Am 15.02.17 um 16:22 schrieb David Osborne:
We spotted that, if the following conditions are met, then a malformed
HTTP request will make a Naviserver assert fail (4.99.15).
* Naviserver is compiled with --enable-symbols
* At least 1 writerthread is running
* A malformed HTTP request is made to a fastpath file which is
bigger than writersize
I have 2 questions.
1. Is there a way of compiling Naviserver with debug symbols included,
but with NDEBUG flag set as to not abort when an assert fails?
The management of the NDEBUG flag is "inherited" via the TEA build rules
of Tcl (m4/tcl.m4). When built with "--enable-symbols", the flag is not
added, meaning that assert() calls will be evaluated. The assumption
from Tcl is that versions built with "--enable-symbols" are for
developers, who want as well asserts to be tested - but not for
production sites. One can override these settings by either editing
include/Makefile.global, or via providing the flag on the command line,
like e.g.:
make "CFLAGS_DEFAULT=-Os -DNDEBUG"
2. Is the failing assert showing us something interesting?
The request is actually not a "malformed request", but a request
interpreted as a pre-HTTP/1.0 request (e.g. a request conforming to HTTP
0.9, where the HTTP-version was not specified in the request line, and
where no reply header was returned; note that HTTP/1.0 was introduced in
1996, more than 20 years ago). NaviServer still tries to handle such
requests, but there was a sanity check in the writer thread code, saying
that when the writer thread has to send the reply header, it must not be
zero, which does not hold for HTTP 0.9.
The fix for this case is in bitbucket [1].
All the best, and many thanks for the detailed report.
-g
[1]
https://bitbucket.org/naviserver/naviserver/commits/258264d620c1bb0164b5d6521d62b6cda064940a?at=default
[13/Feb/2017:18:06:40][22169.7fb8a27fc700][-driver:nssock:0-] Notice:
pre-HTTP/1.0 request <GET /index.html>
nsd: driver.c:4872: NsWriterQueue: Assertion `wrSockPtr->headerString
== ((void *)0)' failed.
Aborted
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
_______________________________________________
naviserver-devel mailing list
naviserver-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/naviserver-devel
