Bug 52755 - mod_filter segfaults
Summary: mod_filter segfaults
Status: RESOLVED FIXED
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_filter (show other bugs)
Version: 2.4.1
Hardware: PC Linux
: P2 normal (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords: FixedInTrunk
: 52780 (view as bug list)
Depends on:
Blocks:
 
Reported: 2012-02-23 21:53 UTC by William
Modified: 2012-05-06 07:29 UTC (History)
1 user (show)



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description William 2012-02-23 21:53:07 UTC
I got a simple .htaccess file which makes apache2.4.1 segfault almost on every request. 

<IfModule mod_deflate.c>
        SetOutputFilter DEFLATE
        AddOutputFilterByType DEFLATE text/plain
        AddOutputFilterByType DEFLATE text/xml
        AddOutputFilterByType DEFLATE text/html
        AddOutputFilterByType DEFLATE text/css
        AddOutputFilterByType DEFLATE image/svg+xml
        AddOutputFilterByType DEFLATE application/xhtml+xml
        AddOutputFilterByType DEFLATE application/xml
        AddOutputFilterByType DEFLATE application/rss+xml
        AddOutputFilterByType DEFLATE application/atom_xml
        AddOutputFilterByType DEFLATE application/x-javascript
        AddOutputFilterByType DEFLATE application/x-httpd-php
        AddOutputFilterByType DEFLATE application/x-httpd-fastphp
        AddOutputFilterByType DEFLATE application/x-httpd-eruby   
        SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png)$ no-gzip dont-vary
        SetEnvIfNoCase Request_URI \.(?:exe|t?gz|zip|bz2|sit|rar)$ no-gzip dont-vary
        SetEnvIfNoCase Request_URI \.(?:pdf|avi|mov|mp3|mp4|rm)$ no-gzip dont-vary   
        BrowserMatch ^Mozilla/4 gzip-only-text/html
        BrowserMatch ^Mozilla/4\.0[678] no-gzip
        BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
        Header append Vary User-Agent env=!dont-vary
</IfModule>
Comment 1 Stefan Fritsch 2012-02-24 20:50:09 UTC
The crash is fixed in trunk by r1293405

But I have noticed that AddOutputFilterByType does not yet work properly if two different filters are added to the same type.
Comment 2 William 2012-02-24 21:22:34 UTC
Hi Stefan,

(In reply to comment #1)
> The crash is fixed in trunk by r1293405

Thank you very much for the quick answer and patch. I should have reported that earlier. I will test it as soon as possible and report the result.

> But I have noticed that AddOutputFilterByType does not yet work properly if two
> different filters are added to the same type.

What do you mean by `does not yet work properly`? Is there already an open bug for that?

Regards,
-- 
William
Comment 3 William 2012-02-25 16:30:29 UTC
(In reply to comment #2)
> I will test it as soon as possible and report the result.

I successfully tested your patch and it fixes the issue reported. I'm therefore closing this bug but I'm still interested if you could give me more information about the issue you spotted (AddOutputFilterByType does not yet work properly if two different filters are added to the same type). Maybe there is an open bug for that?

Regards,
-- 
William
Comment 4 Stefan Fritsch 2012-02-25 21:56:44 UTC
Thanks for testing. But we leave PRs affecting a stable release open until they have been fixed in a stable release.

The other issue I have found is that if you have a config like

AddOutputFilterByType DEFLATE    text/xml
AddOutputFilterByType CASEFILTER text/xml

the second filter is not applied. There is no PR about this yet, but I have added a (failing) test case to our test suite, so we won't forget it.
Comment 5 Jeff Trawick 2012-02-27 18:38:57 UTC
*** Bug 52780 has been marked as a duplicate of this bug. ***
Comment 6 Stefan Fritsch 2012-03-12 18:53:55 UTC
(In reply to comment #4)
> The other issue I have found is that if you have a config like
> 
> AddOutputFilterByType DEFLATE    text/xml
> AddOutputFilterByType CASEFILTER text/xml
> 
> the second filter is not applied. There is no PR about this yet, but I have
> added a (failing) test case to our test suite, so we won't forget it.

This was a false alarm, there was just some confusion between text/xml and application/xml.
Comment 7 Jens Schleusener 2012-03-16 13:50:23 UTC
As an probably related observation I want to report segmentation faults on my server using httpd 2.4.1 (never seen for 2.2.22) that vanish applying the patched file mod_filter.c from httpd-2.4.x (subversion).

Here a typical line in the error_log file (increasing LogLevel to "debug" didn't give more infos):
 [Fri Mar 16 13:03:16.980532 2012] [core:notice] [pid 9543:tid 3076671232] AH00052: child pid 9714 exit signal Segmentation fault (11)

After many hours of cause studies I could break down this segmentation faults to the following szenario:

1) I built httpd 2.4.1 via

./configure --prefix=/usr/local/www/httpd2.4.1 --with-apr=/usr/local/www --with-apr-util=/usr/local/www --enable-rewrite --enable-deflate -enable-modules=few
make
make install

2) I added at the end of the default configuration file httpd.conf the following lines:

RewriteEngine On
Include conf/many_test_rewrite_rules.conf
# Important: Without that Filter NO segfaults!
<Location />
  AddOutputFilterByType DEFLATE text/html text/plain text/xml application/javascript
</Location>

3) I created the test file conf/many_test_rewrite_rules.conf with many dummy "Rewrite"-rules for e.g. via the following script (in reality I use similar lines on my fossies.org server to handle moved/renamed software archives):

#/bin/bash
OUT=many_test_rewrite_rules.conf
N0=10000
N=1
while [ "$N" -le "$N0" ]
do
  echo "RewriteRule ^/unix/privat/dummy-$N(.*)$ http://fossies.org/unix/misc/dummy-$N\$1 [R=301,L]"
  let N=N+1
done >  "$OUT"

Now accessing the default htdocs/index.html (avoiding caches)
I have seen beginning segmentation faults for N0 values for e.g. of

 > 5503 (for Linux OpenSUSE 11.3, 2 MB memory)
respectively
 > 5130   using http://fossies.org:8081/ instead of http://fossies.org/ in the so "larger" test rules.

On a Linux OpenSUSE 11.4 system with 8 MB memory the required number of RewriteRule-lines were a little bit higher. I had also the impression that the number of builtin/used modules changes that values slightly.

Unfortunately the hints in http://httpd.apache.org/dev/debugging.html didn't help me to get more detailed information or a core dump file. But since 2.4.2
is probably coming soon and solving the described bug such infos seems no longer required.

Jens
Comment 8 Stefan Fritsch 2012-05-06 07:29:31 UTC
fixed in 2.4.2