Details
-
Bug
-
Status: Open
-
Major
-
Resolution: Unresolved
-
1.8.15, 1.9.3
-
None
-
None
Description
Responding to PROPFIND requests can result in httpd/mod_dav_svn consuming unbounded amounts of memory.
Reproduction script based on the user report where the user has a server running out of memory and crashing:
- Create repository with /trunk, /branches, /tags hosted by httpd
- Import a .jar file into /trunk
- Create a tag from /trunk
- Repeat two last steps 9000 times
- Issue a depth 1 PROPFIND request for /tags, either by issuing
svn ls -v http://localhost/repository/tags
or with curl:
curl -X PROPFIND -d "<?xml version='1.0' encoding='utf-8'?><propfind xmlns='DAV:' xmlns:S='http://subversion.tigris.org/xmlns/svn/'><prop><resourcetype xmlns='DAV:' /><getcontentlength xmlns='DAV:' /><version-name xmlns='DAV:' /><creator-displayname xmlns='DAV:' /><creationdate xmlns='DAV:' /><checked-in xmlns='DAV:' /><S:mime-type /></prop></propfind>" --header "Depth: 1" http://localhost/repository/tags
- The memory consumption while the server handles PROPFIND request will grow quickly. Creating new tags will increase the absolute amount of memory required to handle the request.
See the e-mail thread "[RFC/PATCH] Handling PROPFIND in mod_dav_svn" on the dev@s.a.o mailing list for the discussion of the problem and the possible solution.