You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2012/01/30 12:24:35 UTC
DO NOT REPLY [Bug 52559] New: [PATCH] Some PROPPATCH causing
segfault in mod_dav_fs / mod_dav
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
Bug #: 52559
Summary: [PATCH] Some PROPPATCH causing segfault in mod_dav_fs
/ mod_dav
Product: Apache httpd-2
Version: 2.5-HEAD
Platform: PC
OS/Version: Windows Vista
Status: NEW
Severity: normal
Priority: P2
Component: mod_dav_fs
AssignedTo: bugs@httpd.apache.org
ReportedBy: Diego.SantaCruz@spinetix.com
Classification: Unclassified
With our product we stumbled across a segfault in mod_dav_fs / mod_dav, as
follows.
When a PROPPATCH attempts to remove a non-existent dead property on a resource
for which there is no dead property in the same namespace httpd segfaults
(e.g., attempt to remove a property 'foo' in namespace 'http://example.com/bar'
on a new resource which has no other dead properties).
Furthermore, if the resource had no dead properties, after this segfault httpd
leaves the dead property DBM in a state which causes an httpd segfault on every
PROPFIND (the .pag and .dir files are both zero length).
>From our analysis the problem boils down to three issues. A patch for each
follows.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 52559] [PATCH] Some PROPPATCH causing segfault in mod_dav_fs /
mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
Graham Leggett <mi...@sharp.fm> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |RESOLVED
Resolution|--- |FIXED
--- Comment #11 from Graham Leggett <mi...@sharp.fm> ---
Backported to v2.4.5.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 52559] [PATCH] Some PROPPATCH causing segfault in
mod_dav_fs / mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
Diego Santa Cruz <Di...@spinetix.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Platform|PC |All
Version|2.5-HEAD |2.2.21
OS/Version|Windows Vista |Linux
--- Comment #4 from Diego Santa Cruz <Di...@spinetix.com> 2012-01-30 12:44:37 UTC ---
Forgot to mention, but the tests have been done against httpd 2.2.21. The
attached patches are against this version too.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 52559] [PATCH] Some PROPPATCH causing segfault in
mod_dav_fs / mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
--- Comment #3 from Diego Santa Cruz <Di...@spinetix.com> 2012-01-30 12:43:07 UTC ---
Created attachment 28230
--> https://issues.apache.org/bugzilla/attachment.cgi?id=28230
Do not segfault on PROPFIND with a zero length DBM
As described above, when httpd segfaults during the PROPPATCH it leaves a zero
length DBM if no other dead properties existed for the resource. Doing a
PROPFIND on the resource segfaults httpd.
The cause of the segfault is that dav_get_allprops() does not check the return
value of the first_name() nor next_name() DB hooks for errors. When the DBM is
of zero length (both the .dir and .pag files are zero length) first_name()
returns an error and leaves its 'name' argument uninitialized. But then
'name.ns' is accessed just after the first_name() call, possibly causing a
segfault or other errors as 'name' is stack allocated.
The attached patch changes this so that the return value of first_name() and
next_name() is checked and the while loop on the properties be stopped in case
of error.
As it seems that dav_get_allprops() cannot return an error I could not see
another way to handle this situation and this is how errors on the
output_value() hook call are treated within dav_get_allprops() anyhow.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 52559] [PATCH] Some PROPPATCH causing segfault in mod_dav_fs /
mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
--- Comment #8 from Graham Leggett <mi...@sharp.fm> ---
Second patch applied to trunk in r1476644.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 52559] [PATCH] Some PROPPATCH causing segfault in mod_dav_fs /
mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
--- Comment #7 from Graham Leggett <mi...@sharp.fm> ---
First patch applied to trunk in r1476642.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 52559] [PATCH] Some PROPPATCH causing segfault in mod_dav_fs /
mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
Christophe JAILLET <ch...@wanadoo.fr> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |PatchAvailable
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 52559] [PATCH] Some PROPPATCH causing segfault in mod_dav_fs /
mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
Graham Leggett <mi...@sharp.fm> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #10 from Graham Leggett <mi...@sharp.fm> ---
Can you test and verify this works for you?
