Bug 22832 - sigsegv at ssl_engine_io.c
Summary: sigsegv at ssl_engine_io.c
Status: CLOSED DUPLICATE of bug 21370
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_ssl (show other bugs)
Version: 2.0.47
Hardware: PC Linux
: P3 critical (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-08-30 07:21 UTC by Juan F. Codagnone
Modified: 2004-11-16 19:05 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Juan F. Codagnone 2003-08-30 07:21:26 UTC
Hi, 
  i was playing with subversion (http+ssl+svn), when i copied an example 
from
  the web (knowing that it was bad) and apache SISEGVed at 
  /modules/ssl/ssl_engine_io.c:1231

the section that trigered the data was 
Option FillowSymLinks
<Location /svn/iolsucker >
        DAV svn
        SVNParentPath /home/cvsowner/svnroot/iolsucker
SSLVerifyClient      optional
SSLVerifyDepth       1
SSLOptions           +FakeBasicAuth +StrictRequire
SSLRequire           %{SSL_CIPHER_USEKEYSIZE} >= 128

#   Force clients from the Internet to use HTTPS
RewriteEngine        on
RewriteCond          %{REMOTE_ADDR} !^192\.168\.1\.[0-9]+$
RewriteCond          %{HTTPS} !=on
RewriteRule          .* - [F]

        AuthType Basic
        AuthName "IOLSUCKER repositories. Anon account available."
        AuthUserFile /home/cvsowner/svn/conf/svn/password
        AuthzSVNAccessFile /home/cvsowner/svn/conf/svn/iolsucker.access
        Require valid-user
</Location>

----------------------------------

Anyway, here is the backtrace:

[Sat Aug 30 03:55:14 2003] [notice] child pid 2891 exit signal Segmentation
fault (11), possible coredump in /home/cvsowner/svn

