cfservd segfault

[Eric Sorenson]

Hi, we're getting periodic, but not regular, segfault crashes in cfservd on the
master server, currently version 2.1.0p3. The offending line however is
unchanged in the 2.1.1 sources so I suspect that upgrading without figuring
out what's happening will not resolve the problem.

Here's the backtrace:

Reading symbols from /usr/lib/debug/usr/sbin/cfservd.debug...done.
(gdb) bt
#0  0x08064976 in DeleteItemGeneral (list=0x80924b0, string=0x405f2af0 
"10.10.16.209", type=regexComplete)
    at item-ext.c:707
#1  0x4707521c in ?? ()
#2  0x08064baf in DeleteItemMatching (list=0x80924b0, string=0x405f2af0 
"10.10.16.209") at item-ext.c:767
#3  0x08050a28 in DeleteConn (conn=0x1) at cfservd.c:3268
#4  0x0804c6fb in HandleConnection (conn=0x40508b50) at cfservd.c:1129
#5  0x401d32b6 in ?? ()
(gdb) 

Line 707 and surrounding:

    705       else
    706          {
    707          last->next = ip->next;
    708          free(ip->name);
    709          if (ip->classes != NULL)
    710             {
    711             free(ip->classes);
    712             }
    713          free((char *)ip);
    714 
    715          NUMBEROFEDITS++;
    716          return true;
    717          }

It seems like there needs to be another check to make sure that 
"ip->next != NULL" before the assignation in line 707, but I'm 
in unfamiliar territory here  so I'll not send a specific patch
in hopes that the problem will be apparent to somebody else 
(AKA Mark :))

-- 

    Eric Sorenson - EXPLOSIVE Networking - http://explosive.net