Backtraces on recurring segfaults on mod_perl-1.27/apache-1.3.26

[db...@newsfactor.com]

I've managed to get a couple of backtraces on a segfault problem we've 
been having for months now. The segfaults occur pretty rarely on the 
whole, but once a client triggers one on a particular page, they do not 
stop. The length and content of the request are key in making the 
segfaults happen. Modifying the cookie or adding characters to the 
request line causes the segfaults to stop.

example (word wrapped):


This request will produce a segfault (backtrace in attached gdb1.txt) 
and about 1/3 of the expected page :


nc 192.168.1.20 84
GET /perl/section/entcmpt/ HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; Konqueror/3; Linux 2.4.18-5)
Pragma: no-cache
Cache-control: no-cache
Accept: text/*, image/jpeg, image/png, image/*, */*
Accept-Encoding: x-gzip, gzip, identity
Accept-Charset: iso-8859-1, utf-8;q=0.5, *;q=0.5
Accept-Language: en
Host: 192.168.1.20:84
Cookie: 
mxstsn=1033666066:19573.19579.19572.19574.19577.19580.19576.19558.19560.19559.19557.19567.19566.19568.19544.19553.19545.19551.19554.19546.19548.19547.19532.19535.19533.19538.19534:0; 
Apache=192.168.2.1.124921033666065714


Adding a bunch of zeroes to the URI (which does not change the code 
functionality) causes the page to work correctly:


nc 192.168.1.20 84
GET 
/perl/section/entcmpt/?00000000000000000000000000000000000000000000000000000000 
HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; Konqueror/3; Linux 2.4.18-5)
Pragma: no-cache
Cache-control: no-cache
Accept: text/*, image/jpeg, image/png, image/*, */*
Accept-Encoding: x-gzip, gzip, identity
Accept-Charset: iso-8859-1, utf-8;q=0.5, *;q=0.5
Accept-Language: en
Host: 192.168.1.20:84
Cookie: 
mxstsn=1033666066:19573.19579.19572.19574.19577.19580.19576.19558.19560.19559.19557.19567.19566.19568.19544.19553.19545.19551.19554.19546.19548.19547.19532.19535.19533.19538.19534:0; 
Apache=192.168.2.1.124921033666065714




Some info:
/usr/apache-perl/bin/httpd -l
Compiled-in modules:
   http_core.c
   mod_env.c
   mod_log_config.c
   mod_mime.c
   mod_negotiation.c
   mod_status.c
   mod_include.c
   mod_autoindex.c
   mod_dir.c
   mod_cgi.c
   mod_asis.c
   mod_imap.c
   mod_actions.c
   mod_userdir.c
   mod_alias.c
   mod_access.c
   mod_auth.c
   mod_so.c
   mod_setenvif.c
   mod_php4.c
   mod_perl.c



Please forgive any obvious missing info (i'm not a c programmer). The 
first backtrace shows the segfault happening in mod_perl_sent_header(), 
and the second shows it happening in  the ap_make_array() which was from 
Apache::Cookie. I don't have one handy now, but I've also seen it happen 
in ap_soft_timeout() after an XS_Apache_print (r->server was out of bounds).

I've added a third backtrace where r->content_encoding contains the 
above 'mxstsn' cookie name.




Any help would be greatly appreciated.

-- 
--
Daniel Bohling
NewsFactor Network