Dear Maintainer,
When the `get` method of an SNMP::Session object is retried in an async
context, the callback data is prematurely freed. This is due to treating
the operation NETSNMP_CALLBACK_OP_RESEND as a final operation even though
it is only meant to signify a retry.
This bug can be reproduced by running this script without having a snmp
listener at port 8000:
```perl
#!/usr/bin/perl
use strict;
use warnings;
use SNMP;
use Time::HiRes qw(time);
my $s = SNMP::Session->new(
DestHost => 'localhost:8000',
Version => '2c',
Timeout => 200_000,
Retries => 1,
);
my $t0 = time;
$s->get(
[ ['.1.3.6.1.2.1.1'] ],
[ sub { printf "callback at %.2fs: %s\n", time - $t0, $s->{ErrorStr} } ]
);
SNMP::MainLoop(1);
```
Here is an excerpt from the output when running this script under
valgrind:
```
$ valgrind -q perl reproduction_get.pl
==3412770== Invalid read of size 8
==3412770== at 0x5FB2261: __snmp_xs_cb (SNMP.xs:1178)
==3412770== by 0x56D1986: snmp_sess_timeout (snmp_api.c:6881)
==3412770== by 0x56D1B47: snmp_timeout (snmp_api.c:6726)
==3412770== by 0x5FB1418: XS_SNMP__main_loop (SNMP.xs:5067)
==3412770== ...
==3412770== Address 0x6b8d728 is 8 bytes inside a block of size 16 free'd
==3412770== at 0x484787F: free (vg_replace_malloc.c:989)
==3412770== by 0x5FB2389: __snmp_xs_cb (SNMP.xs:1187)
==3412770== by 0x56D0C0D: snmp_resend_request.constprop.0 (snmp_api.c:6815)
==3412770== by 0x56D1A05: snmp_sess_timeout (snmp_api.c:6888)
==3412770== by 0x56D1B47: snmp_timeout (snmp_api.c:6726)
==3412770== by 0x5FB1418: XS_SNMP__main_loop (SNMP.xs:5067)
==3412770== ...
==3412770== Block was alloc'd at
==3412770== at 0x4844818: malloc (vg_replace_malloc.c:446)
==3412770== by 0x5FBD5FB: XS_SNMP__get (SNMP.xs:3335)
==3412770== ...
==3412770== Invalid free() / delete / delete[] / realloc()
==3412770== at 0x484787F: free (vg_replace_malloc.c:989)
==3412770== by 0x5FB2389: __snmp_xs_cb (SNMP.xs:1187)
==3412770== by 0x56D1986: snmp_sess_timeout (snmp_api.c:6881)
==3412770== by 0x56D1B47: snmp_timeout (snmp_api.c:6726)
==3412770== by 0x5FB1418: XS_SNMP__main_loop (SNMP.xs:5067)
==3412770== ...
==3412770== Address 0x6b8d720 is 0 bytes inside a block of size 16 free'd
==3412770== [same free'd/alloc'd stacks as above]
```
This bug is resolved with commit cf5d7defd20 in the upstream repository.
Would it be possible to port this fix to the trixie-security suite?
A related bug with the bulkwalk method, got fixed in this PR:
https://github.com/net-snmp/net-snmp/pull/1166
Do you want me to file a separate bug report for this related bug?