[SVN-4616] mod_dav_svn: Unbounded memory usage with PROPFIND requests

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.8.15, 1.9.3
• Component/s: mod_dav_svn
• Assignee: Unassigned
• Reporter: Evgeny Kotkov
• Created: 29/Jan/16 14:34
• Updated: 29/Jan/16 14:34

Description

Responding to PROPFIND requests can result in httpd/mod_dav_svn consuming unbounded amounts of memory.

Reproduction script based on the user report where the user has a server running out of memory and crashing:

1. Create repository with /trunk, /branches, /tags hosted by httpd
2. Import a .jar file into /trunk
3. Create a tag from /trunk
4. Repeat two last steps 9000 times
5. Issue a depth 1 PROPFIND request for /tags, either by issuing

   svn ls -v http://localhost/repository/tags

   or with curl:

   curl -X PROPFIND -d "<?xml version='1.0' encoding='utf-8'?><propfind xmlns='DAV:' xmlns:S='http://subversion.tigris.org/xmlns/svn/'><prop><resourcetype xmlns='DAV:' /><getcontentlength xmlns='DAV:' /><version-name xmlns='DAV:' /><creator-displayname xmlns='DAV:' /><creationdate xmlns='DAV:' /><checked-in xmlns='DAV:' /><S:mime-type /></prop></propfind>" --header "Depth: 1" http://localhost/repository/tags
   

6. The memory consumption while the server handles PROPFIND request will grow quickly. Creating new tags will increase the absolute amount of memory required to handle the request.

See the e-mail thread "[RFC/PATCH] Handling PROPFIND in mod_dav_svn" on the dev@s.a.o mailing list for the discussion of the problem and the possible solution.