[PATCH] bugfix: abort gracefully when tmpfile creation fails

[Max Kellermann <ma...@duempel.org>]

I observed mod_apreq going into an endless loop and exhausting all my
virtual memory when my temp directory was misconfigured. This is
because mod_apreq.c/apreq_filter() does not check the return value of
apreq_brigade_concat().

A fix is appended.

Max

Re: [PATCH] bugfix: abort gracefully when tmpfile creation fails

[Max Kellermann <ma...@duempel.org>]

On 2005/01/08 18:02, Joe Schaefer <jo...@sunstarsys.com> wrote:
> Thanks.  Could you explain the misconfiguration details a bit more?
> Ideally there'd be an accompanying env/t test for it as well,
> (preferably one that doesn't crash an unpatched machine ;-).

Actually, it was a bad cast in the patches I am currently developing,
and it treated some undefined field as temp_dir. temp_dir then
happened to point to the string "LoadModule" (yeah strange). I didn't
test, but you should be able to trigger this error by configuring
APREQ_TempDir to something invalid (or unwritable).

I don't think you can write a test case which doesn't crash -
triggering this bug will leave apreq_filter() in an endless loop,
allocating memory in every iteration.

When that happened first to me, my kernel began killing random
processes to free more memory for apreq ;)

Max

Re: [PATCH] bugfix: abort gracefully when tmpfile creation fails

[Joe Schaefer <jo...@sunstarsys.com>]

Max Kellermann <ma...@duempel.org> writes:

> I observed mod_apreq going into an endless loop and exhausting all my
> virtual memory when my temp directory was misconfigured. This is
> because mod_apreq.c/apreq_filter() does not check the return value of
> apreq_brigade_concat().
>
> A fix is appended.

Thanks.  Could you explain the misconfiguration details a bit more?
Ideally there'd be an accompanying env/t test for it as well, (preferably 
one that doesn't crash an unpatched machine ;-).

-- 
Joe Schaefer