Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: local policy)
References: <19757.33439.47508.803448@gargle.gargle.HOWL>
In-Reply-To: <19757.33439.47508.803448@gargle.gargle.HOWL>
Mime-Version: 1.0 (Apple Message framework v1082)
Content-Type: text/plain; charset=us-ascii
Message-Id: <2C06BD90-7ECA-4E27-A9F1-17ED4332CA72@webthing.com>
Content-Transfer-Encoding: quoted-printable
From: Nick Kew <nick@webthing.com>
Subject: Re: non thread safe functions used in apache httpd project
Date: Mon, 17 Jan 2011 18:33:16 +0000
To: dev@httpd.apache.org

On 12 Jan 2011, at 10:29, Kevin J Walters wrote:

> Hi,

I picked this up when you reported it in bugzilla.  One feature of the =
apache
way of working is that no individual developer 'owns' your question =
(unless
you pay someone for support), so it risks going unanswered.

> Whilst looking at a thread safety issue in mod_fastcgi, i noticed
> there's some suspicious looking code in apache httpd project.
>=20
> server/mpm_common.c (2.2.17) has two functions ap_uname2id and
> ap_gname2id which call getpwnam and getgrnam, two non-reentrant
> functions.

I can say unambiguously that those functions are only used at server
startup, before any threads are spawned.  So not quite a bug.

> Comparing with typical apr code that tends to have an #ifdef to
> select function() vs function_r().

APR is a more general-purpose library, so it matters there.

> Perhaps ap_uname2id and ap_gname2id are not executed concurrently by
> the current code base but if these are general purpose functions they
> should be more cautious/safe?

Good point - thanks for making it.  They are API functions and should =
therefore
either be thread-safe and reentrant or properly documented as unsafe.
So yes, it's a bug!

> Has the whole apache httpd 2.x project been scanned for use of
> non-reentrant function calls?

I couldn't refer you to any systematic scan.  However, a lot of =
third-parties
come to us with reports of potential bugs based on scans of our codebase
by a range of code-analysis tools.  Developers and vendors of such tools
come to apache in a variety of circumstances, from making a constructive
contribution to seeking a high-profile and prestigious scalp!

--=20
Nick Kew

Available for work, contract or permanent
http://www.webthing.com/~nick/cv.html