#1152875 libsnmp-perl: use-after-free when an async request is retried

Package:
libsnmp-perl
Source:
libsnmp-perl
Description:
SNMP (Simple Network Management Protocol) Perl5 support
Submitter:
Sebastian Bugge
Date:
2026-11-02 19:51:02 UTC
Severity:
normal
Tags:
#1152875#5
Date:
2026-11-02 19:25:01 UTC
From:
To:
Dear Maintainer,

When the `get` method of an SNMP::Session object is retried in an async
context, the callback data is prematurely freed. This is due to treating
the operation NETSNMP_CALLBACK_OP_RESEND as a final operation even though
it is only meant to signify a retry.

This bug can be reproduced by running this script without having a snmp
listener at port 8000:

```perl
#!/usr/bin/perl
use strict;
use warnings;

use SNMP;
use Time::HiRes qw(time);

my $s = SNMP::Session->new(
    DestHost => 'localhost:8000',
    Version  => '2c',
    Timeout  => 200_000,
    Retries  => 1,
);

my $t0 = time;
$s->get(
    [ ['.1.3.6.1.2.1.1'] ],
    [ sub { printf "callback at %.2fs: %s\n", time - $t0, $s->{ErrorStr} } ]
);
SNMP::MainLoop(1);
```

Here is an excerpt from the output when running this script under
valgrind:

```
$ valgrind -q perl reproduction_get.pl
==3412770== Invalid read of size 8
==3412770==    at 0x5FB2261: __snmp_xs_cb (SNMP.xs:1178)
==3412770==    by 0x56D1986: snmp_sess_timeout (snmp_api.c:6881)
==3412770==    by 0x56D1B47: snmp_timeout (snmp_api.c:6726)
==3412770==    by 0x5FB1418: XS_SNMP__main_loop (SNMP.xs:5067)
==3412770==    ...
==3412770==  Address 0x6b8d728 is 8 bytes inside a block of size 16 free'd
==3412770==    at 0x484787F: free (vg_replace_malloc.c:989)
==3412770==    by 0x5FB2389: __snmp_xs_cb (SNMP.xs:1187)
==3412770==    by 0x56D0C0D: snmp_resend_request.constprop.0 (snmp_api.c:6815)
==3412770==    by 0x56D1A05: snmp_sess_timeout (snmp_api.c:6888)
==3412770==    by 0x56D1B47: snmp_timeout (snmp_api.c:6726)
==3412770==    by 0x5FB1418: XS_SNMP__main_loop (SNMP.xs:5067)
==3412770==    ...
==3412770==  Block was alloc'd at
==3412770==    at 0x4844818: malloc (vg_replace_malloc.c:446)
==3412770==    by 0x5FBD5FB: XS_SNMP__get (SNMP.xs:3335)
==3412770==    ...

==3412770== Invalid free() / delete / delete[] / realloc()
==3412770==    at 0x484787F: free (vg_replace_malloc.c:989)
==3412770==    by 0x5FB2389: __snmp_xs_cb (SNMP.xs:1187)
==3412770==    by 0x56D1986: snmp_sess_timeout (snmp_api.c:6881)
==3412770==    by 0x56D1B47: snmp_timeout (snmp_api.c:6726)
==3412770==    by 0x5FB1418: XS_SNMP__main_loop (SNMP.xs:5067)
==3412770==    ...
==3412770==  Address 0x6b8d720 is 0 bytes inside a block of size 16 free'd
==3412770==    [same free'd/alloc'd stacks as above]
```

This bug is resolved with commit cf5d7defd20 in the upstream repository.
Would it be possible to port this fix to the trixie-security suite?

A related bug with the bulkwalk method, got fixed in this PR:
https://github.com/net-snmp/net-snmp/pull/1166

Do you want me to file a separate bug report for this related bug?