[JIRA] Commented: (SSPCPP-432) module segmentation fault with long URLs

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SSPCPP-432?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13985#comment-13985 ] 

Scott Cantor commented on SSPCPP-432:
-------------------------------------

This isn't definitive, but I ran a test on a Red Hat box with logging turned up, and the URL you provided with the hostname changed. It's logging that successfully, with no crash.

That could mean that the bug is something I fixed in log4shib (unlikely, but possible), or it could mean that there's a glibc difference with Debian.

The code in log4shib is very clearly doing the right thing and growing a buffer gradually, checking the result code from vsnprintf as documented in the man page. If it were crashing, I'd be pretty confident that either there's a vararg limitation involved, or glibc had a bug.

I don't know what the comparable StringUtil.cpp code in log4cpp looks like on Debian. I'll take a look when I have a chance.

> module segmentation fault with long URLs
> ----------------------------------------
>
>                 Key: SSPCPP-432
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-432
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>          Components: Logging
>    Affects Versions: 2.4.3
>         Environment: # uname -a
> Linux oregano.phys.uwm.edu 2.6.32-5-amd64 #1 SMP Thu Mar 22 17:26:33 UTC 2012 x86_64 GNU/Linux
> # dpkg --list | grep shib
> ii  libapache2-mod-shib2                     2.4.3+dfsg-2~bpo60+1         Federated web single sign-on system (Apache module)
> ii  libshibsp-dev                            2.4.3+dfsg-2~bpo60+1         Federated web single sign-on system (development)
> ii  libshibsp5                               2.4.3+dfsg-2~bpo60+1         Federated web single sign-on system (runtime)
> ii  shibboleth-sp2-schemas                   2.4.3+dfsg-2~bpo60+1         Federated web single sign-on system (schemas)
>            Reporter: skoranda at uwm.edu
>            Assignee: Scott Cantor
>         Attachments: gdb.txt, longURL
>
>
> When attempting to access a long (1154 character) URL the Apache httpd child processes segfault. The Apache log contains lines like
> [Wed Mar 28 18:32:39 2012] [notice] child pid 29527 exit signal Segmentation fault (11), possible coredump in /tmp/cores
> This happens even when the URL resource is not being protected using the module and even if no content served by the SP is protected. It is only necessary to have the module loaded, that is for the Apache configuration to contain 
> LoadModule mod_shib /usr/lib/apache2/modules/mod_shib_22.so
> Removing the LoadModule command from the configuration fixes the issue.
> The long URL being access is provided in an attachment as is the output of using gdb to examine the core file.
> The gdb command used was
> thread apply all bt full

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira