Bug 57927 - Segmentation Fault at proxy_util.c:994
Summary: Segmentation Fault at proxy_util.c:994
Status: NEW
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_proxy (show other bugs)
Version: 2.4.10
Hardware: HP Linux
: P1 major (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-05-13 22:08 UTC by bhanuska
Modified: 2015-06-03 18:12 UTC (History)
2 users (show)



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description bhanuska 2015-05-13 22:08:00 UTC
This intermittently happens on Redhat 6.


The rconf has a memory address of 0x0 from 
proxy_req_conf *rconf = ap_get_module_config(r->request_config,
                                                 &proxy_module);

GDB Output
Program terminated with signal 11, Segmentation fault.
#0  0x00007f1483c7efc5 in ap_proxy_cookie_reverse_map (r=0x7f12f000a9b0, conf=0x7f13e8004528, str=0x7f142cf848ec "JSESSIONID=3AA0AFCF3E1FF34900C2AC5992452490; Path=/")
    at proxy_util.c:994
994	            ent = (struct proxy_alias *)rconf->cookie_paths->elts;
(gdb) bt full
#0  0x00007f1483c7efc5 in ap_proxy_cookie_reverse_map (r=0x7f12f000a9b0, conf=0x7f13e8004528, str=0x7f142cf848ec "JSESSIONID=3AA0AFCF3E1FF34900C2AC5992452490; Path=/")
    at proxy_util.c:994
        rconf = 0x0
        ent = <value optimized out>
        len = 51
        newpath = 0x0
        newdomain = 0x0
        pathp = 0x7f142cf8491e "/"
        domainp = <value optimized out>
        pathe = 0x7f142cf8491f ""
        domaine = 0x0
        l1 = 1
        l2 = <value optimized out>
        poffs = 50
        doffs = 0
        i = <value optimized out>
        ddiff = 0
        pdiff = 0
        ret = <value optimized out>
#1  0x00007f1483a679c4 in process_proxy_header (p=0x7f12f000a938, r=<value optimized out>, backend_ptr=0x7f142cf86b28, worker=0x1293ba0, conf=0x12939e8, 
    server_portstr=0x7f142cf86a70 "") at mod_proxy_http.c:1063
        i = <value optimized out>
        date_hdrs = {0x7f1483a6be79 "Date", 0x7f1483a6c132 "Expires", 0x7f1483a6c13a "Last-Modified", 0x0}
        transform_hdrs = {{name = 0x7f1483a6c119 "Location", func = 0x7f1483c7f0b0 <ap_proxy_location_reverse_map>}, {name = 0x7f1483a6c111 "Content-Location", 
            func = 0x7f1483c7f0b0 <ap_proxy_location_reverse_map>}, {name = 0x7f1483a6c122 "URI", func = 0x7f1483c7f0b0 <ap_proxy_location_reverse_map>}, {
            name = 0x7f1483a6c126 "Destination", func = 0x7f1483c7f0b0 <ap_proxy_location_reverse_map>}, {name = 0x7f1483a6befb "Set-Cookie", 
            func = 0x7f1483c7eb70 <ap_proxy_cookie_reverse_map>}, {name = 0x0, func = 0}}
#2  ap_proxy_read_headers (p=0x7f12f000a938, r=<value optimized out>, backend_ptr=0x7f142cf86b28, worker=0x1293ba0, conf=0x12939e8, server_portstr=0x7f142cf86a70 "")
    at mod_proxy_http.c:1171
        value = <value optimized out>
        end = <value optimized out>
        field = "\030i\000\220\022\177\000\000\000\000\000\000\000\000\000\000\300\261\373c\372\025\005", '\000' <repeats 7873 times>"\356, O*\241=", '\000' <repeats 19 times>"\243, H\370,\024\177\000\000\000\000\000\000\000\000\000\000\003\000\000\000\000\000\000\000\003\000\000\000\000\000\000\000\020I\370,\024\177\000\000\000\000\000\000\002\000\000\000\246H\370,\000\000\000\000\001\000\000\000\000\000\000\000\220H\370,\024\177\000\000\246H\370,\024\177\000\000\340\302X\241=\000\000\000\377H\370,\024\177\000\000\000\000\000\000\000\000\000\000PH\370,\024\177", '\000' <repeats 100 times>, "2400", '\000' <repeats 18 times>, "hi\370,\024\177\000\000\320 \006\344\022\177\000\000\300i\370,\024\177\000\000\300\313m\001\000\000\000\000\213\234\324\254\372\025\005"
        psc = 0x12939e8
        dconf = 0x7f13e8004528
        size = 8192
        saw_headers = -268392016
        len = 63
        sconf = <value optimized out>
#3  ap_proxy_http_process_response (p=0x7f12f000a938, r=<value optimized out>, backend_ptr=0x7f142cf86b28, worker=0x1293ba0, conf=0x12939e8, 
    server_portstr=0x7f142cf86a70 "") at mod_proxy_http.c:1432
        major = <value optimized out>
        minor = 1
        rc = <value optimized out>
        c = 0x7f14781407d8
        buffer = "Set-Cookie\000 JSESSIONID=3AA0AFCF3E1FF34900C2AC5992452490; Path=/\000\n\313m\001\000\000\000\000\213\234\324\254\372\025\005\000\001\000\000\000\000\000\000\000I&\255\204\024\177\000\000h\317m\001\000\000\000\000\320 \006\344\022\177\000\000\300i\370,\024\177\000\000\373\260B\202\024\177\000\000\061\063/May/2015:14:21:09 -0400\000,\024\177", '\000' <repeats 100 times>, "2400", '\000' <repeats 18 times>"\250, j\370,\024\177\000\000p)\000\360\022\177\000\000\000k\370,\024\177\000\000\300\313m\0---Type <return> to continue, or q <return> to quit---
