I've recompiled the library with -O0 -g Here is the new backtrace (the *e is at the very end of the file)
GNU gdb (GDB) 7.1-ubuntu Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/apache2...done. (gdb) handle SIG33 pass nostop noprint Signal Stop Print Pass to program Description SIG33 No No Yes Real-time event 33 (gdb) set pagination 0 (gdb) run Starting program: /usr/sbin/apache2 -k start -X [Thread debugging using libthread_db enabled] [New Thread 0x7fffe8d5d710 (LWP 12425)] [Thread 0x7fffe8d5d710 (LWP 12425) exited] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff214ea60 in sha1_md () from /lib/libcrypto.so.0.9.8 (gdb) backtrace full #0 0x00007ffff214ea60 in sha1_md () from /lib/libcrypto.so.0.9.8 No symbol table info available. #1 0x00007ffff1e7c7cf in engine_unlocked_init (e=0x7ffff86411b0) at eng_init.c:67 to_return = 1 #2 0x00007ffff1e7dc34 in engine_table_select (table=0x7ffff216c860, nid=427) at eng_table.c:274 ret = 0x7ffff86411b0 tmplate = {nid = 427, sk = 0xa8, funct = 0x7ffff83af2f8, uptodate = -248008672} fnd = 0x7ffff8641990 initres = 0 loop = 1 #3 0x00007ffff1e7f095 in ENGINE_get_cipher_engine (nid=427) at tb_cipher.c:115 No locals. #4 0x00007ffff1e96ad6 in do_evp_enc_engine (ctx=0x7ffff86f6f20, pcipher=0x7fffffffda30, impl=0x0) at enc_min.c:161 No locals. #5 0x00007ffff1e96c24 in EVP_CipherInit_ex (ctx=0x7ffff86f6f20, cipher=0x7ffff214a0e0, impl=0x0, key=0x7ffff86f6eb8 "O\216\006H\313iF\235\212\203\027\224\213$\t|\252\332\353\204\361\300\257\206\016\017\254\300\313\325\303\066\225UCu\307=\206r\273i\216OKw\250\036\023\004\f9\206\242B#'\032\305\065ֲ\216u\263\064i\003E?\261\032\037\244 \243\324AR%O\274\024\002\345\031v]ܐ\334o\375\022@)\261", iv=0x7ffff86f6ef8 "\263\064i\003E?\261\032\037\244 \243\324AR%O\274\024\002\345\031v]ܐ\334o\375\022@)\261", enc=0) at enc_min.c:229 No locals. #6 0x00007ffff382f686 in tls1_change_cipher_state (s=0x7ffff86d6c20, which=33) at t1_enc.c:434 empty = "" p = 0x7ffff86f6e90 "\254}\217\033\213\361H\225\005\071\261f?4\030\302\v;\361\262\373\251K\226\342\212\375ί\226ۥ\224N\326!T2\321eO\216\006H\313iF\235\212\203\027\224\213$\t|\252\332\353\204\361\300\257\206\016\017\254\300\313\325\303\066\225UCu\307=\206r\273i\216OKw\250\036\023\004\f9\206\242B#'\032\305\065ֲ\216u\263\064i\003E?\261\032\037\244 \243\324AR%O\274\024\002\345\031v]ܐ\334o\375\022@)\261" key_block = 0x7ffff86f6e90 "\254}\217\033\213\361H\225\005\071\261f?4\030\302\v;\361\262\373\251K\226\342\212\375ί\226ۥ\224N\326!T2\321eO\216\006H\313iF\235\212\203\027\224\213$\t|\252\332\353\204\361\300\257\206\016\017\254\300\313\325\303\066\225UCu\307=\206r\273i\216OKw\250\036\023\004\f9\206\242B#'\032\305\065ֲ\216u\263\064i\003E?\261\032\037\244 \243\324AR%O\274\024\002\345\031v]ܐ\334o\375\022@)\261" mac_secret = 0x7ffff86d6f04 "\254}\217\033\213\361H\225\005\071\261f?4\030\302\v;", <incomplete sequence \361\262> exp_label = 0x7ffff384c74b "client write key" buf = "\000\000\000\000\210\000\000\000plo\370\377\177\000\000\220no\370\377\177\000\000 lm\370\377\177\000\000\370\362:\370\377\177\000\...