a patch from this bug report.
    @Bart - must have been net-snmp 5.7.3 and as discussed in patch 1356 the issue still exists for me. The patch attached on 1356 seems to resolve the issue for me as initially reported

    Note to myself for next time, this is from LP #1541152

     
  • Bart Van Assche

    Bart Van Assche - 2018-05-07
    • summary: session.get(vars) segfaults if not a List --> Python: session.get(vars) segfaults if not a List
     
  • Bart Van Assche

    Bart Van Assche - 2018-05-07

    I can't reproduce this segmentation fault - neither with the latest version of the v5.7 branch nor with the HEAD of the master branch. The attached patch introduces two Python regression test failures.

     

Log in to post a comment.