01\000\000\000\000\340\063\063N\372\025\005\000\001"...
        buf = <value optimized out>
        keepchar = <value optimized out>
        e = <value optimized out>
        bb = 0x7f12f0002e70
        tmp_bb = 0x7f12f0002f18
        pass_bb = 0x7f12f0002e90
        len = 15
        backasswards = 0
        interim_response = 0
        pread_len = 0
        save_table = 0x7f12f0002f48
        backend_broke = 0
        hop_by_hop_hdrs = {0x7f1483a6be7e "Keep-Alive", 0x7f1483a6c0eb "Proxy-Authenticate", 0x7f1483a6c0fe "TE", 0x7f1483a6c101 "Trailer", 0x7f1483a6c109 "Upgrade", 0x0}
        i = <value optimized out>
        te = 0x7f12f000a9b0 "8\251"
        original_status = 200
        proxy_status = <value optimized out>
        original_status_line = 0x0
        proxy_status_line = <value optimized out>
        backend = 0x7f1414004a40
        origin = 0x7f1414006c60
        old_timeout = 0
        dconf = 0x7f13e8004528
        do_100_continue = <value optimized out>
#4  0x00007f1483a6a77b in proxy_http_handler (r=0x7f12f000a9b0, worker=0x1293ba0, conf=0x12939e8, url=0x7f13e8004896 "http://10.48.172.120:7100/gsi/mat/family/index.jsp", 
    proxyname=0x0, proxyport=2008) at mod_proxy_http.c:2006
        locurl = 0x7f13c80025d0 "/gsi/mat/family/index.jsp"
        status = <value optimized out>
        server_portstr = "\000$\000\310\023\177\000\000\206\375B", '\000' <repeats 20 times>
        scheme = <value optimized out>
        proxy_function = 0x7f1483a6bfe9 "HTTP"
        u = <value optimized out>
        backend = 0x7f1414004a40
        is_ssl = -402650904
        c = 0x7f14781407d8
        retry = <value optimized out>
        p = 0x7f12f000a938
        uri = 0x7f13c8002518
#5  0x00007f1483c72d52 in proxy_run_scheme_handler (r=0x7f12f000a9b0, worker=0x1293ba0, conf=0x12939e8, 
    url=0x7f13e8004896 "http://10.48.172.120:7100/gsi/mat/family/index.jsp", proxyhost=0x0, proxyport=0) at mod_proxy.c:2758
        pHook = <value optimized out>
        n = <value optimized out>
        rv = -1
(gdb) print *r
$1 = {pool = 0x7f12f000a938, connection = 0x7f14781407d8, server = 0x1566ae0, next = 0x0, prev = 0x0, main = 0x0, the_request = 0x7f12f000bb88 "GET /family/ HTTP/1.1", 
  assbackwards = 0, proxyreq = 2, header_only = 0, proto_num = 1001, protocol = 0x7f12f000bbd8 "HTTP/1.1", hostname = 0x7f12f000bd20 "xxxxxxx.com", 
  request_time = 1431541448162516, status_line = 0x7f12f0002f40 "200 OK", status = 200, method_number = 0, method = 0x7f12f000bba0 "GET", allowed = 0, 
  allowed_xmethods = 0x0, allowed_methods = 0x7f12f000ac68, sent_bodyct = 0, bytes_sent = 0, mtime = 0, range = 0x0, clength = 0, chunked = 0, read_body = 0, 
  read_chunked = 0, expecting_100 = 0, kept_body = 0x0, body_table = 0x0, remaining = 0, read_length = 0, headers_in = 0x7f12f000aca8, headers_out = 0x7f12f00030a0, 
  err_headers_out = 0x7f13c8002170, subprocess_env = 0x7f13c8002298, notes = 0x7f13c8001ec0, content_type = 0x0, handler = 0x7f1483c836b0 "proxy-server", 
  content_encoding = 0x0, content_languages = 0x0, vlist_validator = 0x0, user = 0x0, ap_auth_type = 0x0, unparsed_uri = 0x7f12f000bbb8 "/family/", 
  uri = 0x7f13e00019f8 "/family/index.jsp", filename = 0x7f13e8004890 "proxy:http://10.48.172.120:7100/xxxxxxx/index.jsp", canonical_filename = 0x0, 
  path_info = 0x0, args = 0x0, used_path_info = 2, eos_sent = 0, per_dir_config = 0x7f13e8004218, request_config = 0x7f12f000b930, log = 0x1566b00, log_id = 0x0, 
  htaccess = 0x0, output_filters = 0x7f13c8002488, input_filters = 0x7f12f000bd30, proto_output_filters = 0x7f12f000baa8, proto_input_filters = 0x7f12f000bd30, 
  no_cache = 0, no_local_copy = 0, invoke_mtx = 0x7f12f000be68, parsed_uri = {scheme = 0x0, hostinfo = 0x0, user = 0x0, password = 0x0, hostname = 0x0, port_str = 0x0, 
    path = 0x7f12f000bbc8 "/family/", query = 0x0, fragment = 0x0, hostent = 0x0, port = 0, is_initialized = 1, dns_looked_up = 0, dns_resolved = 0}, finfo = {pool = 0x0, 
    valid = 0, protection = 0, filetype = APR_NOFILE, user = 0, group = 0, inode = 0, device = 0, nlink = 0, size = 0, csize = 0, atime = 0, mtime = 0, ctime = 0, 
    fname = 0x0, name = 0x0, filehand = 0x0}, useragent_addr = 0x7f12f000bd68, useragent_ip = 0x7f12f000be58 "178.137.19.143"}

