Package: libsnmp-perl
Version: 5.9.4+dfsg-2+deb13u1
Severity: important
Tags: patch
Dear Maintainer,
When the `get` method of an SNMP::Session object is retried in an async
context, the callback data is prematurely freed. This is due to treating
the operation NETSNMP_CALLBACK_OP_RESEND as a final operation even though
it is only meant to signify a retry.
This bug can be reproduced by running this script without having a snmp
listener at port 8000:
```perl
#!/usr/bin/perl
use strict;
use warnings;
use SNMP;
use Time::HiRes qw(time);
my $s = SNMP::Session->new(
DestHost => 'localhost:8000',
Version => '2c',
Timeout => 200_000,
Retries => 1,
);
my $t0 = time;
$s->get(
[ ['.1.3.6.1.2.1.1'] ],
[ sub { printf "callback at %.2fs: %s\n", time - $t0, $s->{ErrorStr} } ]
);
SNMP::MainLoop(1);
```
Here is an excerpt from the output when running this script under
valgrind:
```
$ valgrind -q perl reproduction_get.pl
==3412770== Invalid read of size 8
==3412770== at 0x5FB2261: __snmp_xs_cb (SNMP.xs:1178)
==3412770== by 0x56D1986: snmp_sess_timeout (snmp_api.c:6881)
==3412770== by 0x56D1B47: snmp_timeout (snmp_api.c:6726)
==3412770== by 0x5FB1418: XS_SNMP__main_loop (SNMP.xs:5067)
==3412770== ...
==3412770== Address 0x6b8d728 is 8 bytes inside a block of size 16 free'd
==3412770== at 0x484787F: free (vg_replace_malloc.c:989)
==3412770== by 0x5FB2389: __snmp_xs_cb (SNMP.xs:1187)
==3412770== by 0x56D0C0D: snmp_resend_request.constprop.0 (snmp_api.c:6815)
==3412770== by 0x56D1A05: snmp_sess_timeout (snmp_api.c:6888)
==3412770== by 0x56D1B47: snmp_timeout (snmp_api.c:6726)
==3412770== by 0x5FB1418: XS_SNMP__main_loop (SNMP.xs:5067)
==3412770== ...
==3412770== Block was alloc'd at
==3412770== at 0x4844818: malloc (vg_replace_malloc.c:446)
==3412770== by 0x5FBD5FB: XS_SNMP__get (SNMP.xs:3335)
==3412770== ...
==3412770== Invalid free() / delete / delete[] / realloc()
==3412770== at 0x484787F: free (vg_replace_malloc.c:989)
==3412770== by 0x5FB2389: __snmp_xs_cb (SNMP.xs:1187)
==3412770== by 0x56D1986: snmp_sess_timeout (snmp_api.c:6881)
==3412770== by 0x56D1B47: snmp_timeout (snmp_api.c:6726)
==3412770== by 0x5FB1418: XS_SNMP__main_loop (SNMP.xs:5067)
==3412770== ...
==3412770== Address 0x6b8d720 is 0 bytes inside a block of size 16 free'd
==3412770== [same free'd/alloc'd stacks as above]
```
This bug is resolved with commit cf5d7defd20 in the upstream repository.
Would it be possible to port this fix to the trixie-security suite?
A related bug with the bulkwalk method, got fixed in this PR:
https://github.com/net-snmp/net-snmp/pull/1166
Do you want me to file a separate bug report for this related bug?
-- System Information:
Debian Release: 13.7
APT prefers stable-security
APT policy: (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 7.2.11 (SMP w/40 CPU threads; PREEMPT)
Locale: LANG=en_DK.UTF-8, LC_CTYPE=en_DK.UTF-8 (charmap=UTF-8),
LANGUAGE=en_NO:en_DK:en_US:en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages libsnmp-perl depends on:
ii libc6 2.41-12+deb13u4
ii libnetsnmptrapd40t64 5.9.4+dfsg-2+deb13u1
ii libsnmp40t64 5.9.4+dfsg-2+deb13u1
ii perl 5.40.1-6+deb13u1
ii perl-base [perlapi-5.40.1] 5.40.1-6+deb13u1
libsnmp-perl recommends no packages.
libsnmp-perl suggests no packages.
-- no debconf information
