Author: Henrik Nordstrom <henrik@henriknordstrom.net>

Fix free memory corruption and off-by-on error when comparing SNMP OIDs

Both introduced by the polishing of the SNMP tree generator.

diff --git a/src/snmp_core.cc b/src/snmp_core.cc
index b301fe69934e98b16753e55a818210d28b484ea6..b45ee0c0c7e7190a39b862b30f04ffb8a7ee3f67 100644 (file)
--- a/src/snmp_core.cc
+++ b/src/snmp_core.cc
@@ -934,7 +934,7 @@ snmpLookupNodeStr(mib_tree_entry *root, const char *str)
     }
 
     int i, r = 1;
-    while (r <= namelen) {
+    while (r < namelen) {
 
         /* Find the child node which matches this */
         for (i = 0; i < e->children && e->leaves[i]->name[r] != name[r]; i++) ; // seek-loop
@@ -962,9 +962,10 @@ snmpCreateOidFromStr(const char *str, oid **name, int *nl)
     *name = NULL;
     *nl = 0;
     char *s = xstrdup(str);
+    char *s_ = s;
 
     /* Parse the OID string into oid bits */
-    while ( (p = strsep(&s, delim)) != NULL) {
+    while ( (p = strsep(&s_, delim)) != NULL) {
         *name = (oid*)xrealloc(*name, sizeof(oid) * ((*nl) + 1));
         (*name)[*nl] = atoi(p);
         (*nl)++;