[Pkg-net-snmp-devel] Bug#344979: /usr/sbin/snmpd: snmpd segfaults after getting trap from smux peer on amd64

[Alexander Prokoshev]

Package: snmpd
Version: 5.2.3-7
Followup-For: Bug #344979

snmpd immediately gets SIGSEGV after receiving message from SMUX peer 
(namely, bgpd of Quagga suite).

I've attached core file (gdb says about it following:                      
Program terminated with signal 11, Segmentation fault.                     
#0  0x00002ad923147c4a in asn_parse_objid () from /usr/lib/libnetsnmp.so.9 
).                                                                         
ltrace of snmpd process when sending trap to it follows:                   

== begin ltrace output ==                                                                    
select(21, [3 5 8 12 13 14 15 16 17 18 19 20], [], [], {22, 116000}) = 1 (in [20], left {16, 
516000})                                                                                     
recvfrom(20, "\244\202S~+\6\1\4\1\231u\1\2\2@\4\0\0\0\0\2\1\6\2\1\2C\1\0000\202S_0\202\0\26\6
\20+\6\1\2\1\17\3\1\16W\201b\201#\201\r\4\2\0\0\0\0\0\0\6\20+\6\1\2\1\17\3\1\2W\201b\201#\201
\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1500, 0, NULL
, NULL) = 1500                                                                               
write(10, "Got trap from peer on fd 20\n", 28) = 28                                          
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=815, ...}) = 0                         
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=815, ...}) = 0                         
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=815, ...}) = 0                         
sendto(11, "<30>Feb 25 19:07:57 snmpd[15201]: Got trap from peer on fd 20\n", 62, MSG_NOSIGNA
L, NULL, 0) = 62                                                                             
--- SIGSEGV (Segmentation fault) @ 0 (0) ---                                                 

== end ltrace output ==

snmpd config follows:            
== begin snmpd.conf ==           
syslocation  "Nowhere"           
syscontact  adm at insysnet.ru      
sysservices 76                   
rocommunity  public 81.18.141.5  
rocommunity  public 127.0.0.1    
rocommunity  public              
trapsink  localhost public       
trap2sink localhost              
informsink localhost             
trapcommunity  public            
master  yes                      
smuxsocket 127.0.0.1             
smuxpeer .1.3.6.1.4.1.3317.1.2.5 
smuxpeer .1.3.6.1.4.1.3317.1.2.2 
== end snmpd.conf ==

-- System Information:
Debian Release: 4.0
  APT prefers testing
  APT policy: (500, 'testing'), (50, 'unstable')
Architecture: amd64 (x86_64)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.20
Locale: LANG=ru_RU.KOI8-R, LC_CTYPE=ru_RU.KOI8-R (charmap=KOI8-R)

Versions of packages snmpd depends on:
ii  adduser                     3.102        Add and remove users and groups
ii  debconf                     1.5.11       Debian configuration management sy
ii  libc6                       2.3.6.ds1-10 GNU C Library: Shared libraries
ii  libsensors3                 1:2.10.1-2   library to read temperature/voltag
ii  libsnmp9                    5.2.3-7      NET SNMP (Simple Network Managemen
ii  libwrap0                    7.6.dbs-12   Wietse Venema's TCP wrappers libra

snmpd recommends no packages.

-- debconf information:
  snmpd/upgradefrom36:
  snmpd/upgradefrom521:
-------------- next part --------------
A non-text attachment was scrubbed...
Name: core.bz2
Type: application/x-bzip2
Size: 343607 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/pkg-net-snmp-devel/attachments/20070225/b9ab8b97/core-0001.bin