Hi Dave and Wes,
 
I have a doubt  regarding function  "static struct session_list * _sess_copy(netsnmp_session * in_session)" in snmp_api.c

In this  function DEFAULT auth protocol and priv protocol are assigned without varifying the security level
e.g.
" if(session->securityLevel > SNMP_SEC_LEVEL_AUTHNOPRIV) "

Is this done purposely [Have a particular reason]  ??


I feel this is a BUG to look into.

Modified CODE:

 if(session->securityLevel > SNMP_SEC_LEVEL_NOAUTH)
    {
            if (in_session->securityAuthProtoLen > 0) {
                    session->securityAuthProto =
                            snmp_duplicate_objid(in_session->securityAuthProto,
                                            in_session->securityAuthProtoLen);
                    if (session->securityAuthProto == NULL) {
                            snmp_sess_close(slp);
                            in_session->s_snmp_errno = SNMPERR_MALLOC;
                            return (NULL);
                    }
            } else if (get_default_authtype(&i) != NULL) {
                    session->securityAuthProto =
                            snmp_duplicate_objid(get_default_authtype(NULL), i);
                    session->securityAuthProtoLen = i;
            }
    }
    if(session->securityLevel > SNMP_SEC_LEVEL_AUTHNOPRIV)
    {
            if (in_session->securityPrivProtoLen > 0) {
                    session->securityPrivProto =
                            snmp_duplicate_objid(in_session->securityPrivProto,
                                            in_session->securityPrivProtoLen);
                    if (session->securityPrivProto == NULL) {
                            snmp_sess_close(slp);
                            in_session->s_snmp_errno = SNMPERR_MALLOC;
                            return (NULL);
                    }
            } else if (get_default_privtype(&i) != NULL) {
                    session->securityPrivProto =
                            snmp_duplicate_objid(get_default_privtype(NULL), i);
                    session->securityPrivProtoLen = i;
            }
    }



Rgds,
Sanjay
------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Net-snmp-users mailing list
Net-snmp-users@lists.sourceforge.net
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users

Reply via email to