Re: segfault in httpd 2.3.11-beta

[Torsten Förtsch]

On Thursday, April 14, 2011 19:55:30 Torsten Förtsch wrote:
> Httpd segfaults if its startup is aborted 
> because the DYNAMIC_MODULE_LIMIT is hit.

Here is a better cure.

To trigger the bug the attached config.nice can be used. It compiles all 
modules as shared and sets DYNAMIC_MODULE_LIMIT=10.

An attempt to start the httpd with the default config will show a message like 
"Module "mod_authz_owner.c" could not be loaded, because the dynamic module 
limit was reached. Please increase DYNAMIC_MODULE_LIMIT and recompile." and 
then segfault.

With the patch ap_add_module() first checks for all possible errors and starts 
to change global data structures only if all is well.

Torsten Förtsch

-- 
Need professional modperl support? Hire me! (http://foertsch.name)

Like fantasy? http://kabatinte.net

config.nice
Description: application/shellscript

Index: server/config.c
===================================================================
--- server/config.c	(revision 1092669)
+++ server/config.c	(working copy)
@@ -541,22 +541,17 @@
                             m->name, m->version, MODULE_MAGIC_NUMBER_MAJOR);
     }
 
-    if (m->next == NULL) {
-        m->next = ap_top_module;
-        ap_top_module = m;
-    }
-
     if (m->module_index == -1) {
-        m->module_index = total_modules++;
-        dynamic_modules++;
-
-        if (dynamic_modules > DYNAMIC_MODULE_LIMIT) {
+        if (dynamic_modules >= DYNAMIC_MODULE_LIMIT) {
             return apr_psprintf(p, "Module \"%s\" could not be loaded, "
                                 "because the dynamic module limit was "
                                 "reached. Please increase "
                                 "DYNAMIC_MODULE_LIMIT and recompile.", m->name);
         }
 
+        m->module_index = total_modules++;
+        dynamic_modules++;
+
     }
     else if (!sym_name) {
         while (sym->modp != NULL) {
@@ -568,6 +563,11 @@
         }
     }
 
+    if (m->next == NULL) {
+        m->next = ap_top_module;
+        ap_top_module = m;
+    }
+
     if (sym_name) {
         int len = strlen(sym_name);
         int slen = strlen("_module");