accessing some request or server object members causes a segfault

• Key: MODPYTHON-99
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Critical
• Assignee: Jim Gallacher
• Reporter: Jim Gallacher
• Component/s: core
• Affects Version/s: 3.2.7
• Fix Version/s: 3.2.7

Description

Martin Devara discovered a segfault when accessing some request object members. For example:

def handler(req):
        req.content_type = "text/plain"
        req.write("EE\n")
        a = getattr(req,"allowed_methods");
    return apache.OK

Futher investigation revealed problems with several getter functions in requestobject.c and serverobject.c. The root of the problem seems to be pointer dereferencing errors in the getter code. The affected functions and the members which use them are:

src/requestobject.c
    getreq_rec_ml
        allowed_methods

    getreq_rec_ah
        content_languages
        allowed_xmethods

src/serverobject.c
    getsrv_recmbr_ah
        names
        wild_names

Martin has provided a patch to fix the bug.

(Thanks to Martin for tracking this down and providing the fix.)

Comments

[Jim Gallacher]

Martin's patch (md-20051209.diff)

[Jim Gallacher]

Should we be unit testing the getters and setters for all request and server object members?

[Jim Gallacher]

Some of the unit tests fail after applying Martin's patch. Investigating further reveals that request members are being tested in the unit tests but there are several problems.

One failing test is for req.allowed_xmethods != (). I think this may be a problem with test itself as it seems allowed_xmethods returns None.

The question remains though: why were the tests not detecting the segfaults detailed in this issue?

[Nicolas Lehuen]

Modifying util.c so that tuple_from_array_header and tuple_from_method_list return an empty tuple instead of None fixes the problem, but I still have t(o check whether this change won't break anything else.

[Nicolas Lehuen]

OK, if we modify tuple_from_array_header and tuple_from_method_list, here are the members that would be defined as an empty tuple rather than a None value when the underlying Apache data is not defined :

server.names
server.wildnames
req.allowed_xmethods
req.allowed_methods
req.content_languages

I don't know if we should change the behaviour of those members or simply alter the unit tests, though.

[Jim Gallacher]

The req.allowed_xmethods, req.allowed_methods documentation states that these are a tuples. It seems req.content_languages, server.names, server.wild_names are undocumented.

I don't have mod_python 3.1.4 handy to test but certainly the relavent code has not changed since then. If the problem existed there then I don't think we need to worry about changing the return type since nobody would have been able to access these members anyway.