jlsemi / smartsnmp Goto Github PK

It is traced that commit d8563c4 has made it while the commit just before it is good.

In src/mib_tree.c there is an interface called 'mib_node_reg', and it was written as follows:

int
mib_node_reg(const oid_t *oid, uint32_t len, int callback)
{
...
  gn = mib_tree_group_insert(oid, len - 1);
...
}

Note we invoke function 'mib_tree_group_insert' with len - 1 as the second argument while len is an unsigned integer. If len equals to 0, then len - 1 will be parsed as a huge unsigned integer and passed on. Something horrible might happen... e.x. the memory will be used off and the whole system will halt.

One way to invoke this disaster is to write config/smartsnmp.conf as follows:

mib_modules = {
    [''] = 'system',
}

The oid prefix length is zero.

Is this still in use? It seems to have been professionally developed, but has seen zero commits in the last three years, which seems like incredibly bug free code. Is this just a dead code drop, or is it worth actually using this?

Is there anything wrong or I should configuration by myself to enable smartsnmpd provide OpenWrt's CPU and memory information?

It's referred to by the readme, but doesn't seem to exist. A guide on starting from a MIB file and writing support for a private mib would be awesome.

It needs to be checked that MIB get function can return wrong data type conflicted with that constructor function has defined.