segfault with regex and hint

[Alexander Clouter]

Hi,

It's that time of year to overhaul the cesspool that makes up my 
FreeRADIUS config files.

I am running FreeRADIUS from git[1] about two days ago and found that by 
putting the following in my 'hints' file gives me the segfault shown 
below[2].  If I remove the end bit[3] then I do not get the segfault, 
but then I also do not get my comparison :)

Any more information needed, then let me know.

Cheers

[1] at commit 08baab6769fea367bda5dd006b659621bb9aac18 from 
	yesterday-ish
[2] strlcpy sourced from address 0x0
[3] User-Name =~ "/^%{1}%{2}%{3}%{4}%{5}%{6}$/i"

----
DEFAULT NAS-Port-Type == "Ethernet", User-Name == "%{User-Password}", Calling-Station-Id =~ "/^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i", User-Name =~ "/^%{1}%{2}%{3}%{4}%{5}%{6}$/i"
        Hint = mac-auth
----

----
server dot1x {
 modules {
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating preprocess
  preprocess {
        huntgroups = "/etc/freeradius/huntgroups"
        hints = "/etc/freeradius/hints"
        with_ascend_hack = no
        ascend_channels_per_line = 23
        with_ntdomain_hack = no
        with_specialix_jetstream_hack = no
        with_cisco_vsa_hack = yes
        with_alvarion_vsa_hack = no
  }

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f943272eae0 (LWP 3894)]
strlcpy (dst=0x13545e8 "", src=0x0, siz=<value optimized out>) at strlcpy.c:50
50                              if ((*d++ = *s++) == 0)
(gdb) where
#0  strlcpy (dst=0x13545e8 "", src=0x0, siz=<value optimized out>) at strlcpy.c:50
#1  0x00007f9432315164 in pairmake (attribute=<value optimized out>, value=0x0, operator=17)
    at valuepair.c:1549
#2  0x00007f9432315a39 in pairread (ptr=0x7fff3a7352a8, eol=0x7fff3a7352b4) at valuepair.c:1703
#3  0x00007f9432315b7f in userparse (buffer=<value optimized out>, first_pair=0x7fff3a739470)
    at valuepair.c:1804
#4  0x000000000040ec5c in pairlist_read (file=0x1352140 "/etc/freeradius/hints", list=0x13522b8, 
    complain=<value optimized out>) at files.c:192
#5  0x00007f942dd21aeb in preprocess_instantiate (conf=0x1217110, instance=0x1352108)
    at rlm_preprocess.c:497
#6  0x0000000000413bc1 in find_module_instance (modules=<value optimized out>, 
    instname=0x121e0c0 "preprocess", do_link=20259360) at modules.c:506
#7  0x0000000000414fee in do_compile_modsingle (parent=0x0, component=1, ci=0x121e080, grouptype=0, 
    modname=0x7fff3a739b38) at modcall.c:1872
#8  0x0000000000412db3 in load_component_section (cs=0x121df00, components=0x1351ea0, comp=1)
    at modules.c:794
#9  0x0000000000413368 in load_byserver (cs=0x121d6d0) at modules.c:993
#10 0x0000000000413697 in virtual_servers_load (config=0x1203030) at modules.c:1121
#11 0x0000000000414058 in setup_modules (reload=<value optimized out>, config=0x1203030)
    at modules.c:1368
#12 0x000000000041245a in read_mainconfig (reload=<value optimized out>) at mainconfig.c:904
#13 0x0000000000416d1a in main (argc=2, argv=0x7fff3a73a418) at radiusd.c:257
(gdb)
----

-- 
Alexander Clouter
.sigmonster says: Keep it short for pithy sake.