You are viewing a plain text version of this content. The canonical link for it is here.
Posted to apreq-dev@httpd.apache.org by Sven Geisler <sg...@aeccom.com> on 2002/12/30 15:02:01 UTC

segfault in Apache::Upload::fh with libapreq 1.1rc2

Hi,

I use libapreq 1.1rc2 with self-compiled perl 5.8.0, mod_perl 1.27,
apache 1.3.27:

my Perl code:

if ($r->method_number == Apache::Constants::M_POST) {
	foreach my $upload ($r->upload) {
		my $name = $upload->name;
		if (ref($upload->fh)) {
			# do something with upload
			...
		}
	}

	# do more
	...
}

I got this message in gdb:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 8192 (LWP 25219)]
0x420693d7 in fileno_unlocked () from /lib/i686/libc.so.6

(gdb) where
#0  0x420693d7 in fileno_unlocked () from /lib/i686/libc.so.6
#1  0x40407591 in XS_Apache__Upload_fh (cv=0x8306a54) at Request.xs:501
#2  0x400f6ea8 in Perl_pp_entersub () at pp_hot.c:2773
#3  0x400deb17 in Perl_runops_debug () at dump.c:1398
#4  0x4009c2ec in S_call_body (myop=0xbfffee70, is_eval=0) at
perl.c:2045
#5  0x4009bfb6 in Perl_call_sv (sv=0x4017cd94, flags=68) at perl.c:1963
#6  0x4009b9d4 in Perl_call_method (methname=0x0, flags=68) at
perl.c:1857
#7  0x0806be24 in perl_call_handler ()
#8  0x0806b9c1 in perl_run_stacked_handlers ()
#9  0x0806a25a in perl_handler ()
#10 0x08089563 in ap_invoke_handler ()
#11 0x0809aff2 in ap_some_auth_required ()
#12 0x0809b261 in ap_process_request ()
#13 0x08093c30 in ap_child_terminate ()
#14 0x08093eb1 in ap_child_terminate ()
#15 0x08093f2f in ap_child_terminate ()
#16 0x080949a4 in ap_child_terminate ()
#17 0x08094cb4 in main ()
#18 0x420158d4 in __libc_start_main () from /lib/i686/libc.so.6

In my Perl code the segfault is in $upload->fh.
I looked in Request.xs.:

	fd = PerlLIO_dup(fileno(ApacheUpload_fh(upload)));

fileno is called with zero ptr (upload->fp is null).

I would suggest following code in Request.xs (line 490) to prevent using
zero ptrs.
		
ApreqInputStream
ApacheUpload_fh(upload)
    Apache::Upload upload

    PREINIT:
    int fd;
    FILE *fp;

    CODE:
    /* debug code */
    if ( !upload )
       XSRETURN_UNDEF;

    fp = ApacheUpload_fh(upload);
    if ( !fp )
       XSRETURN_UNDEF;       

    fd = PerlLIO_dup(fileno(fp));

    if ( !(RETVAL = PerlIO_fdopen(fd, "r")) )
	    XSRETURN_UNDEF;

    OUTPUT:
...

I guess, it's more perl 5.8.0 than libapreq.
I got another segfault with the process that receive successful the file
in the next request in glibc fflush. Any idea?

Regards
Sven.



machine: RedHat 8.0 with glibc 2.2.93-5

perl -V:
Summary of my perl5 (revision 5.0 version 8 subversion 0) configuration:
  Platform:
    osname=linux, osvers=2.4.18-18.8.0, archname=i686-linux
    uname='linux andes 2.4.18-18.8.0 #1 wed nov 13 22:52:09 est 2002
i686 athlon i386 gnulinux '
    config_args='-des -Doptimize=-O2 -mcpu=athlon -march=athlon -g
-Dcc=cc -Dprefix=/local/cs -Uinstallusrbinperl
-Dcf_by=AEC/communications GmbH -Duseshrplib -Uusethreads -Uuseithreads
-Duselargefiles -Ud_dosuid -Dd_semctl_semun -Di_db -Ui_ndbm -Di_gdbm
-Di_shadow -Di_syslog -Dman3ext=3pm -Duseperlio -Uinstallusrbinperl
-Ubincompat5005 -Uversiononly -Dpager=/usr/bin/less -isr -DDEBUGGING'
    hint=recommended, useposix=true, d_sigaction=define
    usethreads=undef use5005threads=undef useithreads=undef
usemultiplicity=undef
    useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
    use64bitint=undef use64bitall=undef uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='cc', ccflags ='-DDEBUGGING -fno-strict-aliasing
-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm',
    optimize='-O2 -mcpu=athlon -march=athlon -g',
    cppflags='-DDEBUGGING -fno-strict-aliasing -I/usr/include/gdbm'
    ccversion='', gccversion='3.2 20020903 (Red Hat Linux 8.0 3.2-7)',
gccosandvers=''
    intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t',
lseeksize=8
    alignbytes=4, prototype=define
  Linker and Libraries:
    ld='cc', ldflags =' -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib
    libs=-lnsl -lgdbm -ldb -ldl -lm -lc -lcrypt -lutil
    perllibs=-lnsl -ldl -lm -lc -lcrypt -lutil
    libc=/lib/libc-2.2.93.so, so=so, useshrplib=true, libperl=libperl.so
    gnulibc_version='2.2.93'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-rdynamic
-Wl,-rpath,/local/cs/lib/perl5/5.8.0/i686-linux/CORE'
    cccdlflags='-fpic', lddlflags='-shared -L/usr/local/lib'


Characteristics of this binary (from libperl):
  Compile-time options: DEBUGGING USE_LARGE_FILES
  Built under linux
  Compiled at Dec 23 2002 11:09:59
  %ENV:
   
PERL5LIB="/local/sgeisler/andes2010/cs_code/perl5:/local/sgeisler/andes2010/cs_code/batchproc/renderjob"
  @INC:
    /local/sgeisler/andes2010/cs_code/perl5
    /local/sgeisler/andes2010/cs_code/batchproc/renderjob
    /local/cs/lib/perl5/5.8.0/i686-linux
    /local/cs/lib/perl5/5.8.0
    /local/cs/lib/perl5/site_perl/5.8.0/i686-linux
    /local/cs/lib/perl5/site_perl/5.8.0
    /local/cs/lib/perl5/site_perl
    .



Re: segfault in Apache::Upload::fh with libapreq 1.1rc2

Posted by Stas Bekman <st...@stason.org>.
Sven Geisler wrote:
> Hi,
> 
> I use libapreq 1.1rc2 with self-compiled perl 5.8.0, mod_perl 1.27,
> apache 1.3.27:
> 
> my Perl code:
> 
> if ($r->method_number == Apache::Constants::M_POST) {
> 	foreach my $upload ($r->upload) {
> 		my $name = $upload->name;
> 		if (ref($upload->fh)) {
> 			# do something with upload
> 			...
> 		}
> 	}
> 
> 	# do more
> 	...
> }
> 
> I got this message in gdb:
> 
> Program received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 8192 (LWP 25219)]
> 0x420693d7 in fileno_unlocked () from /lib/i686/libc.so.6

Thank you, Sven, for the diagnosis and patch, which should be certainly 
fixed. But this shouldn't have happened in first place, $upload->fh 
shouldn't be set if there is no file to upload. Any chance you can 
supply a reproducable showcase which reproduces this segfault? Because 
the problem with this patch:

     fp = ApacheUpload_fh(upload);
     if ( !fp )
        XSRETURN_UNDEF;

is that the client code expects a file, and we return undef here.

__________________________________________________________________
Stas Bekman            JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/     mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org   http://ticketmaster.com