[Pkg-net-snmp-devel] Bug#567982: *** glibc detected *** snmpwalk: free(): invalid next size (normal): 0x083cccb8 ***

[Ferenc Wagner]

Package: snmp
Version: 5.4.2.1~dfsg-5+b1
Severity: normal

Hi,

with the following /root/.snmp/snmp.conf:

mibdirs -/root/.snmp/mibs
defSecurityName xxxx
defSecurityLevel authPriv
defAuthType MD5
defAuthPassphrase xxxx
defPrivType DES
defPrivPassphrase xxxx
mibs -BLADE-MIB

and a nonexistent /root/.snmp/mibs directory this happens:

# snmpwalk -v1 -c public 1.2.3.4 bladeName
*** glibc detected *** snmpwalk: free(): invalid next size (normal): 0x08ad1cb8 ***
======= Backtrace: =========
/lib/i686/cmov/libc.so.6[0xb75cb824]
/lib/i686/cmov/libc.so.6[0xb75cd0b3]
/lib/i686/cmov/libc.so.6(cfree+0x6d)[0xb75d00ad]
/lib/i686/cmov/libc.so.6[0xb75bc400]
/lib/i686/cmov/libc.so.6(fopen64+0x2c)[0xb75beb3c]
/usr/lib/libnetsnmp.so.15(read_config+0x61)[0xb76f8aa1]
/usr/lib/libnetsnmp.so.15[0xb76f9706]
/usr/lib/libnetsnmp.so.15(read_config_files+0x102)[0xb76f9a92]
/usr/lib/libnetsnmp.so.15(read_premib_configs+0x168)[0xb76fa558]
/usr/lib/libnetsnmp.so.15(init_snmp+0x37d)[0xb76dc1cd]
/usr/lib/libnetsnmp.so.15(snmp_parse_args+0xeb1)[0xb76f1781]
snmpwalk[0x80490d6]
/lib/i686/cmov/libc.so.6(__libc_start_main+0xe5)[0xb7576b55]
snmpwalk[0x8048bc1]
======= Memory map: ========
08048000-0804a000 r-xp 00000000 fe:09 3414693    /usr/bin/snmpwalk
0804a000-0804b000 rw-p 00001000 fe:09 3414693    /usr/bin/snmpwalk
08ace000-08aef000 rw-p 00000000 00:00 0          [heap]
b7100000-b7121000 rw-p 00000000 00:00 0 
b7121000-b7200000 ---p 00000000 00:00 0 
b728d000-b72a9000 r-xp 00000000 fe:06 524440     /lib/libgcc_s.so.1
b72a9000-b72aa000 rw-p 0001c000 fe:06 524440     /lib/libgcc_s.so.1
b72aa000-b73ef000 r--p 00000000 fe:09 84331      /usr/lib/locale/locale-archive
b73ef000-b73f0000 rw-p 00000000 00:00 0 
b73f0000-b7403000 r-xp 00000000 fe:09 1003       /usr/lib/libz.so.1.2.3.4
b7403000-b7404000 rw-p 00013000 fe:09 1003       /usr/lib/libz.so.1.2.3.4
b7404000-b7406000 r-xp 00000000 fe:06 1174537    /lib/i686/cmov/libdl-2.10.2.so
b7406000-b7407000 r--p 00001000 fe:06 1174537    /lib/i686/cmov/libdl-2.10.2.so
b7407000-b7408000 rw-p 00002000 fe:06 1174537    /lib/i686/cmov/libdl-2.10.2.so
b7408000-b7545000 r-xp 00000000 fe:09 1077385    /usr/lib/i686/cmov/libcrypto.so.0.9.8
b7545000-b755c000 rw-p 0013d000 fe:09 1077385    /usr/lib/i686/cmov/libcrypto.so.0.9.8
b755c000-b7560000 rw-p 00000000 00:00 0 
b7560000-b76a1000 r-xp 00000000 fe:06 1174529    /lib/i686/cmov/libc-2.10.2.so
b76a1000-b76a3000 r--p 00141000 fe:06 1174529    /lib/i686/cmov/libc-2.10.2.so
b76a3000-b76a4000 rw-p 00143000 fe:06 1174529    /lib/i686/cmov/libc-2.10.2.so
b76a4000-b76a7000 rw-p 00000000 00:00 0 
b76a7000-b773a000 r-xp 00000000 fe:09 218769     /usr/lib/libnetsnmp.so.15.1.2
b773a000-b773d000 rw-p 00092000 fe:09 218769     /usr/lib/libnetsnmp.so.15.1.2
b773d000-b775b000 rw-p 00000000 00:00 0 
b775e000-b7760000 rw-p 00000000 00:00 0 
b7760000-b7761000 r-xp 00000000 00:00 0          [vdso]
b7761000-b777d000 r-xp 00000000 fe:06 563808     /lib/ld-2.10.2.so
b777d000-b777e000 r--p 0001b000 fe:06 563808     /lib/ld-2.10.2.so
b777e000-b777f000 rw-p 0001c000 fe:06 563808     /lib/ld-2.10.2.so
bff10000-bff25000 rw-p 00000000 00:00 0          [stack]
Aborted

The above config is certainly broken, but illegal memory access still isn't
acceptable behaviour in my opinion.

Thanks,
Feri.

-- System Information:
Debian Release: 5.0.3
  APT prefers stable
  APT policy: (500, 'stable'), (50, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-trunk-686 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash