more on cfservd segfaults

[Eric Sorenson]

I've gotten two segv's from cfservd on my masterserver in the past
week. I managed to capture corefiles from both and they both died
in the same routine.  This is cfengine-2.1.1 on RH9.

Today's:

(gdb) bt full
#0  0x08065129 in DeleteItemGeneral (list=0x8093110, string=0x40604118 
"10.0.3.57", type=regexComplete)
    at item-ext.c:709
        ip = (struct Item *) 0x40626e00
        last = (struct Item *) 0x0
        match = 1
        matchlen = 0
        rx = {buffer = 0x408ceba0 "address@hidden@address@hidden@\n", allocated 
= 92, used = 92, syntax = 242428, 
  fastmap = 0x408ce7d0 "address@hidden", translate = 0x0, re_nsub = 0, 
can_be_null = 0, regs_allocated = 0, 
  fastmap_accurate = 1, no_sub = 0, not_bol = 0, not_eol = 0, newline_anchor = 
0}
        rxcache = {buffer = 0x408ceba0 "address@hidden@address@hidden@\n", 
allocated = 92, used = 92, 
  syntax = 242428, fastmap = 0x408ce7d0 "address@hidden", translate = 0x0, 
re_nsub = 0, can_be_null = 0, 
  regs_allocated = 0, fastmap_accurate = 1, no_sub = 0, not_bol = 0, not_eol = 
0, newline_anchor = 0}
        pmatch = {rm_so = 0, rm_eo = 9}
#1  0x0806537b in DeleteItemMatching (list=0x8093110, string=0x40604118 
"10.0.3.57") at item-ext.c:770
No locals.
#2  0x08050968 in DeleteConn (conn=0x406038f8) at cfservd.c:3244
No locals.
#3  0x0804c63b in HandleConnection (conn=0x406038f8) at cfservd.c:1105
        sigmask = {__val = {0 <repeats 32 times>}}
#4  0x401d32b6 in ?? ()

Here's a no-frills bt from the earlier corefile, the details vary a bit
but it's pretty clearly the same problem:

(gdb) bt
#0  0x08065129 in DeleteItemGeneral (list=0x8093110, string=0x40a45db0 
"10.10.19.106", type=regexComplete)
    at item-ext.c:709
#1  0x0806537b in DeleteItemMatching (list=0x8093110, string=0x40a45db0 
"10.10.19.106") at item-ext.c:770
#2  0x08050968 in DeleteConn (conn=0x40a45590) at cfservd.c:3244
#3  0x0804c63b in HandleConnection (conn=0x40a45590) at cfservd.c:1105
#4  0x401d32b6 in ?? ()

    705       else
    706          {
    707          last->next = ip->next;
    708          free(ip->name);
    709          if (ip->classes != NULL)
    710             {
    711             free(ip->classes);
    712             }
    713          free((char *)ip);
    714 

The code looks pretty innocuous, and from what I can tell
the 'if' on 709 should have been false:

(gdb) p ip->classes
$3 = 0x40618a80 "1079958316"

? Any ideas?

-- 

    Eric Sorenson - EXPLOSIVE Networking - http://explosive.net