Skip to content

Check for NULL buffer in help command#512

Closed
Mrcopytuo wants to merge 1 commit intonaemon:masterfrom
Mrcopytuo:fix-query-handler-null-pointer
Closed

Check for NULL buffer in help command#512
Mrcopytuo wants to merge 1 commit intonaemon:masterfrom
Mrcopytuo:fix-query-handler-null-pointer

Conversation

@Mrcopytuo
Copy link
Copy Markdown

This PR fixes a potential security vulnerability in query-handler that was cloned from {repo} but did not receive the security patch.

###Details:
Affected Function: qh_echo, qh_help and qg_core in query-handler.c
Original Fix: {original commit}

###What this PR does:
This PR applies the same security patch that was applied to the original repository to eliminate the potential vulnerability in the cloned code.

###References:
{original commit}
{link to original CVE/bug id}

Please review and merge this PR to ensure your repository is protected against this potential vulnerability

@sni
Copy link
Copy Markdown
Contributor

sni commented Dec 12, 2025

thanks for bringing this to our attention. But i am having trouble reproducing this:

ex.:

echo -ne "#help\0" | socat unix-connect:./tmp/run/naemon.qh -
  help <name>   show help for handler <name>
  help list     list registered handlers

Were you able to crash naemon somehow?

@sni
Copy link
Copy Markdown
Contributor

sni commented Dec 12, 2025

After digging a bit in the code, i'd say naemon is not affected by this issue. Seems like the nagios dudes rewrote their query handler a bit and broke things.

@sni sni closed this Dec 12, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants