Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Content-Type: text/plain;
  charset="iso-8859-1"
From: Ryan Bloom <rbb@covalent.net>
Reply-To: rbb@covalent.net
Organization: Covalent Technologies
To: dev@httpd.apache.org, Cliff Woolley <jwoolley@virginia.edu>
Subject: Re: chunked input core dump on daedalus
Date: Thu, 1 Nov 2001 12:49:07 -0800
References: 
 <Pine.LNX.4.33.0111011543510.4217-100000@deepthought.cs.virginia.edu>
In-Reply-To: 
 <Pine.LNX.4.33.0111011543510.4217-100000@deepthought.cs.virginia.edu>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <20011101204908.E596E46DFC@koj.rkbloom.net>

On Thursday 01 November 2001 12:45 pm, Cliff Woolley wrote:
> On Thu, 1 Nov 2001, Greg Ames wrote:
> > Our magic overloaded mode field:
> >
> > (gdb) p *readbytes
> > $12 = -3
> >
> > core_input_filter thinks this means "read a block, no more than -3
> > long", and ends up trying to partition at offset -3.  I believe the
> > whole thing was looping, possibly driven by  ap_get_client_block, until
> > we run out of memory and seg fault.
>
> It'd be nice if it were checking the return value from
> apr_brigade_partition(), which returns APR_EINVAL if given a negative
> offset... besides, you never know when _partition() might get a failure
> when trying to read a bucket for some reason.
++1

Ryan
______________________________________________________________
Ryan Bloom				rbb@apache.org
Covalent Technologies			rbb@covalent.net
--------------------------------------------------------------