#867341 xymonnet buffer overflow, breaking all network tests, when using ipv6 addresses for ping/conn test

Package:
xymon
Source:
xymon
Description:
monitoring system for systems, networks and applications
Submitter:
Nicolas Marot
Date:
2026-10-19 17:39:05 UTC
Severity:
normal
Tags:
#867341#5
Date:
2017-07-05 22:15:45 UTC
From:
To:
Dear Maintainer,


   * I was using xymon 4.3.0~beta2.dfsg-9.1+deb7u1 on Debian wheezy 7.11 and successfully ping some ipv6 hosts with conn6 test
   * I am migrating to xymon 4.3.28-2 on Debian 9 and conn6 does not work anymore (tests are purple)
     So I decided to put my ipv6s to conn=worst,ipv4,ipv6 like
        conn=worst,163.172.93.135,2001:bc8:318d:100::1
   * I tried also with brakets around [ipv6]
   * I noticed all networks tests gone purple and reading xymonnet log, I discovered buffer overflow

#867341#14
Date:
2019-09-09 13:28:58 UTC
From:
To:
Hi,

I wrote in #939846:

https://bugs.debian.org/939846 and https://bugs.debian.org/867341 are
probably related issues if not even the same issue. (867341: "all
networks tests gone purple and reading xymonnet log, I discovered
buffer overflow")

It's though unclear to me relation to the (working for me) conn6 test
from hobbit-plugins is — which works fine for me (with hostnames,
though).

Nicolas: Can you tell us where exactly in xymonnet the buffer overflow
is? Is it in xymonnet/dns.c? Because that's where I experience the
crashes with IPv6-only URLs on hosts.cfg.

Additionally, I actually also have the issue with the last night
uploaded 4.3.30-1 in Debian Unstable.

		Regards, Axel

#867341#19
Date:
2019-11-24 22:56:42 UTC
From:
To:
Hi Axel,

I re-read the bug description and realized i was using an ipv6 with conn
test (and not conn6)
so, the 2 bugs seem to be the same issue or at least related.

Regards,
Nicolas

#867341#24
Date:
2026-10-15 13:35:10 UTC
From:
To:
Hi Nicolas!

I tried to reproduce this issue with current 4.3.30-6.
I wasn't able to reproduce it in the way above that tests become
purple (maybe because xymonnet crashed).
I hope, that the root cause of this (xymonnet crash) was already fixed
in the meantime.

But I still observe a problem with one host running in red conn state.
That's because xymonnet currently puts all IP addresses, that should
be checked into an (alphabetically) sorted file and runs fping -Ae
(or xymonping) on it.
This file generation fails on IP addresses which are longer than 15
chars (plus \n), and only gets first 16 chars from it (without
appending \n), so your 2001:bc8:318d:100::1 is written to the fping
input as 2001:bc8:318d:10 without a trailing \n, and the next IP (for
example 222.222.222.222 is directly appended like
2001:bc8:318d:10222.222.222.222
instead of being written to a new line.

This results 222.222.222.222 conn becoming red, since it isn't found
in the fping output.

Maybe this is a different issue than the one you reported :-)

Anyway, xymon 4.3.30 (and also the upcoming 4.3.31) don't support IPv6
as an address in the first column of hosts.cfg or as an parameter of
conn.  So at the moment you should still use the conn6 plugin from
hobbit-plugins.

Greetings
Roland