[rrd-developers] rrdtool: update crash

[Sebastian Harl]

tags 428780 + patch
retitle 428780 rrdtool create: Missing command line verification.
thanks

Hi Justin,

On Wed, Jun 13, 2007 at 10:09:25PM -0400, Justin Pryzby wrote:
> $ rrdtool create --start 1080000000 foo.rrd DS:bar:GAUGE:1:U:U RRA:AVERAGE:0:1:0

Sometimes, it's the small things: You've specified a row count of 0 in
the RRA definition (that's the zero at the end of the RRA definition),
that is, you're telling RRDtool to keep 0 values in that RRA.

> $ rrdtool update ./foo.rrd N:1 0:0
> Segmentation fault

Obviously, rrdtool does not handle the case that the row count is zero
(FWIW that does not make any sense anyway). In the current SVN version
of the upcoming 1.3 release, rrdcreate segfaults in that case because of
an division by zero. The same seems to apply to rrdupdate in 1.2.

If you specify a row count greater than zero everything works fine.

Anyway, software should not segfault because of invalid input. Attached
is a patch against the current SVN trunk which will cause rrdcreate to
bail out with an error message when specifying a row count less than or
equal to zero. Tobi, could you please apply that to trunk?

I'm not sure, if 1.3 is going to make it into Lenny, so I will backport
that fix to 1.2 and upload a new version to unstable soon.

Cheers,
Sebastian

-- 
Sebastian "tokkee" Harl +++ GnuPG-ID: 0x8501C7FC +++ http://tokkee.org/

Those who would give up Essential Liberty to purchase a little Temporary
Safety, deserve neither Liberty nor Safety.         -- Benjamin Franklin

-------------- next part --------------
From 2b087110bce4f7319a037f6261906e2795dad989 Mon Sep 17 00:00:00 2001
From: Sebastian Harl <sh at tokkee.org>
Date: Tue, 10 Jun 2008 10:56:28 +0200
Subject: [PATCH] rrdcreate: Check if row_cnt is greater than zero.

Else, we'll get a division by zero in rra_random_row().

This resolves Debian bug #428780.
---
 program/doc/rrdcreate.pod |    1 +
 program/src/rrd_create.c  |   13 +++++++++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/program/doc/rrdcreate.pod b/program/doc/rrdcreate.pod
index 86817bd..03012e0 100644
--- a/program/doc/rrdcreate.pod
+++ b/program/doc/rrdcreate.pod
@@ -216,6 +216,7 @@ I<steps> defines how many of these I<primary data points> are used to build
 a I<consolidated data point> which then goes into the archive.
 
 I<rows> defines how many generations of data values are kept in an B<RRA>.
+Obviously, this has to be greater than zero.
 
 =back
 
diff --git a/program/src/rrd_create.c b/program/src/rrd_create.c
index bb8d45d..cc93109 100644
--- a/program/src/rrd_create.c
+++ b/program/src/rrd_create.c
@@ -232,6 +232,7 @@ int rrd_create_r(
             char     *argvcopy;
             char     *tokptr;
             size_t    old_size = sizeof(rra_def_t) * (rrd.stat_head->rra_cnt);
+            int       row_cnt;
 
             if ((rrd.rra_def = rrd_realloc(rrd.rra_def,
                                            old_size + sizeof(rra_def_t))) ==
@@ -312,8 +313,10 @@ int rrd_create_r(
                     case CF_SEASONAL:
                     case CF_DEVPREDICT:
                     case CF_FAILURES:
-                        rrd.rra_def[rrd.stat_head->rra_cnt].row_cnt =
-                            atoi(token);
+                        row_cnt = atoi(token);
+                        rrd.rra_def[rrd.stat_head->rra_cnt].row_cnt = row_cnt;
+                        if (row_cnt <= 0)
+                            rrd_set_error("Invalid row count: %i", row_cnt);
                         break;
                     default:
                         rrd.rra_def[rrd.stat_head->rra_cnt].
@@ -416,8 +419,10 @@ int rrd_create_r(
                             ("Unexpected extra argument for consolidation function DEVPREDICT");
                         break;
                     default:
-                        rrd.rra_def[rrd.stat_head->rra_cnt].row_cnt =
-                            atoi(token);
+                        row_cnt = atoi(token);
+                        rrd.rra_def[rrd.stat_head->rra_cnt].row_cnt = row_cnt;
+                        if (row_cnt <= 0)
+                            rrd_set_error("Invalid row count: %i", row_cnt);
                         break;
                     }
                     break;
-- 
1.5.6.rc2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.oetiker.ch/pipermail/rrd-developers/attachments/20080610/068334ba/attachment.bin