[kea-dev] Accidentally found infinite recursion in Kea 1.3 Option...

Dave Cole davecole at nbnco.com.au
Mon Feb 5 22:39:26 UTC 2018


I understand that the problem is in my code.  I just thought I should tell someone in case they cared 😊


If the Option used a visited_ flag then recursive calls could detect cycles established by callouts and throw an exception rather than crash.


________________________________
From: Francis Dupont <fdupont at isc.org>
Sent: Monday, 5 February 2018 9:34:59 PM
To: Dave Cole
Cc: kea-dev at lists.isc.org
Subject: Re: [kea-dev] Accidentally found infinite recursion in Kea 1.3 Option...

Dave Cole writes:
> While adding more tests for my code I stumbled on a problem in Kea.  It is a
> small thing in the scheme of things, but it might be of interest.

=> IMHO the problem is in your code and is not prevented by Kea.

> >>> from kea import *
> >>> p = Pkt4(DHCPDISCOVER, 0)
> >>> o = Option(1)
> >>> o.addOption(o)
> >>> p.addOption(o)
> >>> p.pack()

=> if I understand well you created a loop with an option including
itself as a sub-option.

> Program received signal SIGSEGV, Segmentation fault.

=> even if the method is tail recursive its call consumes some stack
until the stack underflows...

> isc::dhcp::Option::len (this=0x555555ba3140) at option.cc:176
> 176       size_t length = getHeaderLen() + data_.size();

=> for documentation what is the source of the problem is:

    // ... and sum of lengths of all suboptions
    for (OptionCollection::const_iterator it = options_.begin();
         it != options_.end();
         ++it) {
         length += (*it).second->len();
                                 ^^^ recursive call
    }

Thanks

Francis Dupont <fdupont at isc.org>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/kea-dev/attachments/20180205/48cfaf8b/attachment.html>


More information about the kea-dev mailing list