Subject: [RESENT][PATCH] segmentation fault at ssl_scache_dbm_retrieve()

From: YONETANI Tomokazu <[email-masked]>
Date: Mon, 5 Jan 2004 14:44:13 +0900

Hello.
[resending this message because the previous one doesn't seem to
have made it into the archive for some reason]

Sorry if this is a known issue; I've searched the archive and none
relavant found, and http://www.modssl.org/support/bugdb/ was not functioning.

We're using apache-1.3.x+mod_ssl on some of our linux-based web servers,
and have been experiencing occasional crash of apache child process.
After upgrading to apache-1.3.29+mod_ssl-2.8.16 and the crash still
persists, so I decided to use Jeff Trawick's mod_prctl module to
dump core and see exactly what's causing the segfault.
The tracebacks are consistent between crashes, but the local variables
seem to be garbled. After reading the source code, I found two bugs
in ssl_scache_dbm_retrieve():

- memory location pointed to by ucpData is never freed
  (this is already pointed out as Bug 25667 in Apache bug database;
   and the patch against httpd-2.0 is available there)
- ssl_dbm_close(dbm) is called before memcpy(), possibly trashing the
  memory location pointed to by dbmval.dptr(==dbm->pagbuf).

Attached patch should fix these problems. I noticed afterwards that
the version of mod_ssl imported into Apache httpd-2.0 already has
the similar code.

Regards.
-- 
YONETANI Tomokazu / Ergo-Brains Inc.