Mailing-List: contact apreq-dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Date: Sun, 5 Jan 2003 21:00:39 +0100
Subject: Re: segfault in Apache::Upload::fh with libapreq 1.1rc2
Content-Type: text/plain; charset=US-ASCII; format=flowed
Mime-Version: 1.0 (Apple Message framework v551)
Cc: apreq-dev@httpd.apache.org
To: Joe Schaefer <joe+apache@sunstarsys.com>
From: Sven Geisler <sgeisler@aeccom.com>
In-Reply-To: <m3d6nbcue3.fsf@mumonkan.sunstarsys.com>
Message-Id: <5CB89580-20E8-11D7-A07E-0003936AB624@aeccom.com>
Content-Transfer-Encoding: 7bit

Hi Joe,

Am Sonntag, 05.01.03 um 19:40 Uhr schrieb Joe Schaefer:
>>> More about my circumstances:
>>> I use a html form (multipart form data) with two file upload fields. 
>>> I
>>> got a segfault with $upload->fh if the user selects no files. I use
>>> $upload->fh to find out if there is a upload. My patch is for this
>>> case.
>
> Preventing a segfault here is prudent, so I definitely agree that
> we need to incorporate this fix into 1.1.  However, this situation
> *should not* happen, unless either
>
>   1) an error occurred during parsing (look in $apr->status?),
>   2) you're using an UPLOAD_HOOK, and the hook function isn't
>      creating the necessary tempfiles.
>
> If neither of these are true, uploads should always have non-null
> tempfiles attached, and $upload->fh should not segfault.

Yes, I use a UPLOAD_HOOK to get information during the upload - like 
the transparent_hook example in the doc. I use the same function with 
libapreq 1.0 with no problems.

Here my code:
(inquriry/handler is my internal object. The method var provides access 
to my internal data store.)

$UPLOADHOOK = sub {
     my ($upload, $buffer, $length, $hook_data) = @_;
     my $inquiry = ${$hook_data};
     if (ref($inquiry)) {
	my $info = $inquiry->var('V_UPLOADINFO') || {};
	if ($info->{'name'} ne $upload->name) {
	    $info->{'name'} = $upload->name;
	    $info->{'file'} = $upload->filename;
	    $info->{'temp'} = $upload->tempname;
	    $info->{'time'} = time;
	    my $r = $inquiry->var('V_REQUEST');
	    $info->{'size'} = $r->header_in('Content-Length');
	    #warn "upload hook ($$): '", join(q{', '}, %{$info}), "'\n";
	    $inquiry->var('V_UPLOADINFO', $info);
	    $inquiry->var('S_UPLOADINFO', $info, 'sessionpersistent');
	}
     }
};

....

     # create Apache::Request object
     my $ar = Apache::Request->instance($r,
				       DISABLE_UPLOADS => 0, # allow uploads
				       POST_MAX => 268435456, # max. 256 MByte
				       HOOK_DATA => \$HANDLER,
				       UPLOAD_HOOK => $UPLOADHOOK,
				       TEMP_DIR => $ENV{'CSHOME'}.'/spool'
				      );


>
>>> I got another segfault if the user select a file. My handler receives
>>> the file. This request handled well. I got a segfault with the next
>>> request on this process. This looks like the same segfault that I saw
>>> with libapreq 1.0 and perl 5.8.0.
>
> We need to see a stack trace of the core (I suspect a duped
> filehandle is being freed twice, but I haven't been able to get
> my box to segfault yet).  Once again, would you please post the
> particulars so apreq-dev can collectively figure this issue out?

Do we need more information from the gdb?
I still get no core dumps. I was trying all tips. I use gdb to get the 
stack trace.
My apache start with ca. 40 MByte (each process). The apache processes 
run with a normal user account.

Do you need more information about the circumstances?
I will create the stack trace of the second segfault tomorrow...

Thx for you help...
Regards
Sven.