Bug 1402780

Summary: Host cannot register to satellite server/customer portal
Product: Red Hat Enterprise Linux 6 Reporter: Marcel Gazdík <mgazdik>
Component: subscription-managerAssignee: candlepin-bugs
Status: CLOSED NOTABUG QA Contact: John Sefler <jsefler>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 6.7CC: khowell, mdekan, mgazdik, redakkan, skallesh
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-12-22 11:04:41 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Marcel Gazdík 2016-12-08 10:38:23 UTC
Description of problem:
  Running subscription manager to register a host always end up with SIGSEGV on rhel 6.7.

Executed command: /usr/bin/python -S /usr/sbin/subscription-manager register --org=CATS --activat
Program terminated with signal 11, Segmentation fault.

Version-Release number of selected component (if applicable):
subscription-manager-1.14.10-1.el6.x86_64 
libxml2-2.7.6-20.el6.x86_64


How reproducible:
  We could not reproduce this internally. But from the code:

2519         if ((xmlInputCallbackTable[i].opencallback == xmlGzfileOpen) &&
2520                 (strcmp(URI, "-") != 0)) {
2521             if (((z_stream *)context)->avail_in > 4) {
2522                 char *cptr, buff4[4];
2523                 cptr = (char *) ((z_stream *)context)->next_in;
2524                 if (gzread(context, buff4, 4) == 4) {
2525                     if (strncmp(buff4, cptr, 4) == 0)
2526                         ret->compressed = 0;
2527                     else
2528                         ret->compressed = 1;
2529                     gzrewind(context);
2530                 }
2531             }
2532         }

The ((z_stream *)context)->avail_in seems not to be initialized since the xmlGzfileOpen callback just calls gzopen and there is no read operation done before it is being used. Also gzopen should return gzFile structure where I so not see a way it could be compatible with z_stream structure.

Actual results:
  SIGSEGV - cptr = (char *) ((z_stream *)context)->next_in; points out of the allocated memory and it is also being used before any read operation.

Expected results:
  The registration attempt will not fail on SIGSEGV