Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Message-ID: <4A717483.2020401@apache.org>
Date: Thu, 30 Jul 2009 12:22:59 +0200
From: Ruediger Pluem <rpluem@apache.org>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
 rv:1.8.1.22) Gecko/20090606 SeaMonkey/1.1.17
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: Segfault with fix for CVE-2009-1891
References: <46300.194.224.98.149.1248802525.squirrel@www.sfritsch.de>
    <4A6F6C73.2040407@apache.org>
    <46701.194.224.98.149.1248868348.squirrel@www.sfritsch.de>
    <4A705D6A.20903@apache.org>
 <44136.194.224.98.149.1248943719.squirrel@www.sfritsch.de>
In-Reply-To: <44136.194.224.98.149.1248943719.squirrel@www.sfritsch.de>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit


On 07/30/2009 10:48 AM, Stefan Fritsch wrote:
>> Right, it is not really helpful, but as you seem to be able to reproduce
>> the issue can you please create a backtrace on your own, preferably with
>> an unstripped and -g compiled php (which doesn't seem to be the case in
>> the
>> current backtrace) .
> 
> Backtrace is attached. Looking at it again, the brigade that contains the
> transient bucket does not seem to belong to the oldwrite filter. It's the
> brigade that is used by mod_php to pass the eos bucket. But since mod_php
> only creates eos buckets and uses ap_fwrite for everything else, I don't
> know where the transient bucket comes from.

I guess this is because they reuse the brigade for sending the EOS bucket
(which is fine). They should simply cleanup this brigade before sending
the EOS bucket down the chain.

Regards

R�diger