[Nagiosplug-devel] [ nagiosplug-Bugs-1862300 ] check_ntp_time segfault in 1.4.11

[SourceForge.net]

Bugs item #1862300, was opened at 2008-01-02 11:39
Message generated for change (Settings changed) made by dermoth
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=397597&aid=1862300&group_id=29880

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: General plugin execution
Group: Release (specify)
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: digitalruin (digitalruin)
>Assigned to: Thomas Guyot (dermoth)
Summary: check_ntp_time segfault in 1.4.11

Initial Comment:
Hi, I'm running 1.4.11 on a Solaris 9 setup and check_ntp_time seems to have a segfault issue. This only happens when running it against an ntp pool, not an individual host. See below:

/usr/local/nagios/libexec$ ./check_ntp_time -H 0.us.pool.ntp.org -w 60 -c 120
Segmentation Fault
/usr/local/nagios/libexec$ ./check_ntp_time -v -H 0.us.pool.ntp.org -w 60 -c 120
sending request to peer 0
sending request to peer 1
response from peer 0: offset 54.24633014
sending request to peer 0
response from peer 1: offset 54.23421776
.
. <snip>
.
response from peer 4: offset 54.23087406
sending request to peer 4
response from peer 4: offset 54.23018897
sending request to peer 4
response from peer 4: offset 54.23138392
Segmentation Fault

Here's the truss output:

sending request to peer 4
write(1, " s e n d i n g   r e q u".., 26)      = 26
write(8, "E3\004FA\001\0\0\001\0\0".., 48)      = 48
poll(0x00034298, 5, 100)                        = 1
read(8, " $0104ED\0\0\0\0\0\0\011".., 48)       = 48
response from peer 4: offset 54.24180388
write(1, " r e s p o n s e   f r o".., 41)      = 41
    Incurred fault #6, FLTBOUNDS  %pc = 0x00015FB4
      siginfo: SIGSEGV SEGV_MAPERR addr=0x7FC1E3A4
    Received signal #11, SIGSEGV [default]
      siginfo: SIGSEGV SEGV_MAPERR addr=0x7FC1E3A4

And the traceback:

/usr/local/nagios/libexec# dbx /usr/local/nagios/libexec/check_ntp_time
Reading check_ntp_time
Reading ld.so.1
Reading libresolv.so.2
Reading libm.so.1
Reading libnsl.so.1
Reading libsocket.so.1
Reading libc.so.1
Reading libdl.so.1
Reading libmp.so.2
Reading libc_psr.so.1
(dbx) run -H 0.us.pool.ntp.org -w 60 -c 120
Running: check_ntp_time -H 0.us.pool.ntp.org -w 60 -c 120
(process id 12120)
signal SEGV (no mapping at the fault address) in offset_request at line 427 in file "check_ntp_time.c"
(dbx) where
=>[1] offset_request(host = 0x354b0 "0.us.pool.ntp.org", status = 0xffbffae4), line 427 in "check_ntp_time.c"
  [2] main(argc = 7, argv = 0xffbffb54), line 554 in "check_ntp_time.c"


----------------------------------------------------------------------

Comment By: Thomas Guyot (dermoth)
Date: 2008-01-03 07:39

Message:
Logged In: YES 
user_id=375623
Originator: NO

Hi,

I'm the author of check_ntp_time and it's mostly based on check_ntp
(written by Sean Finney). The specific place where it segfaults
(offset_request function) hasn't been modified so this should apply to
check_ntp.c as well. Could you confirm running check_ntp with the same
arguments does the same segfault?

Also I can't reproduce the bug on my Linux and Solaris boxes and FreeBSD
VM. Does it happens all the time? Is it's still happening?

To debug further I will need the full verbose output of the plug-in
("-vvv" instead of "-v").


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=397597&aid=1862300&group_id=29880