[JIRA] Commented: (SSPCPP-401) IIS App Pool Crash
Scott Cantor (JIRA)
noreply at shibboleth.net
Tue Nov 1 22:05:26 GMT 2011
[ https://issues.shibboleth.net/jira/browse/SSPCPP-401?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13684#comment-13684 ]
Scott Cantor commented on SSPCPP-401:
-------------------------------------
Yes, that's very helpful. The log entry you provided does prove that the source of the exception is a piece of request data that's missing. They are in turn correct that the crash is because of the pointer cast. Their API used to be based on a DWORD parameter (the cast was imposed by their API), and it's now been changed to take a larger value to accomodate the 64-bit pointer. So that's an easy fix I will make, but I have to be somewhat careful not to break older IIS support.
That fix alone will just change it from a crash to a failure page the browser will display about the missing data, as it does for me when I test it. The other fixes still need to be made to figure out which piece of data is missing and work around it.
I'm sorry this is an emergency for you, but all I can do is work on it when my local work schedule permits. I expect that I should be able to produce a build to try by tomorrow evening.
> IIS App Pool Crash
> ------------------
>
> Key: SSPCPP-401
> URL: https://issues.shibboleth.net/jira/browse/SSPCPP-401
> Project: Shibboleth SP - C++
> Issue Type: Bug
> Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability )
> Components: Error Handling
> Affects Versions: 2.4.3
> Environment: Windows 2008R2 (SP1 + current patches), IIS 7.5 and .NET 3.5 framework
> Reporter: jlaweave at idp.protectnetwork.org
> Assignee: Scott Cantor
> Labels: Session
> Fix For: 2.5
>
> Original Estimate: 1 day, 4 hours
> Remaining Estimate: 1 day, 4 hours
>
> Our IIS web service keeps crashing with the following error:
> A process serving application pool 'app.Production' suffered a fatal communication error with the Windows Process Activation Service. The process id was '2576'. The data field contains the error number.
> A debug of the crash shows an access violation that appears to be caused by Shibboleth as referenced from a support request we opened with Microsoft (below):
> //From Microsoft PSS
> I have finished analyzing the dumps you sent Friday and the crash is being caused by the Shibboleth ISAPI filter. In the crashing call stack below you can see that isapi_shib is calling into our ServerSupportFunction. When I look at the instruction that is causing the AV in our code, I can see that the Shibboleth component is passing in a bad pointer for the ul1 parameter, see http://msdn.microsoft.com/en-us/library/aa503395.aspx.
> 0:030> kL
> Child-SP RetAddr Call Site
> 00000000`0b23b970 00000001`8000174e filter!W3_FILTER_CONTEXT::ServerSupportFunction+0x174
> 00000000`0b23bb80 00000001`8000c566 isapi_shib!TerminateFilter+0x45e
> 00000000`0b23bbc0 00000000`745e6f60 isapi_shib!GetFilterVersion+0x2896
> 00000000`0b23bc00 00000000`745b3b3c msvcr90!_CallSettingFrame+0x20
> 00000000`0b23bc30 00000000`77990c21 msvcr90!__CxxCallCatchBlock+0xfc
> 00000000`0b23bd00 00000001`80007ff2 ntdll!RcFrameConsolidation+0x3
> 00000000`0b23ea20 000007fe`f67e17e4 isapi_shib!HttpFilterProc+0x2d2
> 00000000`0b23eec0 000007fe`f67e1e01 filter!W3_FILTER_CONTEXT::NotifyFilters+0x178
> 00000000`0b23f0e0 000007fe`f8f6a185 filter!GlobalDoWork+0x351
> 00000000`0b23f310 000007fe`f8f6ab24 iiscore!W3_CONTEXT::SetupStateMachine+0x685
> 00000000`0b23f820 000007fe`fb4310d2 iiscore!W3_MAIN_CONTEXT::OnNewRequest+0x1b0
> 00000000`0b23f850 000007fe`fb43109c w3dt!UL_NATIVE_REQUEST::DoWork+0x126
> 00000000`0b23f8b0 000007fe`f8b01fba w3dt!OverlappedCompletionRoutine+0x1c
> 00000000`0b23f8e0 000007fe`f8b02024 w3tp!THREAD_POOL_DATA::ThreadPoolThread+0x7a
> 00000000`0b23f930 000007fe`f8b020a1 w3tp!THREAD_POOL_DATA::ThreadPoolThread+0x34
> 00000000`0b23f960 00000000`7783652d w3tp!THREAD_MANAGER::ThreadManagerThread+0x61
> 00000000`0b23f990 00000000`7796c521 kernel32!BaseThreadInitThunk+0xd
> 00000000`0b23f9c0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
> As you can see from below the AV is caused by an attempted read from 8000e6f0.
> 0:030> .exr -1
> ExceptionAddress: 000007fef67ebc14 (filter!W3_FILTER_CONTEXT::ServerSupportFunction+0x0000000000000174)
> ExceptionCode: c0000005 (Access violation)
> ExceptionFlags: 00000000
> NumberParameters: 2
> Parameter[0]: 0000000000000000
> Parameter[1]: 000000008000e6f0
> Attempt to read from address 000000008000e6f0
> The memory at the referenced address is free and is Page_Protect
> 0:030> !address 000000008000e6f0
> Usage: Free
> Base Address: 00000000`7fff0000
> End Address: 00000000`ffb00000
> Region Size: 00000000`7fb10000
> Type: 00000000
> State: 00010000 MEM_FREE
> Protect: 00000001 PAGE_NOACCESS
> 0:030> lmvm isapi_shib
> start end module name
> 00000001`80000000 00000001`80020000 isapi_shib (export symbols) isapi_shib.dll
> Loaded symbol image file: isapi_shib.dll
> Image path: D:\opt\shibboleth-sp\lib\shibboleth\isapi_shib.dll
> Image name: isapi_shib.dll
> Timestamp: Sun Jul 03 17:00:27 2011 (4E10D86B)
> CheckSum: 00026390
> ImageSize: 00020000
> File version: 2.4.3.0
> Product version: 2.4.3.0
> File flags: 0 (Mask 3F)
> File OS: 40004 NT Win32
> File type: 2.0 Dll
> File date: 00000000.00000000
> Translations: 0409.04b0
> CompanyName: UCAID
> ProductName: Shibboleth 2.4.3
> InternalName: isapi_shib
> OriginalFilename: isapi_shib.dll
> ProductVersion: 2, 4, 3, 0
> FileVersion: 2, 4, 3, 0
> PrivateBuild: 2, 4, 3, 0
> SpecialBuild: 2, 4, 3, 0
> FileDescription: Shibboleth ISAPI Filter / Extension
> LegalCopyright: Copyright © 2011 UCAID
> LegalTrademarks: Copyright © 2011 UCAID
> Comments: Copyright © 2011 UCAID
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the commits
mailing list