Prevent crashes on bare Varbind arguments

Author: SoundGoof

netsnmp/client_intf.c

@@ -1527,8 +1527,12 @@ netsnmp_get(PyObject *self, PyObject *args)
 
     if (varlist) {
       PyObject *varlist_iter = PyObject_GetIter(varlist);
+      if (!varlist_iter) {
+        snmp_free_pdu(pdu);
+        goto done;
+      }
 
-      while (varlist_iter && (varbind = PyIter_Next(varlist_iter))) {
+      while ((varbind = PyIter_Next(varlist_iter))) {
         if (py_netsnmp_attr_string(varbind, "tag", &tag, NULL) < 0 ||
             py_netsnmp_attr_string(varbind, "iid", &iid, NULL) < 0)
         {
@@ -1674,6 +1678,10 @@ netsnmp_get(PyObject *self, PyObject *args)
 
 done:
   SAFE_FREE(oid_arr);
+  if (PyErr_Occurred()) {
+    Py_XDECREF(val_tuple);
+    return NULL;
+  }
   return (val_tuple ? val_tuple : Py_BuildValue(""));
 }
 
@@ -1745,8 +1753,12 @@ netsnmp_getnext(PyObject *self, PyObject *args)
 
     if (varlist) {
       PyObject *varlist_iter = PyObject_GetIter(varlist);
+      if (!varlist_iter) {
+        snmp_free_pdu(pdu);
+        goto done;
+      }
 
-      while (varlist_iter && (varbind = PyIter_Next(varlist_iter))) {
+      while ((varbind = PyIter_Next(varlist_iter))) {
         if (py_netsnmp_attr_string(varbind, "tag", &tag, NULL) < 0 ||
             py_netsnmp_attr_string(varbind, "iid", &iid, NULL) < 0)
         {
@@ -1894,6 +1906,10 @@ netsnmp_getnext(PyObject *self, PyObject *args)
 
 done:
   SAFE_FREE(oid_arr);
+  if (PyErr_Occurred()) {
+    Py_XDECREF(val_tuple);
+    return NULL;
+  }
   return (val_tuple ? val_tuple : Py_BuildValue(""));
 }
 
@@ -1978,8 +1994,12 @@ netsnmp_walk(PyObject *self, PyObject *args)
 
     /* we need an initial count for memory allocation */
     varlist_iter = PyObject_GetIter(varlist);
+    if (!varlist_iter) {
+      snmp_free_pdu(pdu);
+      goto done;
+    }
     varlist_len = 0;
-    while (varlist_iter && (varbind = PyIter_Next(varlist_iter))) {
+    while ((varbind = PyIter_Next(varlist_iter))) {
       varlist_len++;
     }
     Py_DECREF(varlist_iter);
@@ -2236,7 +2256,7 @@ application.
       /* propagate error */
       if (verbose)
         printf("error: walk response processing: unknown python error");
-      Py_DECREF(val_tuple);
+      Py_CLEAR(val_tuple);
     } 
   }
 
@@ -2250,6 +2270,10 @@ application.
   }
   SAFE_FREE(oid_arr);
   SAFE_FREE(oid_arr_broken_check);
+  if (PyErr_Occurred()) {
+    Py_XDECREF(val_tuple);
+    return NULL;
+  }
   return (val_tuple ? val_tuple : Py_BuildValue(""));
 }
 
@@ -2487,14 +2511,16 @@ netsnmp_getbulk(PyObject *self, PyObject *args)
       /* propagate error */
       if (verbose)
         printf("error: getbulk response processing: unknown python error");
-      if (val_tuple)
-        Py_DECREF(val_tuple);
-      val_tuple = NULL;
+      Py_CLEAR(val_tuple);
     }
   }
 
 done:
   SAFE_FREE(oid_arr);
+  if (PyErr_Occurred()) {
+    Py_XDECREF(val_tuple);
+    return NULL;
+  }
   return (val_tuple ? val_tuple : Py_BuildValue(""));
 }
 
@@ -2503,7 +2529,7 @@ netsnmp_set(PyObject *self, PyObject *args)
 {
   PyObject *session;
   PyObject *varlist;
-  PyObject *varbind;
+  PyObject *varbind = NULL;
   PyObject *ret = NULL;
   netsnmp_session *ss;
   netsnmp_pdu *pdu, *response;
@@ -2551,8 +2577,12 @@ netsnmp_set(PyObject *self, PyObject *args)
 
     if (varlist) {
       PyObject *varlist_iter = PyObject_GetIter(varlist);
+      if (!varlist_iter) {
+        snmp_free_pdu(pdu);
+        goto done;
+      }
 
-      while (varlist_iter && (varbind = PyIter_Next(varlist_iter))) {
+      while ((varbind = PyIter_Next(varlist_iter))) {
         if (py_netsnmp_attr_string(varbind, "tag", &tag, NULL) < 0 ||
             py_netsnmp_attr_string(varbind, "iid", &iid, NULL) < 0)
         {
@@ -2637,6 +2667,8 @@ netsnmp_set(PyObject *self, PyObject *args)
 done:
   Py_XDECREF(varbind); 
   SAFE_FREE(oid_arr);
+  if (PyErr_Occurred())
+    return NULL;
   return (ret ? ret : Py_BuildValue(""));
 }
 

netsnmp/tests/test.py

@@ -248,6 +248,25 @@ def testFuncs(self):
 
 
 class SetTests(unittest.TestCase):
+    def test_session_methods_reject_bare_varbind(self):
+        session = netsnmp.Session(Version=2,
+                                  DestHost='127.0.0.1',
+                                  Community='public',
+                                  Timeout=1000,
+                                  Retries=0)
+        varbind = netsnmp.Varbind('.1.3.6.1.2.1.1.3', '0', b'1', 'INTEGER')
+        calls = ((TypeError, lambda: session.get(varbind)),
+                 (TypeError, lambda: session.getnext(varbind)),
+                 (TypeError, lambda: session.set(varbind)),
+                 (AttributeError, lambda: session.walk(varbind)),
+                 (AttributeError,
+                  lambda: session.getbulk(0, 1, varbind)))
+
+        for error_type, call in calls:
+            with self.subTest(call=call):
+                with self.assertRaises(error_type):
+                    call()
+
     def testFuncs(self):        
         print("\n-------------- SET Test Start ----------------------------\n")