[hobbit] Error in hobbitdboard request crashes hobbitd

[Henrik Stoerner]

On Fri, Jul 14, 2006 at 12:01:32PM +0200, Thomas Schenk wrote:
> 
> I am testing the 4.2-RC on Linux 2.6.15. Trying all the new features
> (thanks, henrik!) I sent a hobbitdboard request with an error in it:
> 
> bb $BBDISP "hobbitdboard status=yellow"
> (should have been color=yellow)
> 
> This causes the hobbitd process to crash with a segmentation fault.

Thanks, this is indeed a bug. A patch is available on the betapatches
page at http://www.hswn.dk/hobbitsw/betapatches/


Regards,
Henrik

-------------- next part --------------
--- hobbitd/hobbitd.c	2006/07/08 10:39:15	1.245
+++ hobbitd/hobbitd.c	2006/07/14 10:45:36
@@ -25,7 +25,7 @@
 /*                                                                            */
 /*----------------------------------------------------------------------------*/
 
-static char rcsid[] = "$Id: hobbitd.c,v 1.245 2006/07/08 10:39:15 henrik Exp $";
+static char rcsid[] = "$Id: hobbitd.c,v 1.247 2006/07/14 10:45:22 henrik Exp $";
 
 #include <limits.h>
 #include <sys/time.h>
@@ -2054,22 +2054,22 @@
 			tname = strrchr(tok, '.');
 			if (tname) { *tname = '\0'; tname++; }
 			s = hname; while ((s = strchr(s, ',')) != NULL) *s = '.';
-
 			hname = knownhost(hname, hostip, ghosthandling);
-			if (hname) {
+
+			if (hname && tname) {
 				hnameexp = (char *)malloc(strlen(hname)+3);
 				sprintf(hnameexp, "^%s$", hname);
 				*shost = compileregex(hnameexp);
 				xfree(hnameexp);
-			}
 
-			tnameexp = (char *)malloc(strlen(tname)+3);
-			sprintf(tnameexp, "^%s$", tname);
-			*stest = compileregex(tnameexp);
-			xfree(tnameexp);
+				tnameexp = (char *)malloc(strlen(tname)+3);
+				sprintf(tnameexp, "^%s$", tname);
+				*stest = compileregex(tnameexp);
+				xfree(tnameexp);
 
-			if (chshost) *chshost = hname;
-			if (chstest) *chstest = tname;
+				if (chshost) *chshost = hname;
+				if (chstest) *chstest = tname;
+			}
 		}
 
 		tok = strtok(NULL, " \t\r\n");
@@ -3186,6 +3186,7 @@
 		char *hostname = NULL, *clientos = NULL, *clientclass = NULL;
 		char *hname = NULL;
 		char *line1, *p;
+		char savech;
 
 		msgfrom = strstr(msg->buf, "\nStatus message received from ");
 		if (msgfrom) {
@@ -3193,8 +3194,16 @@
 			*msgfrom = '\0';
 		}
 
-		p = strchr(msg->buf, '\n'); if (p) *p = '\0';
-		line1 = strdup(msg->buf); if (p) *p = '\n';
+		p = msg->buf + strcspn(msg->buf, "\r\n");
+		if ((*p == '\r') || (*p == '\n')) {
+			savech = *p;
+			*p = '\0';
+		}
+		else {
+			p = NULL;
+		}
+		line1 = strdup(msg->buf); if (p) *p = savech;
+
 		p = strtok(line1, " \t"); /* Skip the client keyword */
 		if (p) hostname = strtok(NULL, " \t"); /* Actually, HOSTNAME.CLIENTOS */
 		if (hostname) {