DO NOT REPLY [Bug 51072] New: httpd segfaults when DYNAMIC_MODULE_LIMIT is reached

[bu...@apache.org]

https://issues.apache.org/bugzilla/show_bug.cgi?id=51072

           Summary: httpd segfaults when DYNAMIC_MODULE_LIMIT is reached
           Product: Apache httpd-2
           Version: 2.3-HEAD
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Core
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: torsten.foertsch@gmx.net


Created an attachment (id=26889)
 --> (https://issues.apache.org/bugzilla/attachment.cgi?id=26889)
the cure

when httpd startup is aborted because the DYNAMIC_MODULE_LIMIT is hit it
segfaults. This happens because config.c:ap_add_module() inserts the new module
into the module list before it has checked for all possible errors. Then if the
limit is reached the module is partly added.

The caller mod_so.c:load_module() installs a pool cleanup to remove the module
only if ap_add_module() returns without error. But APR has also added a pool
cleanup to remove the mapped memory segment.

Now, when the pool is destroyed first the APR cleanup is called and it removes
the memory segment. But that segment also contains the module structure where
ap_top_module still points to. Then the next cleanup function for a dynamic
module (the one loaded previous to the module that caused hitting the limit) is
called. It calls config.c:ap_remove_module() which traverses the list starting
at ap_top_module. But ap_top_module still points to the memory segment that has
just been removed from the address space. Hence, it segfaults.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 51072] httpd segfaults when DYNAMIC_MODULE_LIMIT is reached

[bu...@apache.org]

https://issues.apache.org/bugzilla/show_bug.cgi?id=51072

Stefan Fritsch <sf...@sfritsch.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #1 from Stefan Fritsch <sf...@sfritsch.de> 2011-04-15 15:05:18 EDT ---
committed as r1092787. Thanks for debugging this.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org