snmptrapd: Really fix a buffer overflow triggered by an empty enterprise OID

bvanassche · bvanassche · commit ca51e5808b70 · 2025-12-25T20:02:46.000+01:00
Fixes: ce1c9d4 ("snmptrapd: Fix a buffer overflow triggered by an empty enterprise OID") Fixes: https://issues.oss-fuzz.com/issues/471518953
diff --git a/apps/snmptrapd_handlers.c b/apps/snmptrapd_handlers.c
@@ -1115,7 +1115,7 @@ snmp_input(int op, netsnmp_session *session,
             if (pdu->trap_type == SNMP_TRAP_ENTERPRISESPECIFIC) {
                 trapOidLen = pdu->enterprise_length;
                 memcpy(trapOid, pdu->enterprise, sizeof(oid) * trapOidLen);
-                if (trapOidLen >= 0 && trapOid[trapOidLen - 1] != 0) {
+                if (trapOidLen > 0 && trapOid[trapOidLen - 1] != 0) {
                     trapOid[trapOidLen++] = 0;
                 }
                 trapOid[trapOidLen++] = pdu->specific_type;

Original file line number	Diff line number	Diff line change
`@@ -1115,7 +1115,7 @@ snmp_input(int op, netsnmp_session *session,`
`1115`	`1115`	`if (pdu->trap_type == SNMP_TRAP_ENTERPRISESPECIFIC) {`
`1116`	`1116`	`trapOidLen = pdu->enterprise_length;`
`1117`	`1117`	`memcpy(trapOid, pdu->enterprise, sizeof(oid) * trapOidLen);`
`1118`		`- if (trapOidLen >= 0 && trapOid[trapOidLen - 1] != 0) {`
	`1118`	`+ if (trapOidLen > 0 && trapOid[trapOidLen - 1] != 0) {`
`1119`	`1119`	`trapOid[trapOidLen++] = 0;`
`1120`	`1120`	`}`
`1121`	`1121`	`trapOid[trapOidLen++] = pdu->specific_type;`