Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-1050

Some windows eventlog messages cause zabbix agent to crash at 'FormatMessage()'.

    Details

    • Type: Incident report
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 1.6
    • Fix Version/s: 1.6.6, 1.9.0 (alpha)
    • Component/s: Agent (G)
    • Labels:
      None
    • Environment:
      Windows(XP, 2003), Zabbix Agent 1.6.6 from ZABBIX SIA.

      Description

      Some windows eventlog messages cause zabbix agent to crash at 'FormatMessage()'.

      If 'hLib' has arguments more than the number of array of 'aInsertStrs', zabbix will crash at 'FormatMessage()'.
      But, zabbix restricts the number of array of 'aInsertStrs' to less than 'MAX_INSERT_STRS'.
      In zabbix 1.6.6, 'MAX_INSERT_STRS' is 64.
      So, if 'hLib' has arguments more than 64, it will crash.
      > for (
      > i = 0, pCh = (char *)((LPBYTE)pELR + pELR->StringOffset);
      > i < pELR->NumStrings && i < MAX_INSERT_STRS;
      > i++, pCh += strlen(pCh) + 1) /* point to next string */
      >

      { > aInsertStrs[i] = pCh; > }

      Most of eventlog don't have arguments more than 64.
      But, some eventlogs have.
      Actually, I found this problem at SAP eventlog which has arguments more than 64.
      I cannot attach the dll, but it is easy to reproduce same crash situation by setting MAX_INSERT_STRS as small number, like 1, 2 or 3.

        Attachments

          Activity

            People

            • Assignee:
              sasha Alexander Vladishev
              Reporter:
              tsuzuki Takanori Suzuki
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: