Bug 1402780 - Host cannot register to satellite server/customer portal
Summary: Host cannot register to satellite server/customer portal
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: subscription-manager
Version: 6.7
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: candlepin-bugs
QA Contact: John Sefler
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-12-08 10:38 UTC by Marcel Gazdík
Modified: 2020-01-17 16:19 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-12-22 11:04:41 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Marcel Gazdík 2016-12-08 10:38:23 UTC
Description of problem:
  Running subscription manager to register a host always end up with SIGSEGV on rhel 6.7.

Executed command: /usr/bin/python -S /usr/sbin/subscription-manager register --org=CATS --activat
Program terminated with signal 11, Segmentation fault.

Version-Release number of selected component (if applicable):
subscription-manager-1.14.10-1.el6.x86_64 
libxml2-2.7.6-20.el6.x86_64


How reproducible:
  We could not reproduce this internally. But from the code:

2519         if ((xmlInputCallbackTable[i].opencallback == xmlGzfileOpen) &&
2520                 (strcmp(URI, "-") != 0)) {
2521             if (((z_stream *)context)->avail_in > 4) {
2522                 char *cptr, buff4[4];
2523                 cptr = (char *) ((z_stream *)context)->next_in;
2524                 if (gzread(context, buff4, 4) == 4) {
2525                     if (strncmp(buff4, cptr, 4) == 0)
2526                         ret->compressed = 0;
2527                     else
2528                         ret->compressed = 1;
2529                     gzrewind(context);
2530                 }
2531             }
2532         }

The ((z_stream *)context)->avail_in seems not to be initialized since the xmlGzfileOpen callback just calls gzopen and there is no read operation done before it is being used. Also gzopen should return gzFile structure where I so not see a way it could be compatible with z_stream structure.

Actual results:
  SIGSEGV - cptr = (char *) ((z_stream *)context)->next_in; points out of the allocated memory and it is also being used before any read operation.

Expected results:
  The registration attempt will not fail on SIGSEGV


Note You need to log in before you can comment on or make changes to this bug.