segfault in 1.3.17

[Michael Smith <mj...@iii.co.uk>]

I've just tried to upgrade from 1.3.11 to 1.3.17 and experience
segfaults, presumably due to my use of "RewriteRule"s - I know there was
a problem due to a security hole, but thought this had been fixed.
Anyhow, here goes:

The backtrace I see in gdb is:


0  0x3db3c in ap_pstrndup (a=0x11f720, s=0xee2c8
"80/common/$1docs/$2/$3",
    n=-15) at alloc.c:807
#1  0x35af8 in do_expand (r=0x11f748,
    input=0xee2a0
"http://${farm:map_centres}/%{HTTP_HOST}:80/common/$1docs/$2/$3",
buffer=0xffbed0c8 "http://", nbuf=8192, briRR=0x120818, briRC=0x120918)
    at mod_rewrite.c:2296
#2  0x34ab4 in apply_rewrite_rule (r=0x11f748, p=0xfaf28, perdir=0x0)
    at mod_rewrite.c:1925
#3  0x33dc4 in apply_rewrite_list (r=0x11f748, rewriterules=0xce428,
    perdir=0x0) at mod_rewrite.c:1619
#4  0x32a50 in hook_uri2file (r=0x11f748) at mod_rewrite.c:1096
#5  0x444c8 in run_method (r=0x11f748, offset=0, run_all=0)
    at http_config.c:369
#6  0x44580 in ap_translate_name (r=0x11f748) at http_config.c:381
#7  0x614b8 in process_request_internal (r=0x11f748) at
http_request.c:1177
#8  0x61b6c in ap_process_request (r=0x11f748) at http_request.c:1302
#9  0x551c0 in child_main (child_num_arg=5) at http_main.c:4205
#10 0x5554c in make_child (s=0xcddc0, slot=5, now=981743457)
    at http_main.c:4364
#11 0x55670 in startup_children (number_to_start=5) at http_main.c:4391
#12 0x5605c in standalone_main (argc=3, argv=0xffbefbc4) at
http_main.c:4679
#13 0x56c58 in main (argc=3, argv=0xffbefbc4) at http_main.c:5006


the relevant line of the source code is:

2296                        key  = ap_pstrndup(r->pool, key+1,
endp-key-1);

the reason why endp-key-1 is negative appears to be because

(gdb) p endp
$6 = 0xee2b9 "}/%{HTTP_HOST}:80/common/$1docs/$2/$3"

and

(gdb) p key
$7 = 0xee2c7 ":80/common/$1docs/$2/$3"

The relevant line of the config file seems to be this RewriteRule:

RewriteRule ^/(reg/)?([^/]*)/(.*)
http://${farm:map_centres}/%{HTTP_HOST}:80/common/$1docs/$2/$3 [P]


Any help - as ever appreciated.  Any help I can give, please let me
know!

Mike

Re: segfault in 1.3.17

[Tony Finch <do...@dotat.at>]

Michael Smith <mj...@iii.co.uk> wrote:
>
>I've just tried to upgrade from 1.3.11 to 1.3.17 and experience
>segfaults, presumably due to my use of "RewriteRule"s - I know there was
>a problem due to a security hole, but thought this had been fixed.

Yes, several times :-( I made a bit of a mess of this one. Have you
tried the patch at <http://httpd.apache.org/dist/apache_1.3.17-fix.diff>?

Tony.
-- 
f.a.n.finch    fanf@covalent.net    dot@dotat.at
ROCKALL MALIN HEBRIDES BAILEY FAIR ISLE FAEROES: SOUTHEASTERLY VEERING
SOUTHWESTERLY 6 TO GALE 8. RAIN THEN THUNDERY SHOWERS. MODERATE OR GOOD.