[SVN-3875] Serf SEGV in pool handling on error

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: ---
• Fix Version/s: 1.7.0
• Component/s: libsvn_ra_serf
• Labels: third-party
• Assignee: C. Michael Pilato
• Reporter: Philip Martin
• Created: 10/May/11 12:26
• Updated: 27/Oct/18 19:29
• Resolved: 24/Jun/11 17:54

Description

When I build APR and Subversion with pool debugging serf can SEGV when an error
occurs. I don't know if this is a problem in serf or libsvn_ra_serf.

A wrong URL gives:

svn ls http:/svn.apache.org/abc
../src/subversion/svn/list-cmd.c:301: (apr_err=175009)
../src/subversion/libsvn_client/list.c:153: (apr_err=175009)
../src/subversion/libsvn_client/ra.c:481: (apr_err=175009)
../src/subversion/libsvn_client/ra.c:683: (apr_err=175009)
../src/subversion/libsvn_client/revisions.c:73: (apr_err=175009)
../src/subversion/libsvn_ra_serf/property.c:1001: (apr_err=175009)
../src/subversion/libsvn_ra_serf/property.c:683: (apr_err=175009)
../src/subversion/libsvn_ra_serf/util.c:638: (apr_err=175009)
../src/subversion/libsvn_ra_serf/util.c:1493: (apr_err=175009)
../src/subversion/libsvn_ra_serf/util.c:1493: (apr_err=175009)
../src/subversion/libsvn_ra_serf/util.c:1245: (apr_err=175009)
../src/subversion/libsvn_ra_serf/util.c:1245: (apr_err=175009)
svn: E175009: XML parsing failed: (405 Method Not Allowed)
Segmentation fault

GDB stack trace:

#0  apr_allocator_free (allocator=0x4141414141414141, node=0x6862a0)
    at ../memory/unix/apr_pools.c:416
#1  0x00007ffff2ae8ce1 in serf_default_destroy_and_data (bucket=0x684fc8)
    at buckets/buckets.c:120
#2  0x00007ffff2ae93ec in serf_response_destroy_and_data (bucket=0x681a18)
    at buckets/response_buckets.c:91
#3  0x00007ffff2ae6438 in destroy_request (request=0x674ed8)
    at ./outgoing.c:306
#4  0x00007ffff2ae69d5 in serf_connection_close (conn=0x670ab0)
    at ./outgoing.c:1113
#5  0x00007ffff2ae6ae9 in clean_conn (data=0x4141414141414141)
    at ./outgoing.c:56
#6  0x00007ffff6bb1476 in run_cleanups (pool=0x66da70, 
    file_line=0x434d28 "../src/subversion/svn/main.c:2633")
    at ../memory/unix/apr_pools.c:2308
#7  pool_clear_debug (pool=0x66da70, 
    file_line=0x434d28 "../src/subversion/svn/main.c:2633")
    at ../memory/unix/apr_pools.c:1509
#8  0x00007ffff6bb16ee in pool_destroy_debug (pool=0x4141414141414141, 
    file_line=0x6862a0 "") at ../memory/unix/apr_pools.c:1594
#9  0x00007ffff6bb1450 in pool_clear_debug (pool=0x66d240, 
    file_line=0x434d28 "../src/subversion/svn/main.c:2633")
    at ../memory/unix/apr_pools.c:1506
#10 0x00007ffff6bb16ee in pool_destroy_debug (pool=0x4141414141414141, 
    file_line=0x6862a0 "") at ../memory/unix/apr_pools.c:1594
#11 0x00007ffff6bb1450 in pool_clear_debug (pool=0x66c960, 
    file_line=0x434d28 "../src/subversion/svn/main.c:2633")
    at ../memory/unix/apr_pools.c:1506
#12 0x00007ffff6bb16ee in pool_destroy_debug (pool=0x4141414141414141, 
    file_line=0x6862a0 "") at ../memory/unix/apr_pools.c:1594
#13 0x00007ffff6bb1450 in pool_clear_debug (pool=0x6473f0, 
    file_line=0x434d28 "../src/subversion/svn/main.c:2633")
    at ../memory/unix/apr_pools.c:1506
#14 0x00007ffff6bb16ee in pool_destroy_debug (pool=0x4141414141414141, 
    file_line=0x6862a0 "") at ../memory/unix/apr_pools.c:1594
#15 0x0000000000416a86 in main (argc=5, argv=0x7fffffffea18)
    at ../src/subversion/svn/main.c:2633

http://code.google.com/p/serf/issues/detail?id=76