Segfaults in Apache 1.3.27 with mod_ssl

[Carsten Gaebler]

Hi there,

I have a quite busy SSL proxy server which loses child processes due to 
segmentation faults every now and then (i.e. one in about 2 to 6 
minutes). There doesn't seem to be a pattern in the requests that cause 
Apache to fail, so I'm not able to reproduce it intentionally. The core 
dumps suggest that it has something to do with mod_ssl, but since I'm 
not sure I'll post the backtrace here.

My setup is this:

Dual P4 Xeon machine
Debian Linux 3.0 with kernel 2.4.20-ac2
gcc 2.95.4
Apache 1.3.27
mod_ssl-2.8.14-1.3.27
openssl-0.9.7b
A backtrace is attached. I hope that someone can help.

Regards
Carsten.
GNU gdb 2002-04-01-cvs
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...
Core was generated by `/usr/local/apache/bin/httpd -DSSL'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libdb2.so.2...done.
Loaded symbols for /lib/libdb2.so.2
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libnss_compat.so.2...done.
Loaded symbols for /lib/libnss_compat.so.2
Reading symbols from /lib/libnsl.so.1...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from /usr/local/apache/libexec/mod_rewrite.so...done.
Loaded symbols for /usr/local/apache/libexec/mod_rewrite.so
Reading symbols from /usr/local/apache/libexec/libproxy.so...done.
Loaded symbols for /usr/local/apache/libexec/libproxy.so
Reading symbols from /usr/local/apache/libexec/mod_log_config.so...done.
Loaded symbols for /usr/local/apache/libexec/mod_log_config.so
Reading symbols from /usr/local/apache/libexec/mod_log_agent.so...done.
Loaded symbols for /usr/local/apache/libexec/mod_log_agent.so
Reading symbols from /usr/local/apache/libexec/mod_log_referer.so...done.
Loaded symbols for /usr/local/apache/libexec/mod_log_referer.so
Reading symbols from /usr/local/apache/libexec/mod_setenvif.so...done.
Loaded symbols for /usr/local/apache/libexec/mod_setenvif.so
Reading symbols from /usr/local/apache/libexec/libssl.so...done.
Loaded symbols for /usr/local/apache/libexec/libssl.so
Reading symbols from /usr/local/apache/libexec/mod_prctl.so...done.
Loaded symbols for /usr/local/apache/libexec/mod_prctl.so
Reading symbols from /lib/libnss_dns.so.2...done.
Loaded symbols for /lib/libnss_dns.so.2
Reading symbols from /lib/libresolv.so.2...done.
Loaded symbols for /lib/libresolv.so.2
#0  0x40385264 in ssl3_write_pending (s=0xbfffd73c, type=134713128, buf=0x80bf758 
"ap::buff::write", len=134861327) at s3_pkt.c:749
749                     if (i == s->s3->wbuf.left)
(gdb) where
#0  0x40385264 in ssl3_write_pending (s=0xbfffd73c, type=134713128, buf=0x80bf758 
"ap::buff::write", len=134861327) at s3_pkt.c:749
#1  0x00001297 in ?? ()
#2  0x08079f11 in ap_hook_call_func (ap=0xbfffd788, he=0x80bf738, hf=0x80c6518) at 
ap_hook.c:649
#3  0x08079614 in ap_hook_call (hook=0x809d20f "ap::buff::write") at ap_hook.c:382
#4  0x08053687 in ap_write (fb=0x80c1fe8, buf=0x816af98, nbyte=4738) at buff.c:361
#5  0x0805521f in buff_write (fb=0x80c1fe8, buf=0x816af98, nbyte=4738) at buff.c:408
#6  0x08054674 in write_with_errors (fb=0x80c1fe8, buf=0x816af98, nbyte=4738) at 
buff.c:1176
#7  0x08054754 in bcwrite (fb=0x80c1fe8, buf=0x816af98, nbyte=4738) at buff.c:1213
#8  0x08054c24 in ap_bwrite (fb=0x80c1fe8, buf=0x816af98, nbyte=4738) at buff.c:1427
#9  0x402e6dc9 in ap_proxy_send_fb (f=0x0, r=0x8165278, c=0x8167890, len=27278, 
nowrite=0, chunked=0, recv_buffer_size=8192) at proxy_util.c:652
#10 0x402e5c82 in ap_proxy_http_handler (r=0x8165278, c=0x8167890, 
    url=0x816780e 
"http://s26412026.einsundeinsshop.de/sess/utn153ef84519216ea/shopdata/0190_Sony/0110_Gro=DFbild-TV/images/KV24LS35_200x131.bmp";,
 proxyhost=0x0, proxyport=0)
    at proxy_http.c:750
#11 0x402da946 in proxy_handler (r=0x8165278) at mod_proxy.c:469
#12 0x08055d19 in ap_invoke_handler (r=0x8165278) at http_config.c:518
#13 0x0806bddf in process_request_internal (r=0x8165278) at http_request.c:1308
#14 0x0806be46 in ap_process_request (r=0x8165278) at http_request.c:1324
#15 0x08062620 in child_main (child_num_arg=173) at http_main.c:4689
#16 0x080628ca in make_child (s=0x80b6cc8, slot=173, now=1056457251) at 
http_main.c:4868
#17 0x08062c58 in perform_idle_server_maintenance () at http_main.c:5050
#18 0x0806322c in standalone_main (argc=2, argv=0xbffffda4) at http_main.c:5287
#19 0x0806389c in main (argc=2, argv=0xbffffda4) at http_main.c:5566
(gdb)