mod_dav_svn segfaults upon PROPFIND to the SVNParentPath location (was: Re: apache coredump in mod_dav_svn)

[Daniel Shahaf <d....@daniel.shahaf.name>]

Moving to dev@.  (Please drop users@ from follow-ups.)

Summary: segfault in mod_dav_svn with PROPFIND at the SVNParentPath
location, reproducable with trunk.

Daniel Shahaf wrote on Fri, Nov 05, 2010 at 14:03:26 +0200:
> Rob Kooper wrote on Wed, Nov 03, 2010 at 22:54:57 -0500:
> > I'm getting a core dump in mod_dav_svn, here is the backtrace:
> > 
> ...
> > 
> > This seems to happen when a propfind is performed on the parentpath of my repository. Running the following curl makes the coredump happen:
> > 
> > curl --request PROPFIND --header "Depth: 1" https://host/svn/
> > 
> > The section from apache.conf is:
> > 
> >         <Location /svn>
> >                 # Uncomment this to enable the repository
> >                 DAV svn
> > 
> >                 # Set this to the path to your repository
> >                 SVNParentPath /home/svn
> >                 SVNListParentPath on
> >         </Location>
> > 
> > Is this a known issue or do I have something wrong.
> 
> Thanks for the report.  I can reproduce it with current trunk:
> 
> (gdb) bt
> #0  0xb749d640 in svn_stringbuf_dup (original_string=0x0, pool=0x8402518)
>     at subversion/libsvn_subr/svn_string.c:509
> #1  0xb751556e in walk (params=0xbfce3780, depth=1, response=0xbfce37d0)
>     at subversion/mod_dav_svn/repos.c:4139
> #2  0x0809f94f in dav_method_propfind (r=0x8402558) at mod_dav.c:2064
> #3  0x080a362c in dav_handler (r=0x8402558) at mod_dav.c:4649
> #4  0x0807d9f9 in ap_run_handler (r=0x8402558) at config.c:158
> #5  0x08080d7e in ap_invoke_handler (r=0x8402558) at config.c:376
> #6  0x080988d6 in ap_process_request (r=0x8402558) at http_request.c:282
> #7  0x08095858 in ap_process_http_connection (c=0x83fe6e0) at http_core.c:190
> #8  0x08084eb9 in ap_run_process_connection (c=0x83fe6e0) at connection.c:43
> #9  0x080beb5d in child_main (child_num_arg=<value optimized out>) at prefork.c:662
> #10 0x080bee27 in make_child (s=0x834f098, slot=0) at prefork.c:707
> #11 0x080bf532 in ap_mpm_run (_pconf=0x834a0a8, plog=0x838e1b8, s=0x834f098) at prefork.c:983
> #12 0x0806a490 in main (argc=Cannot access memory at address 0x0) at main.c:739
>