Re: [Polipo-users] Segfault in polipo-20140107

[Richard Z]

On Fri, Mar 14, 2014 at 10:48:15PM +0100, Aleksandar Kuktin wrote:
> >On Fri, 14 Mar 2014 21:22:35 +0100
> >Richard Z <r...@linux-m68k.org> wrote:
> 
> > I have meanwhile got a few more of those crashes, mine happen always
> > in offline mode. It was trigered by logrotate because polipo was
> > accidentally put into offline mode for logrotation
> 
> I have been looking at the code in client.c, I think I see the problem.
> 
> Let's start with httpClientNoticeRequest(). It gets passed the request
> (whatever that is), it parses it and gets (1) the handle for the object
> contained within and (2) some sort of a reference to a "connection". It
> then fills the object from disk (using objectFillFromDisk()) and calls
> httpServeObject() with the above connection. httpServeObject() then
> proceeds to extract the request from the connection, extracts the
> object from the request, fills it up from disk for the second time and
> then proceeds to deallocate it, allocate a new object that it
> "attaches" to the request and proceeds to call
> httpClientNoticeRequest() with that request.
> 
> So, a bit of memory gets allocated, filled with data twice and then
> deallocated all the while the stack keeps on growing.
> 
> This hypothesis is testable. If it won't inconvenience you too much
> (and you still have at least one coredump around), can you please
> test the following values:
> 
> A. from the httpClientNoticeRequest() stack:
>   1. request
>   2. request->connection
> B. from the httpServeObject() stack:
>   1. connection
>   2. connection->request
> 
> If ((A1 == B2) && (B1 == A2)), then we have successfully isolated the
> infinite loop for at least one of the two crashes.

#6  0x08058bb4 in httpClientNoticeRequest (request=0x997ac90, novalidate=1)
    at client.c:1207
1207                return httpServeObject(connection);
(gdb) p request
$4 = (HTTPRequestPtr) 0x997ac90
(gdb) p request->connection
$5 = (struct _HTTPConnection *) 0x99758c8
(gdb) up
#7  0x080583c3 in httpServeObject (connection=0x99758c8) at client.c:1662
1662            return httpClientNoticeRequest(request, 1);
(gdb) p connection
$6 = (HTTPConnectionPtr) 0x99758c8
(gdb) p connection->request
$7 = (HTTPRequestPtr) 0x997ac90

ok, so that is the case.


> If that truly *is* the loop, then it is obvious the problem is in the
> defective data structure. We would then need to study the data
> structures and see where, why and how do they get deformed.

any idea what to look at?

# p *connection
$8 = {flags = 3, fd = 40, buf = 0x0, len = -1, offset = 0, 
  request = 0x997ac90, request_last = 0x997ac90, serviced = 3, version = 1, 
  time = 1395247264, timeout = 0x0, te = 0, reqbuf = 0x0, reqlen = 0, 
  reqbegin = 0, reqoffset = 0, bodylen = 0, reqte = -1, chunk_remaining = 0, 
  server = 0x0, pipelined = 0, connecting = 0}

#  p *(connection->request)
$9 = {flags = 1, connection = 0x99758c8, object = 0x996f0f8, method = 0, 
  from = 0, to = -1, cache_control = {flags = 0, max_age = -1, s_maxage = -1, 
    min_fresh = -1, max_stale = -1}, condition = 0x0, via = 0x0, 
  chandler = 0x0, can_mutate = 0x0, error_code = 0, error_message = 0x0, 
  error_headers = 0x0, headers = 0x997fc10, time0 = {tv_sec = 0, tv_usec = 0}, 
  time1 = {tv_sec = 0, tv_usec = 0}, request = 0x0, next = 0x0}

# p *object
$12 = {refcount = 1, type = 1 '\001', request = 0x805d131 <httpServerRequest>, 
  request_closure = 0x0, 
  key = 0x997dbe0 
"http://i2.wp.com/a0.twimg.com/profile_images/3111195344/1ba591523c2501cd19bb74f9db600f72_normal.png?resize=40%2C40";,
 key_size = 114, 
  flags = 17, code = 400, abort_data = 0x0, message = 0x996e978, length = 56, 
  date = 1395173463, age = 1395173463, expires = -1, last_modified = -1, 
  atime = 1395247268, etag = 0x0, cache_control = 4097, max_age = -1, 
  s_maxage = -1, headers = 0x996eb58, via = 0x0, size = 56, numchunks = 1, 
  chunks = 0x997d130, requestor = 0x0, condition = {handlers = 0x0}, 
  disk_entry = 0x9981e60, next = 0x99736c8, previous = 0x0}


Richard

---
Name and OpenPGP keys available from pgp key servers

pgpqP80GrCJVT.pgp
Description: PGP signature

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
Polipo-users mailing list
Polipo-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/polipo-users