On Thu, Sep 15, 2005 at 11:46:10AM +0100, Patrick Welche wrote:
> (gdb) frame 0
> #0  0x080520d3 in _get_realloc_symbol (objid=0x80c5c44, objidlen=7, 
>     subtree=0x0, buf=0xbfbfe4ec, buf_len=0xbfbfe4f0, out_len=0xbfbfe4f4, 
>     allow_realloc=1, buf_overflow=0xbfbfe4f8, in_dices=0x80f8dc0, 
>     end_of_known=0xbfbfe4fc) at mib.c:4201
> 4201                            if (tp->next_peer &&
> (gdb) print *tp
> Cannot access memory at address 0x0

That bit of code is executed

            } else {
                numids = (size_t) * objid + 1;
                if (numids > objidlen)               XXX
                    goto finish_it;
                if (numids == 1) {
...
                } else {
                    if (!*buf_overflow) {

now do if ((NULL)->next_peer)

It's odd that at the core dump objidlen=7 and numids=7. Is it possible
that the line marked XXX should be a >= ? (Can't just try it because of
the 'string' business..

Cheers,

Patrick


-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. 
Download it for free - -and be entered to win a 42" plasma tv or your very
own Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Net-snmp-coders mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/net-snmp-coders

Reply via email to