_apache._global_lock results in segfault when index > number of mutexes

• Key: MODPYTHON-58
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Minor
• Assignee: Unassigned
• Reporter: Jim Gallacher
• Component/s: core
• Affects Version/s: 3.1.3, 3.1.4, 3.2.7
• Fix Version/s: 3.2.7

Description

All of the following calls will cause a segfault when the index is greater than the number of global mutexes available or index < -1.

eg. 32 mutexes created on apache startup

index = 100
_apache._global_lock(req.server, None, index)
_global_unlock(req.server, None, index)
_apache._global_trylock(req.server, None, index)

For all of the corresponding functions in _apachemodule.c, the value of index is not checked before using it to access the contents of the global array of mutex locks.

eg.
    rv = apr_global_mutex_lock(glb->g_locks[index]);

I'll attach a patch for all three functions that does this check.

eg.

    if ((index >= (glb->nlocks)) || (index < -1)) {
        ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
                     "Index %d is out of range for number of global mutex locks", index);
        PyErr_SetString(PyExc_ValueError,
                        "Lock index is out of range for number of global mutex locks");
        return NULL;
    }