Attached is a fix for the 4.3.29 version of xymonnet/xymonnet.c that is truncating the RPC test reporting for the service. With the security changes to using strncat() rather than strcat(), the size of a malloc string cannot be determined by using sizeof(). For example:

char *buffer = (char *)malloc(sizeof(char) * 10);
int numElements = sizeof(buffer); 

does not return 10.

I did not have time to check the rest of the xymon source tree to see if there are other instances of the sizeof() being miscalculated for malloc'ed strings.

Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary.

-----Original Message----- From: Tom Schmidt (tschmidt) Sent: Thursday, August 8, 2019 10:54 AM To: John Horne <john.horne at plymouth.ac.uk>; xymon at xymon.com Subject: Re: [Xymon] Hostname validation (was Re: Xymon 4.3.29 Released - Important Security Update)

I likewise see one more issue with 4.3.29 that I am trying to correct. The xymonnet RPC check is not displaying the RPC test summary correctly at the top of the svcstatus report. It should look like this:

Mon Apr 1 10:53:02 2019 rpc ok,

green Service rpcbind (ID: 100000) found on port 111
green Service ypbind (ID: 100007) found on port 1013

Command: rpcinfo -p 1.2.3.4 2>&1

Instead, it is getting truncated like this:

Thu Aug 8 10:42:07 2019 rpc ok,

green S

Command: rpcinfo -p 1.2.3.4 2>&1

The truncation is causing any red/yellow/green RPC checks to not show properly at the top of the svcstatus report.

Tom Schmidt Sr Manager, IT, Product Engineering IT ETD Eng Sites US Micron Technology, Inc. Office:?+1 (208) 368-4058 ?Fax:?(208)368-2807 Email:?tschmidt at micron.com? Website:?micron.com Micron Technology, Inc., Confidential and Proprietary.

-----Original Message----- From: Xymon <xymon-bounces at xymon.com> On Behalf Of John Horne Sent: Thursday, August 8, 2019 10:16 AM To: xymon at xymon.com Subject: [EXT] Re: [Xymon] Hostname validation (was Re: Xymon 4.3.29 Released - Important Security Update)

On Mon, 2019-08-05 at 13:26 -0700, Japheth Cleaver wrote:

Thanks, this does indeed fix the issue. I've added in underscores (which have been valid for hostnames in xymon, though not in reality) to match the checks elsewhere. Would appreciate if others could confirm on this.

Fix/patch is committed in https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsour ceforge.net%2Fp%2Fxymon%2Fcode%2F8072%2F&data=02%7C01%7Ctschmidt%4 0micron.com%7C64388b4a70ef471166d708d71c1bcbf8%7Cf38a5ecd28134862b11ba c1d563c806f%7C0%7C0%7C637008778033157428&sdata=L9XY5CBlGUlIFZDQpaO kV0nffOL4RDS0uIN%2F6uJELFc%3D&reserved=0 ; 4.3.30 with this to come shortly.

Sorry - stealing the subject - could I ask to hold fire with 4.3.30 for a little while. There still seems to be a problem with graph titles when using 'exec:'. I'm just trying to track it down now (looks like an extra double-quote has crept in somewhere). Thanks.

John.

-- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.plymouth.ac.uk%2Fimages%2Femail_footer.gif&data=02%7C01%7Ctschmidt%40micron.com%7C64388b4a70ef471166d708d71c1bcbf8%7Cf38a5ecd28134862b11bac1d563c806f%7C0%7C0%7C637008778033157428&sdata=Vbz%2F5ikN5U4HsRz6X5qm3dEAyDM9sMmdrY1%2FT%2FgFIYM%3D&reserved=0]<https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.plymouth.ac.uk%2Fworldclass&data=02%7C01%7Ctschmidt%40micron.com%7C64388b4a70ef471166d708d71c1bcbf8%7Cf38a5ecd28134862b11bac1d563c806f%7C0%7C0%7C637008778033167417&sdata=WYuWzp6kfIUgQzeedzE21f8kcremFyHPGj%2FiJNG038k%3D&reserved=0>

This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

Xymon mailing list Xymon at xymon.com https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.xymon.com%2Fmailman%2Flistinfo%2Fxymon&data=02%7C01%7Ctschmidt%40micron.com%7C64388b4a70ef471166d708d71c1bcbf8%7Cf38a5ecd28134862b11bac1d563c806f%7C0%7C0%7C637008778033167417&sdata=ZrghxVgvmXdUOCxhXaVuz19e19rv5TLIDtG9lvtYE7k%3D&reserved=0