Segfaults with mod_rewrite

[Bill Moseley <mo...@hank.org>]

I've been looking for this segfault for a while.

This may be related to my last post about the double requests under
mod_perl because if I use a cgi-script instead of a mod_perl handler I
don't get the segfault.  But there's an issue with mod_rewrite, too.

I have a url that can go to an advanced search page:

   http://localhost/search/advanced/extra/path

Everything after /search is extra path info.

I thought it would be nice to make it easy to use:

   http://localhost/advanced/extra/path


So, I was using this rewrite rule:

   RewriteRule ^/(foo|bar|advanced)(.*) /search/$1$2

But that's causing a segfault.

My guess is that 

    /search/advanced/extra/path

ends up with a subrequest of 

    /advanced/extra/path

And the rewrite_log shows that happening.

Interesting, is that although this causes the segfaults

   RewriteRule ^/(foo|bar|advanced)(.*) /search/$1$2

this works fine:

   RewriteRule ^/(advanced)(.*) /search/$1$2

Looks like a bug in mod_rewrite, too.

Here's the httpd.conf:
<VirtualHost *:9000>
    RewriteEngine on
    RewriteLogLevel 9
    RewriteLog rewrite_log
    RewriteRule ^/(foo|bar|advanced)(.*) /search/$1$2
    

    <perl>
        package My::Hello;
        use strict;
        use Apache::Constants qw( OK );
        sub handler {
            my $r = shift;
            $r->send_http_header('text/plain');
            $r->print('hello');
            return OK;
        }
    </perl>
    
   
    <Location /search>
        Allow from all
        SetHandler perl-script
        PerlHandler My::Hello
        PerlSendHeader on
    </Location>
</VirtualHost>    

And here's the backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x4012c65c in memset (dstpp=0x0, c=0, len=3355583254) at
../sysdeps/i386/memset.c:64
64      ../sysdeps/i386/memset.c: No such file or directory.
(gdb) bt
#0  0x4012c65c in memset (dstpp=0x0, c=0, len=3355583254) at
../sysdeps/i386/memset.c:64
#1  0x809d25a in ap_pcalloc ()
#2  0x80bb39e in ap_pregsub ()
#3  0x807bfa6 in expand_backref_inbuffer ()
#4  0x807a8e8 in apply_rewrite_rule ()
#5  0x8079ea1 in apply_rewrite_list ()
#6  0x8078a37 in hook_uri2file ()
#7  0x80a2254 in run_method ()
#8  0x80a22d4 in ap_translate_name ()
#9  0x80b79d9 in ap_sub_req_method_uri ()
#10 0x80b7bb5 in ap_sub_req_lookup_uri ()
#11 0x80c0214 in ap_add_cgi_vars ()
#12 0x808b66a in perl_cgi_env_init ()
#13 0x8086042 in perl_setup_env ()
#14 0x8085722 in perl_per_request_init ()
#15 0x80858ea in perl_call_handler ()
#16 0x8085636 in perl_run_stacked_handlers ()
#17 0x808418d in perl_handler ()
#18 0x80a27b3 in ap_invoke_handler ()
#19 0x80b8af9 in process_request_internal ()
#20 0x80b8b5c in ap_process_request ()
#21 0x80af1f9 in child_main ()
#22 0x80af3b8 in make_child ()
#23 0x80af543 in startup_children ()
#24 0x80afbe4 in standalone_main ()
#25 0x80b0463 in main ()
#26 0x400e2313 in __libc_start_main (main=0x80b0080 <main>, argc=3,
argv=0xbffff8d4, init=0x8062188 <_init>, 
    fini=0x8156ef8 <_fini>, rtld_fini=0x4000ac70 <_dl_fini>,
stack_end=0xbffff8cc) at ../sysdeps/generic/libc-start.c:90
(gdb) 






Bill Moseley
mailto:moseley@hank.org