1212408 - net-snmp: snmp_pdu_parse() incompletely parsed varBinds left in list of variables

1248412 - net-snmp: snmp_pdu_parse() incompletely parsed varBinds left in list of variables [rhel-7.1.z]

Backported from:

commit f23bcd3ac6ddee5d0a48f9703007ccc738914791

Author: Robert Story <rstory@localhost>

Date:   Sat Apr 11 18:49:02 2015 -0400

    CHANGES: BUG: #2615: Don't return incompletely parsed varbinds

diff -up net-snmp-5.5/snmplib/snmp_api.c.incomplete-parse net-snmp-5.5/snmplib/snmp_api.c

--- net-snmp-5.5/snmplib/snmp_api.c.incomplete-parse	2015-07-30 12:10:31.495801514 +0200

+++ net-snmp-5.5/snmplib/snmp_api.c	2015-07-30 12:11:43.087038548 +0200

@@ -4508,10 +4508,9 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char

     u_char          type;

     u_char          msg_type;

     u_char         *var_val;

-    int             badtype = 0;

     size_t          len;

     size_t          four;

-    netsnmp_variable_list *vp = NULL;

+    netsnmp_variable_list *vp = NULL, *vplast = NULL;

     oid             objid[MAX_OID_LEN];

     u_char         *p;

@@ -4647,38 +4646,24 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char

                               (ASN_SEQUENCE | ASN_CONSTRUCTOR),

                               "varbinds");

     if (data == NULL)

-        return -1;

+        goto fail;

     /*

      * get each varBind sequence 

      */

     while ((int) *length > 0) {

-        netsnmp_variable_list *vptemp;

-        vptemp = (netsnmp_variable_list *) malloc(sizeof(*vptemp));

-        if (NULL == vptemp) {

-            return -1;

-        }

-        if (NULL == vp) {

-            pdu->variables = vptemp;

-        } else {

-            vp->next_variable = vptemp;

-        }

-        vp = vptemp;

-

-        vp->next_variable = NULL;

-        vp->val.string = NULL;

+        vp = SNMP_MALLOC_TYPEDEF(netsnmp_variable_list);

+        if (NULL == vp)

+            goto fail;

+        

         vp->name_length = MAX_OID_LEN;

-        vp->name = NULL;

-        vp->index = 0;

-        vp->data = NULL;

-        vp->dataFreeHook = NULL;

         DEBUGDUMPSECTION("recv", "VarBind");

         data = snmp_parse_var_op(data, objid, &vp->name_length, &vp->type,

                                  &vp->val_len, &var_val, length);

         if (data == NULL)

-            return -1;

+            goto fail;

         if (snmp_set_var_objid(vp, objid, vp->name_length))

-            return -1;

+            goto fail;

         len = MAX_PACKET_LENGTH;

         DEBUGDUMPHEADER("recv", "Value");

@@ -4690,7 +4675,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char

                           (long *) vp->val.integer,

                           sizeof(*vp->val.integer));

             if (!p)

-                return -1;

+                goto fail;

             break;

         case ASN_COUNTER:

         case ASN_GAUGE:

@@ -4702,7 +4687,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char

                                    (u_long *) vp->val.integer,

                                    vp->val_len);

             if (!p)

-                return -1;

+                goto fail;

             break;

 #ifdef NETSNMP_WITH_OPAQUE_SPECIAL_TYPES

         case ASN_OPAQUE_COUNTER64:

@@ -4715,7 +4700,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char

                                      (struct counter64 *) vp->val.

                                      counter64, vp->val_len);

             if (!p)

-                return -1;

+                goto fail;

             break;

 #ifdef NETSNMP_WITH_OPAQUE_SPECIAL_TYPES

         case ASN_OPAQUE_FLOAT:

@@ -4724,7 +4709,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char

             p = asn_parse_float(var_val, &len, &vp->type,

                             vp->val.floatVal, vp->val_len);

             if (!p)

-                return -1;

+                goto fail;

             break;

         case ASN_OPAQUE_DOUBLE:

             vp->val.doubleVal = (double *) vp->buf;

@@ -4732,7 +4717,7 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char

             p = asn_parse_double(var_val, &len, &vp->type,

                              vp->val.doubleVal, vp->val_len);

             if (!p)

-                return -1;

+                goto fail;

             break;

         case ASN_OPAQUE_I64:

             vp->val.counter64 = (struct counter64 *) vp->buf;

@@ -4742,12 +4727,12 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char

                                    sizeof(*vp->val.counter64));

             if (!p)

-                return -1;

+                goto fail;

             break;

 #endif                          /* NETSNMP_WITH_OPAQUE_SPECIAL_TYPES */

         case ASN_IPADDRESS:

             if (vp->val_len != 4)

-                return -1;

+                goto fail;

             /* fallthrough */

         case ASN_OCTET_STR:

         case ASN_OPAQUE:

@@ -4758,22 +4743,22 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char

                 vp->val.string = (u_char *) malloc(vp->val_len);

             }

             if (vp->val.string == NULL) {

-                return -1;

+                goto fail;

             }

             p = asn_parse_string(var_val, &len, &vp->type, vp->val.string,

                              &vp->val_len);

             if (!p)

-                return -1;

+                goto fail;

             break;

         case ASN_OBJECT_ID:

             vp->val_len = MAX_OID_LEN;

             p = asn_parse_objid(var_val, &len, &vp->type, objid, &vp->val_len);

             if (!p)

-                return -1;

+                goto fail;

             vp->val_len *= sizeof(oid);

             vp->val.objid = (oid *) malloc(vp->val_len);

             if (vp->val.objid == NULL) {

-                return -1;

+                goto fail;

             }

             memmove(vp->val.objid, objid, vp->val_len);

             break;

@@ -4785,21 +4770,38 @@ snmp_pdu_parse(netsnmp_pdu *pdu, u_char

         case ASN_BIT_STR:

             vp->val.bitstring = (u_char *) malloc(vp->val_len);

             if (vp->val.bitstring == NULL) {

-                return -1;

+                goto fail;

             }

             p = asn_parse_bitstring(var_val, &len, &vp->type,

                                 vp->val.bitstring, &vp->val_len);

             if (!p)

-                return -1;

+                goto fail;

             break;

         default:

             snmp_log(LOG_ERR, "bad type returned (%x)\n", vp->type);

-            badtype = -1;

+            goto fail;

             break;

         }

         DEBUGINDENTADD(-4);

+

+        if (NULL == vplast) {

+            pdu->variables = vp;

+        } else {

+            vplast->next_variable = vp;

+        }

+        vplast = vp;

+        vp = NULL;

+

     }

-    return badtype;

+    return 0;

+

+fail:

+    DEBUGMSGTL(("recv", "error while parsing VarBindList\n"));

+    /** if we were parsing a var, remove it from the pdu and free it */

+    if (vp)

+        snmp_free_var(vp);

+

+    return -1;

 }

 /*