Mailing List Archive: Apache: Dev

abort inside ap_internal_fast_redirect()

Index | Next | Previous | View Threaded

minfrin at sharp

May 8, 2008, 6:29 AM

Post #1 of 2 (40 views)
Permalink

abort inside ap_internal_fast_redirect()

Hi all,

While debugging something else entirely I have tripped over an abort()
triggered from inside mod_dir when POOL_DEBUG is enabled.

It seems within ap_internal_fast_redirect(), an attempt is made to do this:

r->notes = apr_table_overlay(r->pool, rr->notes, r->notes);

The abort occurs because "apr_table_overlay: overlay's pool is not an
ancestor of p".

The subrequest rr is created inside make_sub_request() like this:

apr_pool_create(&rrp, r->pool);
apr_pool_tag(rrp, "subrequest");
rnew = apr_pcalloc(rrp, sizeof(request_rec));
rnew->pool = rrp;

I am confused - rr->pool was created as an ancestor of r->pool, so why
should it abort?

At the top of ap_internal_fast_redirect(), the comment says:

/* XXX: Is this function is so bogus and fragile that we deep-6 it? */

which leads me to believe that this function has caused somebody pain in
the past.

Does this look familiar to anybody?

The backtrace looks like this:

Thread [1] (Suspended: Signal 'SIGABRT' received. Description: Aborted.)
15 kill() 0x900481ac
14 abort() 0x9012d7b4
13 apr_table_overlay()
/Users/minfrin/src/apache/sandbox/proxy/httpd-trunk/srclib/apr/tables/apr_tables.c:844
0x007621dc
12 ap_internal_fast_redirect()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/modules/http/http_request.c:433
0x000d839c
11 fixup_dir()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/modules/mappers/mod_dir.c:198
0x00087c58
10 ap_run_fixups()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/server/request.c:73 0x0002a298

9 ap_process_request_internal()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/server/request.c:246 0x0002b544

8 ap_process_request()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/modules/http/http_request.c:256
0x000d7b9c
7 ap_process_http_connection()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/modules/http/http_core.c:190
0x0008b894
6 ap_run_process_connection()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/server/connection.c:43
0x0002f368
5 ap_process_connection()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/server/connection.c:178
0x0002f9e4
4 child_main()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/server/mpm/prefork/prefork.c:640
0x0009cd68
3 make_child()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/server/mpm/prefork/prefork.c:680
0x0009ceb8
2 ap_mpm_run()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/server/mpm/prefork/prefork.c:956
0x0009d700
1 main()
/Users/minfrin/src/apache/sandbox/proxy/httpd-2.2.8/server/main.c:730
0x00003b90

Regards,
Graham
--

Attachments:

smime.p7s (3.21 KB)

ruediger.pluem at vodafone

May 8, 2008, 9:52 AM

Post #2 of 2 (35 views)
Permalink

Re: abort inside ap_internal_fast_redirect() [In reply to]

> -----Ursprüngliche Nachricht-----
> Von: Graham Leggett
> Gesendet: Donnerstag, 8. Mai 2008 15:29
> An: dev[at]httpd.apache.org
> Betreff: abort inside ap_internal_fast_redirect()
>
> Hi all,
>
> While debugging something else entirely I have tripped over
> an abort()
> triggered from inside mod_dir when POOL_DEBUG is enabled.
>
> It seems within ap_internal_fast_redirect(), an attempt is
> made to do this:
>
> r->notes = apr_table_overlay(r->pool, rr->notes, r->notes);
>
> The abort occurs because "apr_table_overlay: overlay's pool is not an
> ancestor of p".
>
> The subrequest rr is created inside make_sub_request() like this:
>
> apr_pool_create(&rrp, r->pool);
> apr_pool_tag(rrp, "subrequest");
> rnew = apr_pcalloc(rrp, sizeof(request_rec));
> rnew->pool = rrp;
>
> I am confused - rr->pool was created as an ancestor of
> r->pool, so why
> should it abort?

IMHO the code in apr_table_overlay is wrong:

#if APR_POOL_DEBUG
/* we don't copy keys and values, so it's necessary that
* overlay->a.pool and base->a.pool have a life span at least
* as long as p
*/
if (!apr_pool_is_ancestor(overlay->a.pool, p)) {
fprintf(stderr,
"apr_table_overlay: overlay's pool is not an ancestor of p\n");
abort();
}
if (!apr_pool_is_ancestor(base->a.pool, p)) {
fprintf(stderr,
"apr_table_overlay: base's pool is not an ancestor of p\n");
abort();
}
#endif

I guess it should be

apr_pool_is_ancestor(p, overlay->a.pool)

and

apr_pool_is_ancestor(p, base->a.pool)

instead.

Regards

Rüdiger

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact lists@gossamer-threads.com