Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: <CAC=HunvJjU1gZJgfssTdSar-oW0dJm__7_pZA+8RXHSv7wF_1g@mail.gmail.com>
References: <CAC=HunsE-yVFT0ydafOqRnqGBtXb33yq96YVMtXzE2xQFH19Wg@mail.gmail.com>
 <8f86374711a34a38881ce9a1b01a6ce1@evcspmbx04.ads.northwestern.edu>
 <6e155373db834607aceb7d4e0162eaa4@DC03PXMBP003.jacksonnational.com>
 <CAC=HunspdWYEpBOQnp0ifw2cdBH+VsZc-fF1WtaNECKK0mNE-A@mail.gmail.com>
 <CALK=YjOgWN8QbH9owPy35q3K4ixqPAMC2H537BGOeQek9jR8-A@mail.gmail.com>
 <CAC=HunsdxRUmtJ5YqWA0XV7AcpQwGayBuBPWif86dJFa9PYwjA@mail.gmail.com>
 <4ecfa164a4654f83a11bd553c4a45726@evcspmbx04.ads.northwestern.edu>
 <CAC=HunvhiZ9bevsVjNe8zsSdb=yC4kPMFuE=Fyt=WyAHXoDUFQ@mail.gmail.com>
 <112bc7ffbd5b477baab5d6ef68aa03a8@evcspmbx04.ads.northwestern.edu>
 <CAC=HuntZNx-Zp=Z7b25Kf2ixk6XhEKPo2WGY-Ki-znHt4Sj2Hw@mail.gmail.com>
 <d2bc16cfec7243609c16311b796e6be8@evcspmbx04.ads.northwestern.edu> <CAC=HunvJjU1gZJgfssTdSar-oW0dJm__7_pZA+8RXHSv7wF_1g@mail.gmail.com>
From: Yann Ylavic <ylavic.dev@gmail.com>
Date: Thu, 26 Jan 2017 01:27:54 +0100
Message-ID: <CAKQ1sVPU-oUqj2dPKm4vakTjM1Ur-09cA6mTbh3jW4APaM7ctA@mail.gmail.com>
To: users@httpd.apache.org
Content-Type: text/plain; charset=UTF-8
Subject: Re: [users@httpd] Unable to fork new process
archived-at: Thu, 26 Jan 2017 00:28:01 -0000

Hi,

On Wed, Jan 25, 2017 at 10:33 PM, Michele Mase' <michele.mase@gmail.com> wrote:
> <?php

I checked restarts with valgrind on latest 2.2.x and found this fixes:

Index: modules/ssl/mod_ssl.c
===================================================================
--- modules/ssl/mod_ssl.c    (revision 1778094)
+++ modules/ssl/mod_ssl.c    (working copy)
@@ -277,7 +277,12 @@ static apr_status_t ssl_cleanup_pre_config(void *d
     /* Don't call ERR_free_strings here; ERR_load_*_strings only
      * actually load the error strings once per process due to static
      * variable abuse in OpenSSL. */
+#if (OPENSSL_VERSION_NUMBER >= 0x00090805f)
+    ERR_free_strings();
+#endif

+    sk_SSL_COMP_free(SSL_COMP_get_compression_methods());
+
     /* Also don't call CRYPTO_cleanup_all_ex_data here; any registered
      * ex_data indices may have been cached in static variables in
      * OpenSSL; removing them may cause havoc.  Notably, with OpenSSL
Index: modules/ssl/ssl_util_ssl.c
===================================================================
--- modules/ssl/ssl_util_ssl.c    (revision 1778094)
+++ modules/ssl/ssl_util_ssl.c    (working copy)
@@ -311,6 +311,7 @@ BOOL SSL_X509_isSGC(X509 *cert)
                     break;
                 }
             }
+            EXTENDED_KEY_USAGE_free(sk);
         }
     }
     return is_sgc;
__

> Tomorrow, probably i'll open a ticket with redhat.

The first one (ERR_free_strings) is fixed in 2.4.x and seems to be
backported in redhat's 2.2.* already (at least in
"httpd-2.2.15-56.el6_8.3.src.rpm").

The second one (sk_SSL_COMP_free) is nowhere, neither in httpd nor
redhat (AFAICT) releases.

The last and biggest one (EXTENDED_KEY_USAGE_free) is 2.2 code only
(2.4 not concerned), and seems to affect both httpd-2.x and redhat's.

I won't be able to verify how it affects the different openssl
versions (hence commit anything) in the next few days, just wanted to
notify before being away...

Regards,
Yann.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org