tomcat-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 35862] New: - Tomcat Connector:JK/AJP: JK Status Worker accesses freed memory for NSAPI plugin
Date Tue, 26 Jul 2005 07:30:16 GMT
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG·
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=35862>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND·
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=35862

           Summary: Tomcat Connector:JK/AJP: JK Status Worker accesses freed
                    memory for NSAPI plugin
           Product: Tomcat 4
           Version: 4.1.31
          Platform: Sun
        OS/Version: Solaris
            Status: NEW
          Severity: minor
          Priority: P3
         Component: Connector:JK/AJP
        AssignedTo: tomcat-dev@jakarta.apache.org
        ReportedBy: brian.kavanagh@immi.gov.au


For release 1.2.13 of jakarta-tomcat-connectors:

Problem 1: the NSAPI plugin under <root>/jk/native/netscape/jk_nsapi_plugin.c 
frees() the initial workers map structure, init_map, at the end of the jk_init
(...) function.  As the jk_status.c worker uses the list of workers stored 
within this structure, when the jk_status worker is used by the NSAPI plugin, 
it attempts to read freed memory.

Problem 2: the NSAPI plugin under <root>/jk/native/netscape/jk_nsapi_plugin.c 
does not use the uri_to_worker map within the jk_worker_env_t structure (as 
this is done inside the netscape configuration files), however, the jk_status 
worker attempts to access the (uw_map) attached to the current jk_ws_service 
without a null check, thus causing the jk_status worker to attempt to 
dereference a null pointer.

Attached is a diff output of the changes between the jk_nsapi_plugin.c supplied 
within the jakarta-tomcat-connectors-1.2.13-src package, and a modified version 
of this file which fixes this problem by adding a uri_to_worker map, and having 
a static init_map structure:

---
56,57d55
< static jk_map_t *init_map = NULL;
< static jk_uri_worker_map_t *uw_map = NULL;
89c87
<     init_map = (jk_map_t *)init_d;
---
>     jk_map_t *init_map = (jk_map_t *)init_d;
93,101c91
<         if (uri_worker_map_alloc(&uw_map, NULL, logger)) {
<             uw_map->fname = "";
<             worker_env.uri_to_worker = uw_map;
<             init_on_other_thread_is_ok = JK_TRUE;
<         }
<         else {
<             jk_log(logger, JK_LOG_EMERG,
<                    "In init_workers_on_other_threads, failed");
<         }
---
>         init_on_other_thread_is_ok = JK_TRUE;
227a218
>     jk_map_t *init_map;
271a263,264
>
>         jk_map_free(&init_map);
289,292d281
<     if (uw_map) {
<         uri_worker_map_free(&uw_map, logger);
<     }
<
297,300d285
<
<     if (init_map) {
<         jk_map_free(&init_map);
<     }
410d394
<     s->uw_map = uw_map;
--

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org


Mime
View raw message