Re: how should agents handle an 'out-of-range' index ?

On Wed, Sep 15, 2010 at 9:27 AM, Fulko Hew <[email protected]> wrote:
> On Tue, Sep 14, 2010 at 11:55 AM, Fulko Hew <[email protected]> wrote:
>
> ... snip ...
>
>> When I ran this test (snmpgetnext), the agent died and needed to be
>> restarted
>>
>> snmpgetnext -v1 -cpublic -Ir localhost
1.3.6.1.4.1.2021.8.1.103.4294967295

... snip ...

Following up on my previous email to the net-snmp-users list,
I've added the coders list too...

Applying a debugger to the problem, I have narrowed it down to line 1397 of
./net-snmp-5.6.rc2/agent/mibgroup/agent/extend.c
where it performs a strlen() on a non-existent memory location
(where a command string is supposed to reside).

But since the index is so large, the code at line 1363 blindly follows
the index given.

There should be some check in here to prevent the code from continuing
and instead return the appropriate indication to upper levels to
'go to the next variable'.

  idx = name[*length-1] -1;
  exten = &compatability_entries[ idx ];
   if (exten) {
      switch (vp->magic) {
...
      case ERRORFIXCMD:
           if (exten->efix_entry) {
              *var_len = strlen(exten->efix_entry->command);
               return ((u_char *) exten->efix_entry->command);
          } else {
               *var_len = 0;
              return ((u_char *) &long_return);  /* Just needs to be
non-null! */
           }

Further investigation reveals that there is a variable defined as
max_compatability_entries = 50
that appears to define the number of entries that can appear in the table.

Perhaps the following code snippet could avoid the issue:

   idx = name[*length-1] -1;
  if (idx > max_compatability_entries)       <-- new
       return NULL;                           <-- new
  exten = &compatability_entries[ idx ];

Since I don't yet know if compatability_entries[] is a statically
sized table, or dynamic, the above may or may not be appropriate,
or there may be a more correct place to address the issue.

I have submitted a bug report #3066862 on this issue.

https://sourceforge.net/tracker/?func=detail&atid=112694&aid=3066862&group_id=12694

------------------------------------------------------------------------------
Start uncovering the many advantages of virtual appliances
and start using them to simplify application deployment and
accelerate your shift to cloud computing.
http://p.sf.net/sfu/novell-sfdev2dev

_______________________________________________
Net-snmp-coders mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/net-snmp-coders