Bug 108956

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5)
Gecko/20031007

Description of problem:

This defect appears to Redhat specific since it refers to the
/usr/sbin/lokkit command. 

/usr/sbin/lokkit will not correctly interpret the interfaces if there
are more than 10 configured interfaces.  The symptom is that lokkit
will appear to hang. 

No curses displays were displayed at all.   strace logs showed that we
got as far as an open() on /etc/sysconfig/network-scripts and that was it.
    
When I downloaded source for that revision, I found where I think
the problem is occurring:

char **getNetworkDevices(int *len) {
        int num = 0;
        DIR *dir;
        char **ret = malloc(20*sizeof(char *));
        struct dirent *dent;

        dir = opendir("/etc/sysconfig/network-scripts");
        if (dir) {
                while ((dent = readdir(dir))) {
                        if (!strncmp(dent->d_name,"ifcfg-",6) &&
                            !strstr(dent->d_name,":") &&
                            strcmp(dent->d_name,"ifcfg-lo")) {
                                if (num > 20)

                                  ret = realloc(ret, num+1 *
sizeof(char *));
                                ret[num] = strdup(dent->d_name+6);
                                num++;
                        }
                }
                closedir(dir);
        }
        *len = num;
        if (ret) {
                qsort((void *)ret, num, sizeof(char *),
                      (int (*)(const void *, const void *))strcmp);
        }
        return ret;
} 

Reducing the number of interfaces allows the program to run normally. 


I wrote to Alan Cox (maintainer) and his reply was: 

>> 	software.  I recently was working a case with a customer who
>> 	experienced a strange problem with /usr/sbin/lokkit, from the
>> 	lokkit-0.50-6 package.

That should go in Red Hat bugzilla I think

>>                                  if (num > 20)
>> 
>>                                    ret = realloc(ret, num+1 *
sizeof(char *));


Thats the bug - it should be (num + 1) * sizeof(char *). The bracket
is rather important. Fixing that ought to fix your customer problem
but please file it and my suggested fix comment in Red Hat bugzilla
(the code in question isnt in the non Red Hat lokkit version)

Thanks

Alan



Version-Release number of selected component (if applicable):
lokkit-0.50-6

How reproducible:
Always

Steps to Reproduce:
1. Configure /etc/sysconfig/network-scripts to have > 10 ethernet devices
2. /usr/sbin/lokkit 
3.
    

Actual Results:  lokkit appears to hang.  We never get to curses screen. 

If you run strace on it, the last system call appears to be an open()
of /etc/sysconfig/network-scripts followed by a getdents() call: 

open("/etc/sysconfig/network-scripts",
O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 3
SYS_1212(0x3, 0x60000fffffffb300, 0x1f8, 0x2000000000304c80,
0xc000000000000309, 
0, 0x40000000000070f0, 0x10800) = 0

Expected Results:  /usr/sbin/lokkit should have brought up a screen to
allow you to configure your firewall. 

Additional info: