Bug#399027: Segfaults just after start

[Martin Pala]

Hi,

the patch which solves the problem is in the attachment (will be part of 
next monit release).

Thanks,

Cheers,

Martin


Michal Čihař wrote:
Package: monit
Version: 1:4.8.1-2.1
Severity: important

Hi

I see this problem for more time, but didn't yet find time to report.
Monit segfaults for me just after startup. Here is end of strace:

rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
open("/var/lib/monit", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
getdents64(3, /* 7 entries */, 4096)    = 240
write(2, "Processing postponed events queu"..., 34Processing postponed events 
queue
) = 34
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=806, ...}) = 0
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=806, ...}) = 0
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=806, ...}) = 0
sendto(4, "<31>Nov 17 09:20:47 monit[32479]"..., 69, MSG_NOSIGNAL, NULL, 0) = 69
stat("/var/lib/monit/.", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
stat("/var/lib/monit/monit.state", {st_mode=S_IFREG|0644, st_size=1684, ...}) = 0
write(2, "monit: processing queued event /"..., 58monit: processing queued 
event /var/lib/monit/monit.state
) = 58
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=806, ...}) = 0
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=806, ...}) = 0
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=806, ...}) = 0
sendto(4, "<31>Nov 17 09:20:47 monit[32479]"..., 93, MSG_NOSIGNAL, NULL, 0) = 93
open("/var/lib/monit/monit.state", O_RDONLY) = 6
fstat(6, {st_mode=S_IFREG|0644, st_size=1684, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 
0x2aaaaaaae000
read(6, "\6\0\0\0lighttpd\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096) = 
1684
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++
Process 32479 detached

When I remove state file, it starts and seem to work fine (it didn't yet 
run too long, but looks good enough so far). So there must be something
wrong with state saving/parsing. It fails whenever there is some state
file. I'm attaching one as example.

Index: event.c
===================================================================
RCS file: /sources/monit/monit/event.c,v
retrieving revision 1.62
diff -u -r1.62 event.c
--- event.c     28 Jun 2006 09:02:43 -0000      1.62
+++ event.c     18 Nov 2006 00:13:50 -0000
@@ -564,39 +564,41 @@
       {
         LogError("%s: Processing failed - cannot open the event file %s -- 
%s\n",
           prog, file_name, STRERROR);
-        goto error;
+        goto error1;
       }
 
       /* read event structure version */
-      if(!(version = File_readQueue(file, &size)) || size != sizeof(int))
-        goto error;
+      if(!(version = File_readQueue(file, &size)) || size != sizeof(int)) {
+        LogError("skipping %s - unknown data format\n",
+          file_name, *version);
+        goto error2;
+      }
       if(*version != EVENT_VERSION)
       {
         LogError("Aborting event %s - incompatible data format version %d\n",
           file_name, *version);
-        unlink(file_name);
-        goto error;
+        goto error2;
       }
 
       /* read event structure */
       if(!(e = File_readQueue(file, &size)) || size != sizeof(*e))
-        goto error;
+        goto error2;
 
       /* read source */
       if(!(e->source = File_readQueue(file, &size)))
-        goto error;
+        goto error3;
 
       /* read group */
       if(!(e->group = File_readQueue(file, &size)))
-        goto error;
+        goto error3;
 
       /* read message */
       if(!(e->message = File_readQueue(file, &size)))
-        goto error;
+        goto error3;
 
       /* read event action */
       if(!(action = File_readQueue(file, &size)) || size != sizeof(short))
-        goto error;
+        goto error3;
       a->id = *action;
       if(e->state == STATE_FAILED)
       {
@@ -662,15 +664,17 @@
         unlink(file_name);
       }
 
-      error:
-      FREE(version);
-      FREE(action);
+      error3:
       FREE(e->source);
       FREE(e->group);
       FREE(e->message);
       FREE(e);
+      FREE(action);
+      error2:
+      FREE(version);
       fclose(file);
     }
+    error1:
     de = readdir(dir);
   }
   Run.handler_init = FALSE;