Bug 474381

Summary: iptstate -s -S <source> -D <dest> segfaults
Product: Red Hat Enterprise Linux 5 Reporter: Peter Bieringer <pb>
Component: iptstateAssignee: Thomas Woerner <twoerner>
Status: CLOSED ERRATA QA Contact: BaseOS QE <qe-baseos-auto>
Severity: high Docs Contact:
Priority: low    
Version: 5.2CC: dkovalsk, mcermak, pknirsch, wtogami
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-12-16 09:25:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Peter Bieringer 2008-12-03 16:01:58 UTC
Description of problem:

iptstate segfaults in case of use of "-s" and "-S" and "-D"

Version-Release number of selected component (if applicable):
iptstate-1.4-1.1.2.2

How reproducible:
Always


Steps to Reproduce:
# iptstate -s -S 1.2.3.4 -D 5.6.7.8
IP Tables State Top -- Sort by: SrcIP
Segmentation fault

  
Actual results:
Segfault

Expected results:
No segfault


Additional info:

last lines of strace:

mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f79000
read(4, "# /etc/protocols:\n# $Id: protoco"..., 4096) = 4096
close(4)                                = 0
munmap(0xb7f79000, 4096)                = 0
read(3, "", 8191)                       = 0
close(3)                                = 0
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 3), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f79000
write(1, "IP Tables State Top -- Sort by: "..., 38IP Tables State Top -- Sort by: SrcIP
) = 38
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++

Comment 1 Phil Knirsch 2008-12-22 14:01:20 UTC
Seems as if -s isn't correctly checked for a valid ip-address.

Proposing for RHEL-5.4 and granting Devel ACK.

Thanks & regards, Phil

Comment 2 Peter Bieringer 2008-12-22 14:15:01 UTC
"-s" (non-capital) means single shot, I'm using this as input for special parsing of the state table (easier than /proc/net/nf_conntrack)

Without "-s", -S and -D works fine, looks like a test case is missing...

Comment 3 Phil Knirsch 2008-12-22 16:00:37 UTC
Ah yes, was looking at the wrong manpage, sorry.

A quick check revealed that iptstate seems to be still using ncurses output functions for the single shot run, but i suspect it isn't initializing the ncurses environment properly. Should still be an easy fix.

Thanks & regards, Phil

Comment 4 Peter Bieringer 2008-12-22 16:04:17 UTC
Note, using "-s" without "-D" or "-S" will not segfault...

Comment 5 RHEL Program Management 2009-03-26 17:03:53 UTC
This request was evaluated by Red Hat Product Management for
inclusion, but this component is not scheduled to be updated in
the current Red Hat Enterprise Linux release. If you would like
this request to be reviewed for the next minor release, ask your
support representative to set the next rhel-x.y flag to "?".

Comment 8 Thomas Woerner 2009-11-11 08:32:48 UTC
In single-run mode curses is not used, but one function call is printw instead of printf, which is used for formatted output in a curses window. This leads to the problem.

Comment 12 errata-xmlrpc 2009-12-16 09:25:35 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2009-1676.html