SEGV in cmd_process_service_check_result (base/commands.c)

[Ethan Galstad]

Thanks for the report - I'll get this into CVS tonight.  If you 
notice other problems, let me know.  I'm cleaning up the external 
command code in 2.0  to reduce duplication where possible.

On 30 Jun 2003 at 18:49, Mooney, Ryan wrote:

> I'm seeing this in a nagios 1.0 deployment, but its still appears to be in the CVS version.
>  
> Basically the problem happens when an external PROCESS_SERVICE_CHECK_RESULT comes in
> formatted like:
>   [1056956399] PROCESS_SERVICE_CHECK_RESULT;
> Yes this is an error (one of my external check scripts barfs every so often).  However it shouldn't crash nagios...
>  
> The problem is that  
>   /* get the host name */
>   temp_ptr=my_strtok(args,";");
> returns a null and then when you try to do the  
>    if(!strcmp(temp_ptr,temp_host->address)){
> a few lines later bam strcmp((char *)0, something_else) == instant SEGV.
>  
> The obvious solution is to put a test in for strlen of args, but looking around I see a couple
> other places where this could conceivably happen, so the question is - is it better to fix each
> of them individually in thier own functions, or just stuff some code in up higher that checks 
> the args is mostly ok (or at least exists) for the vulnerable types (types that have args) (maybe 
> in process_external_command() or check_for_external_commands()). Or maybe there is a better
> way to handle the problem altogether.
>  
>  



Ethan Galstad,
Nagios Developer
---
Email: nagios at nagios.org
Website: http://www.nagios.org



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null