httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Greg Ames <grega...@remulak.net>
Subject infinite recursive subrequests
Date Thu, 04 Oct 2001 21:35:31 GMT
...well, at least until my ulimit of 1024 open file descriptors kicks
in.

setup: DocumentRoot contains /index.html, mod_negotiation is built in,
Options MultiViews is coded in the config file.  Directory
<doc_root>/index/ does not exist.

URI: /index/garbage/trash (the /trash on the end is probably irrelevant)

We get into read_types_multi() in mod_negotiation's type checker.  It
has r->filename == <doc_root>/index and neg->dir_name == <doc_root> ,
opens up the doc_root directory, and starts reading entries.  The entry
for "index.html" triggers a call to ap_sub_req_lookup_dir_ent(), which
starts the nearly infinite recursion.  The subrequest URI's are
/index/garbage/index.html .  

Thankfully, my ulimit kicks in when mod_negotiation has 1011 open fd's
for the doc_root directory.  Then I get a single 

"(24)Too many open files: cannot read directory for multi: <doc_root>" 

log message, followed by 1011 

"Negotiation: discovered file(s) matching request: <doc_root>/index
(None could be negotiated)"

log messages.

It seems like this code is confused about what the base part of the
desired pathname is, and uses only the part that exists (doc_root) in
the code that opens the directory.  This is wrong.  Since neg->dir_name
isn't the same as the desired pathname up to the last slash, some code
must have already detected a problem, but didn't kill the request.  Or
shouldn't the request die in directory_walk?

Greg

Mime
View raw message