[Xymon] Segfault in confreport-critical.sh / confreport.cgi in 4.3.24 (now with backtrace)

[J.C. Cleaver]

On Thu, December 10, 2015 5:59 am, Axel Beckert wrote:
> Hi,
>
> On Thu, Dec 10, 2015 at 01:45:49PM +0100, Axel Beckert wrote:
>> I don't have a proper backtrace (yet), but I had look at the source
>> code and I'm quite confident that the issue is inside the function
>> print_alert_recipients() starting at lib/loadalerts.c, line 1124.
>
> Here's the according backtrace. Doesn't look too helpful to me,
> though:
>
> # gdb /usr/lib/xymon/server/bin/confreport.cgi
> ./207855-33-33-11-1449754874-silberspitz--usr-lib-xymon-server-bin-confreport.cgi.core
> GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
> [...]
> Reading symbols from /usr/lib/xymon/server/bin/confreport.cgi...Reading
> symbols from
> /usr/lib/debug/.build-id/f2/5c37643ea6a391c09535cc250d18cef4aa39cf.debug...done.
> done.
> [New LWP 207855]
> [Thread debugging using libthread_db enabled]
> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
> Core was generated by `/usr/lib/xymon/server/bin/confreport.cgi
> --env=/usr/lib/xymon/server/etc/xymons'.
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  strlen () at ../sysdeps/x86_64/strlen.S:106
> 106     ../sysdeps/x86_64/strlen.S: No such file or directory.
> (gdb) bt
> #0  strlen () at ../sysdeps/x86_64/strlen.S:106
> #1  0x0000000000403640 in print_host (testcount=18, testnames=0x167dcc0,
> host=0x166b070) at confreport.c:310
> #2  main (argc=<optimized out>, argv=<optimized out>) at confreport.c:876
>
> Line 310 of web/confreport.c looks liek this:
>
>   newitem->visualdata = (char *)realloc(newitem->visualdata,
> strlen(newitem->visualdata) + strlen(visdata) + 5);
>
> So do I read the backtrace correctly that there was no proper value
> (e.g. a null pointer) was passed to strlen()?
>
> Then again I also don't find any file named strlen.S on the system
> where I build the packages either. (But it seems to be part of glibc's
> source code.)
>
> 		Kind regards, Axel Beckert


Hmm,

Well, that's different from loadalerts.c, but there does seem to be a
problem there.

Can you see if this patch helps?

-jc
-------------- next part --------------
A non-text attachment was scrubbed...
Name: confreport.patch
Type: text/x-patch
Size: 850 bytes
Desc: not available
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20151210/a97a8fd4/attachment.bin>