I was working on new Simple checks (read answer from tcp services) and ran into a situation where zabbix_server segfaulted on a tcp_read error:

------------8<------------ gdb ------------8<------------
This GDB was configured as "i386-unknown-openbsd4.1"...
Core was generated by `zabbix_server'.
Program terminated with signal 11, Segmentation fault.
#0 0x1c124fc0 in vfprintf (fp=0x3c0c4838, fmt0=0x3c00f999 "tcp_read error: %s:%s", ap=0xcfbdd7d0 "") at /usr/src/lib/libc/stdio/vfprintf.c:612
612 /usr/src/lib/libc/stdio/vfprintf.c: No such file or directory.
in /usr/src/lib/libc/stdio/vfprintf.c
(gdb) bt
#0 0x1c124fc0 in vfprintf (fp=0x3c0c4838, fmt0=0x3c00f999 "tcp_read error: %s:%s", ap=0xcfbdd7d0 "") at /usr/src/lib/libc/stdio/vfprintf.c:612
#1 0x1c02246e in __zbx_zabbix_log (level=4, fmt=0x3c00f999 "tcp_read error: %s:%s") at log.c:260
#2 0x1c020803 in tcp_read (host=0xcfbe00a0 "10.253.6.132", port=25, request=0xcfbdf0a0 "HELO genua.de", value_str=0xcfbde8a0 "", max_buf_len=255) at net.c:294
#3 0x1c021856 in CHECK_SERVICE_READ (cmd=0xcfbe1900 "net.tcp.service.read[smtp,10.253.6.132,25,HELO genua.de]", param=0xcfbe1100 "smtp,10.253.6.132,25,HELO genua.de", flags=0, result=0xcfbe79f0)
at simple.c:483
#4 0x1c01d83d in process (in_command=0xcfbe6160 "net.tcp.service.read[smtp,10.253.6.132,25,HELO genua.de]", flags=0, result=0xcfbe79f0) at sysinfo.c:514
#5 0x1c013ee7 in get_value_simple (item=0xcfbe8230, result=0xcfbe79f0) at checks_simple.c:269
#6 0x1c012356 in get_value (item=0xcfbe8230, result=0xcfbe79f0) at poller.c:80
#7 0x1c012b5d in get_values () at poller.c:358
#8 0x1c01318c in main_poller_loop (type=0, num=3) at poller.c:538
#9 0x1c00da0c in MAIN_ZABBIX_ENTRY () at server.c:1134
#10 0x1c022ae5 in daemon_start (allow_root=0) at daemon.c:170
#11 0x1c00d5f8 in main (argc=1, argv=0xcfbe8db4) at server.c:978
------------8<------------ gdb ------------8<------------

But this is simply due to a wrong format string that expects a %s while it gets an integer, the following patch will fix it:

------------8<------------ Bugfix ------------8<------------
$ svn diff -rBASE trunk/src/libs/zbxsysinfo/common/net.c
Index: trunk/src/libs/zbxsysinfo/common/net.c
===================================================================
— trunk/src/libs/zbxsysinfo/common/net.c (revision 5092)
+++ trunk/src/libs/zbxsysinfo/common/net.c (working copy)
@@ -291,7 +291,7 @@

if(FAIL == ret)

------------8<------------ Bugfix ------------8<------------