(gdb) print rconf
$3 = (proxy_req_conf *) 0x0

(gdb) print *rconf
Cannot access memory at address 0x0
Comment 1 Yann Ylavic 2015-05-17 14:06:15 UTC
Thanks for the report.

Would you share the minimal configuration to reproduce this?

It seems that ProxyPassReverse* is/are used with a RewriteRule [P] (not ProxyPass), is that correct?
Comment 2 John Curley 2015-05-19 18:46:15 UTC
(In reply to Yann Ylavic from comment #1)
> Thanks for the report.
> 
> Would you share the minimal configuration to reproduce this?
> 
> It seems that ProxyPassReverse* is/are used with a RewriteRule [P] (not
> ProxyPass), is that correct?

tomcat backend, load balanced through F5 vip

        SetEnvIf Request_Protocol HTTP PROTO=http
        SetEnvIf ProxyHTTPS true PROTO=https
        RewriteCond %{HTTPS} =on   [NC]
        RewriteRule / - [E=PROTO:https]
        RewriteCond %{HTTP_HOST}  ^(.*)$
        RewriteRule / - [E=VHOST:%1]
        <Location /*.jsp>
          ExpiresActive Off
          ProxyPass  http://10.xxx.xxx.xxx:7300/app
          ProxyPassReverse http://10.xxx.xxx.xxx:7300/app
        </Location>
        ProxyPassReverse / ${PROTO}://${VHOST}/gsi/etoys/ interpolate
Comment 3 bhanuska 2015-06-03 18:12:01 UTC
(In reply to Yann Ylavic from comment #1)
> Thanks for the report.
> 
> Would you share the minimal configuration to reproduce this?
> 
> It seems that ProxyPassReverse* is/are used with a RewriteRule [P] (not
> ProxyPass), is that correct?

Is there any other information you might need to get this fixed?