Backport proposed for v2.4.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 52559] [PATCH] Some PROPPATCH causing segfault in mod_dav_fs /
mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
--- Comment #12 from Graham Leggett <mi...@sharp.fm> ---
Proposed for backport to v2.2.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 52559] [PATCH] Some PROPPATCH causing segfault in mod_dav_fs /
mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
--- Comment #6 from Wim Lewis <wi...@omnigroup.com> ---
The crash also still occurs in trunk/2.5 r1470659, no apparent change from
2.4.4
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 52559] [PATCH] Some PROPPATCH causing segfault in mod_dav_fs /
mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
Wim Lewis <wi...@omnigroup.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |wiml@omnigroup.com
OS|Linux |All
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 52559] [PATCH] Some PROPPATCH causing segfault in
mod_dav_fs / mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
--- Comment #1 from Diego Santa Cruz <Di...@spinetix.com> 2012-01-30 11:31:18 UTC ---
Created attachment 28228
--> https://issues.apache.org/bugzilla/attachment.cgi?id=28228
First patch to fix PROPPATCH segfault
This patch fixes the described segfault in the PROPPATCH.
In the described case a rollback cannot be created when doing the
dav_method_proppacth(), because dav_propdb_get_rollback() fails without
returning a rollback object. Thus the call to dav_propdb_apply_rollback()
segfaults because rollback is NULL. This patch just protects against that case
considering it a success.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 52559] [PATCH] Some PROPPATCH causing segfault in
mod_dav_fs / mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
--- Comment #2 from Diego Santa Cruz <Di...@spinetix.com> 2012-01-30 12:31:23 UTC ---
Created attachment 28229
--> https://issues.apache.org/bugzilla/attachment.cgi?id=28229
Do not fail PROPPATCH when prop namespace not known
With the patch in attachment 28228 the PROPPATCH described above no longer
segfaults httpd, but fails with a 500 error.
As stated in RFC 4918 (WebDAV), section 14.23, removing a non-existing property
is not an error.
The failure comes from dav_propdb_get_rollback(), which returns an error for
the non-existent property. It turns out that if the property's namespace is not
known (as can well be the case for a non-existent property) dav_build_key()
returns a zeroed key, but doing a dav_dbm_fetch() on such a key returns an
error. In fact, APR's apr_dbm_fetch() returns APR_EINVAL for such a key (at
least the SDBM backend).
The patch modifies dav_dbm_fetch() so that is catches this case and treats it
as a "key not found", which is the actual error as the namespace index is built
from the DBM.
With this patch httpd succeds the test case described above (doing a PROPPATCH
to remove a non-existing property on a resource which does not have any other
property in the same namespace).
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 52559] [PATCH] Some PROPPATCH causing segfault in mod_dav_fs /
mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
--- Comment #9 from Graham Leggett <mi...@sharp.fm> ---
Third patch applied to trunk in r1476645.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 52559] [PATCH] Some PROPPATCH causing segfault in mod_dav_fs /
mod_dav
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52559
--- Comment #5 from Wim Lewis <wi...@omnigroup.com> ---
I can confirm this crash still occurs in Apache 2.4.4: the PROPFIND causes a
segfault and leaves the zero-length DAV prop db behind. (However, the
zero-length prop db no longer causes later operations to crash the server, so
that's progress I guess.)
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000010
0x0000000100602c53 in dav_propdb_apply_rollback ()
(gdb) bt
#0 0x0000000100602c53 in dav_propdb_apply_rollback ()
#1 0x00000001000c8d2d in dav_prop_rollback ()
#2 0x00000001000c1b0e in dav_process_ctx_list ()
#3 0x00000001000c2074 in dav_method_proppatch ()
#4 0x00000001000c7063 in dav_handler ()
#5 0x00000001000015ef in ap_run_handler ()
#6 0x0000000100001eaf in ap_invoke_handler ()
#7 0x000000010005b7de in ap_process_async_request ()
#8 0x000000010005b8b0 in ap_process_request ()
#9 0x00000001000573fb in ap_process_http_sync_connection ()
#10 0x00000001000574f6 in ap_process_http_connection ()
#11 0x0000000100019906 in ap_run_process_connection ()
#12 0x0000000100019dd7 in ap_process_connection ()
#13 0x00000001000e24d8 in child_main ()
#14 0x00000001000e25e4 in make_child ()
#15 0x00000001000e2c5d in prefork_run ()
#16 0x000000010001c47d in ap_run_mpm ()
#17 0x000000010000d924 in main ()
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org