MIME-Version: 1.0
User-Agent: Alpine 2.00 (LFD 1167 2008-08-23)
Subject: common/dispatch.c: add_timeout() when parameter NULL
Date: Fri, 26 Jun 2009 14:03:57 -1000 (HST)
content-type: TEXT/PLAIN; charset="utf-8"; format="flowed"
Message-ID: <alpine.LFD.2.00.0906261359400.18197@mitre.honolulu.burdell.org>
To: dhcp-bugs@isc.org
From: David Cantrell <dcantrell@redhat.com>
Content-Length: 1492

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In Fedora 11 and rawhide on 32-bit x86 systems, some users are reporting a
SGISEGV in dhclient when there is a DHCPDECLINE sent.  The add_timeout()
function is called in common/dispatch.c and the 'when' parameter is NULL.
Core dumps reveal the offending line as:

     q -> when . tv_sec = when -> tv_sec;

Which is around line 143 in common/dispatch.c in dhcp-4.1.0.

x86_64 systems are not having this problem.

As it is affecting users from using their systems, I've added the following
patch to the Fedora package:


diff -up dhcp-4.1.0/common/dispatch.c.dracut dhcp-4.1.0/common/dispatch.c
- --- dhcp-4.1.0/common/dispatch.c.dracut 2008-01-23 16:43:04.000000000 -1000
+++ dhcp-4.1.0/common/dispatch.c    2009-06-25 16:21:03.000000000 -1000
@@ -104,6 +104,10 @@ void add_timeout (when, where, what, ref
  {
     struct timeout *t, *q;

+   if (when == NULL) {
+       return;
+   }
+
     /* See if this timeout supersedes an existing timeout. */
     t = (struct timeout *)0;
     for (q = timeouts; q; q = q -> next) {


What I'd really like to determine is why the when parameter is NULL in these
cases, but I wanted to get something out to users that isn't segfaulting.

- -- 
David Cantrell <dcantrell@redhat.com>
Red Hat / Honolulu, HI

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkpFYe0ACgkQ5hsjjIy1Vkn4eACbBan1EXNoGGVogGARQesl64nR
p+UAniJleIDwYB7kiUXzrimN+AwcG37o
=NwTj
-----END PGP SIGNATURE-----