$ gdb /home/cvsowner/svn/bin/httpd  /home/cvsowner/svn/core
GNU gdb 5.3
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain 
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-slackware-linux"...
Core was generated by `/home/cvsowner/svn/bin/httpd -k start'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libssl.so.0...done.
Loaded symbols for /usr/lib/libssl.so.0
Reading symbols from /usr/lib/libcrypto.so.0...done.
Loaded symbols for /usr/lib/libcrypto.so.0
Reading symbols from /home/cvsowner/svn/lib/libaprutil-0.so.0...done.
Loaded symbols for /home/cvsowner/svn/lib/libaprutil-0.so.0
Reading symbols from /usr/lib/libgdbm.so.2...done.
Loaded symbols for /usr/lib/libgdbm.so.2
Reading symbols from /lib/libdb-4.1.so...done.
Loaded symbols for /lib/libdb-4.1.so
Reading symbols from /usr/lib/libexpat.so.0...done.
Loaded symbols for /usr/lib/libexpat.so.0
Reading symbols from /home/cvsowner/svn/lib/libapr-0.so.0...done.
Loaded symbols for /home/cvsowner/svn/lib/libapr-0.so.0
Reading symbols from /lib/librt.so.1...done.
Loaded symbols for /lib/librt.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libnsl.so.1...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libpthread.so.0...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libnss_compat.so.2...done.
Loaded symbols for /lib/libnss_compat.so.2
Reading symbols from /home/cvsowner/svn/modules/mod_dav_svn.so...done.
Loaded symbols for /home/cvsowner/svn/modules/mod_dav_svn.so
Reading symbols from /home/cvsowner/svn//lib/libsvn_repos-1.so.0...done.
Loaded symbols for /home/cvsowner/svn//lib/libsvn_repos-1.so.0
Reading symbols from /home/cvsowner/svn//lib/libsvn_fs-1.so.0...done.
Loaded symbols for /home/cvsowner/svn//lib/libsvn_fs-1.so.0
Reading symbols from /home/cvsowner/svn//lib/libsvn_delta-1.so.0...done.
Loaded symbols for /home/cvsowner/svn//lib/libsvn_delta-1.so.0
Reading symbols from /home/cvsowner/svn//lib/libsvn_subr-1.so.0...done.
Loaded symbols for /home/cvsowner/svn//lib/libsvn_subr-1.so.0
Reading symbols from /usr/lib/libz.so.1...done.
Loaded symbols for /usr/lib/libz.so.1
Reading symbols from /home/cvsowner/svn/modules/mod_authz_svn.so...done.
Loaded symbols for /home/cvsowner/svn/modules/mod_authz_svn.so
#0  0x40082a24 in CRYPTO_get_ex_data () from /usr/lib/libcrypto.so.0
(gdb) bt full
#0  0x40082a24 in CRYPTO_get_ex_data () from /usr/lib/libcrypto.so.0
No symbol table info available.
#1  0x3f504a49 in ?? ()
No symbol table info available.
#2  0x08076195 in ssl_io_filter_input (f=0x0, bb=0x81a7a88, 
    mode=AP_MODE_READBYTES, block=APR_BLOCK_READ, readbytes=0)
    at /home/cvsowner/src/httpd-2.0.47/modules/ssl/ssl_engine_io.c:1231
	status = 232
	inctx = (bio_filter_in_ctx_t *) 0x4014ca8c
	len = 8192
	is_init = 232
#3  0x080bb4f6 in ap_get_brigade (next=0x0, bb=0x81a7a88, 
    mode=AP_MODE_GETLINE, block=APR_BLOCK_READ, readbytes=0)
    at /home/cvsowner/src/httpd-2.0.47/server/util_filter.c:513
No locals.
#4  0x080bb4f6 in ap_get_brigade (next=0x0, bb=0x81a7a88, 
    mode=AP_MODE_GETLINE, block=APR_BLOCK_READ, readbytes=0)
    at /home/cvsowner/src/httpd-2.0.47/server/util_filter.c:513
No locals.
#5  0x080bc4ca in ap_rgetline_core (s=0x81a6df8, n=8192, read=0xbffff41c, 
    r=0x81a6de0, fold=0, bb=0x81a7a88)
    at /home/cvsowner/src/httpd-2.0.47/server/protocol.c:256
	rv = 135953032
	e = (apr_bucket *) 0x64
	bytes_handled = 0
	current_alloc = 0
	pos = 0x0
	last_char = 0x0
	do_alloc = 1
	saw_eos = 0
#6  0x080bca13 in read_request_line (r=0x81a6de0, bb=0x81a7a88)
    at /home/cvsowner/src/httpd-2.0.47/server/protocol.c:623
	rv = 232
	ll = 0xbffff448 "xôÿ¿IÐ\v\bàm\032\b\210z\032\b\200\001"
	uri = 0x0
	pro = 0x0
	major = 1
	minor = 0
	http = "¨m\032\b\210"
	len = 1075147149
	num_blank_lines = 0
	max_blank_lines = 100
#7  0x080bd049 in ap_read_request (conn=0x81a7a88)
    at /home/cvsowner/src/httpd-2.0.47/server/protocol.c:885
	p = (apr_pool_t *) 0x81a6da8
	expect = 0x81a7a88 "¨m\032\b\214z\032\b\214z\032\b 
M\032\b\030z\032\b\210z\032\bpp\025@¸[\006\bX\r\032\b"
	access_status = 232
	tmp_bb = (apr_bucket_brigade *) 0x81a7a88
#8  0x08083e88 in ap_process_http_connection (c=0x81a0e30)
    at /home/cvsowner/src/httpd-2.0.47/modules/http/http_core.c:285
	r = (request_rec *) 0x81aef70
	csd_set = 1
	csd = (apr_socket_t *) 0x81a0d58
#9  0x080b91a6 in ap_run_process_connection (c=0x81a0e30)
    at /home/cvsowner/src/httpd-2.0.47/server/connection.c:85
	pHook = (ap_LINK_process_connection_t *) 0xe8
	n = 0
	rv = 232
#10 0x080adb54 in child_main (child_num_arg=232)
    at /home/cvsowner/src/httpd-2.0.47/server/mpm/prefork/prefork.c:694
	ptrans = (apr_pool_t *) 0x81a0d20
	allocator = (apr_allocator_t *) 0x8194bd0
	current_conn = (conn_rec *) 0x81a0e30
	status = 135925296
	i = 0
	lr = (ap_listen_rec *) 0x81a0e30
	curr_pollfd = 0
	last_pollfd = 0
	pollset = (apr_pollfd_t *) 0x8194d08
	offset = 232
	csd = (void *) 0x81a0d58
	sbh = (ap_sb_handle_t *) 0x8194cd8
	rv = 232
	bucket_alloc = (apr_bucket_alloc_t *) 0x81a4da0
#11 0x080adc80 in make_child (s=0x81442d0, slot=2)
    at /home/cvsowner/src/httpd-2.0.47/server/mpm/prefork/prefork.c:788
	pid = 0
#12 0x080add8f in startup_children (number_to_start=3)
    at /home/cvsowner/src/httpd-2.0.47/server/mpm/prefork/prefork.c:806
	i = 0
#13 0x080ae509 in ap_mpm_run (_pconf=0x0, plog=0x813eb78, s=0x81442d0)
    at /home/cvsowner/src/httpd-2.0.47/server/mpm/prefork/prefork.c:1022
	index = 0
	remaining_children_to_start = 5
	rv = 232
#14 0x080b39f8 in main (argc=3, argv=0xbffff664)
    at /home/cvsowner/src/httpd-2.0.47/server/main.c:660
	c = 0 '\0'
	configtestonly = 0
	confname = 0x80e78dc "conf/httpd.conf"
	def_server_root = 0x80e8772 "/home/cvsowner/svn"
	temp_error_log = 0x0
	process = (process_rec *) 0x80fcaf0
	server_conf = (server_rec *) 0x81442d0
	pglobal = (apr_pool_t *) 0x80fca70
	pconf = (apr_pool_t *) 0x80fea78
	plog = (apr_pool_t *) 0x813eb78
	ptemp = (apr_pool_t *) 0x814f0c0
	pcommands = (apr_pool_t *) 0x813cb70
	opt = (apr_getopt_t *) 0x813cc08
	rv = 232
	mod = (module **) 0x81442d0
	optarg = 0x4000b100 "U\211åWVS\203ìLèÊ\003"
	signal_server = (apr_OFN_ap_signal_server_t *) 0
#15 0x40339d06 in __libc_start_main () from /lib/libc.so.6
No symbol table info available.
(gdb) quit
Comment 1 Mads Toftum 2003-11-17 03:10:59 UTC
Could you please try simplifying this a bit. Also, does the same happen
without SSLOptions +FakeBasicAuth and how about removing the Require? Any
change with SSLVerifyClient require?
 
Comment 2 Joe Orton 2004-01-25 15:52:36 UTC
Can you reproduce this using 2.0.48?
Comment 3 Joe Orton 2004-02-25 12:13:36 UTC
This is most likely a duplicate of bug 21370, which was fixed in 2.0.48.  Please
reopen if you have problems with 2.0.48.

*** This bug has been marked as a duplicate of 21370 ***