@~l\367\377\177\000\000\300\333\377\377\377\177\000\000\330\062m\370\377\177\000\000\370\362:\370\377\177\000\000 \260\067\361\377\177\000\000\b\325m", <incomplete sequence \370> tmp1 = "\000\000\000\000\000\000\000\000`\352\024\362\377\177\000\000\340\240\024\362\377\177\000\000plo\370\377\177\000" tmp2 = " \334\377\377\377\177\000\000\264\370\202\363\377\177\000\000\350\372\r!\000\000\000\000 lm\370\377\177\000" iv1 = "\220no\370\377\177\000\000\262U\341\361\377\177\000\000\377\377\377\377\377\377\377\377plo\370\377\177\000" iv2 = "_/_7s\323\355\067uW\341\361\377\177\000\000\210\000\000\000\000\000\000\000plo\370\377\177\000" ms = 0x7ffff86f6e90 "\254}\217\033\213\361H\225\005\071\261f?4\030\302\v;\361\262\373\251K\226\342\212\375ί\226ۥ\224N\326!T2\321eO\216\006H\313iF\235\212\203\027\224\213$\t|\252\332\353\204\361\300\257\206\016\017\254\300\313\325\303\066\225UCu\307=\206r\273i\216OKw\250\036\023\004\f9\206\242B#'\032\305\065ֲ\216u\263\064i\003E?\261\032\037\244 \243\324AR%O\274\024\002\345\031v]ܐ\334o\375\022@)\261" key = 0x7ffff86f6eb8 "O\216\006H\313iF\235\212\203\027\224\213$\t|\252\332\353\204\361\300\257\206\016\017\254\300\313\325\303\066\225UCu\307=\206r\273i\216OKw\250\036\023\004\f9\206\242B#'\032\305\065ֲ\216u\263\064i\003E?\261\032\037\244 \243\324AR%O\274\024\002\345\031v]ܐ\334o\375\022@)\261" iv = 0x7ffff86f6ef8 "\263\064i\003E?\261\032\037\244 \243\324AR%O\274\024\002\345\031v]ܐ\334o\375\022@)\261" er1 = 0x7ffff86d6fac "l...@\030_/_7s\323\355\067\306\327eo\330\305\346v![\\UQ\264\177\216\061\377\033\r", <incomplete sequence \336> er2 = 0x7ffff86d6f8c "l...@\030_\265\\\206v\227\223z\234\265\070i1\256\330\353\271\027\216&\271\n\021\214\271\377\177\35...@\030_/_7s\323\355\067\306\327eo\330\305\346v![\\UQ\264\177\216\061\377\033\r", <incomplete sequence \336> client_write = 1 dd = 0x7ffff86f6f20 c = 0x7ffff214a0e0 comp = 0x0 m = 0x7ffff214ea60 is_export = 0 n = 136 i = 20 j = 32 k = 16 exp_label_len = 16 cl = 32 reuse_dd = 0 #7 0x00007ffff3828cbe in ssl3_do_change_cipher_spec (s=0x7ffff86d6c20) at s3_pkt.c:1246 i = 33 sender = 0x4df1efefe0 <Address 0x4df1efefe0 out of bounds> slen = -1802653440 #8 0x00007ffff382889b in ssl3_read_bytes (s=0x7ffff86d6c20, type=22, buf=0x7ffff86df440 "\020", len=4, peek=0) at s3_pkt.c:1110 al = 406867166 i = 219938609 j = 32767 ret = 1 n = 2842807147 rr = 0x7ffff86d7008 cb = 0 #9 0x00007ffff3829ad9 in ssl3_get_message (s=0x7ffff86d6c20, st1=8608, stn=8609, mt=-1, max=514, ok=0x7fffffffde28) at s3_both.c:394 skip_message = 32767 p = 0x7ffff86df440 "\020" l = 4167921856 n = 140737251474023 i = 32767 al = -209455920 #10 0x00007ffff381c12b in ssl3_get_cert_verify (s=0x7ffff86d6c20) at s3_srvr.c:2311 pkey = 0x0 p = 0x7ffff86d6c20 "\001\003" al = 32767 ok = -127061288 ret = 0 n = 140737361309888 type = 0 i = 32767 j = -127045440 peer = 0x7ffff86d7118 #11 0x00007ffff381895b in ssl3_accept (s=0x7ffff86d6c20) at s3_srvr.c:506 buf = 0x7ffff86f3bc0 l = 109052176 Time = 1279268959 cb = 0x7ffff1162c30 <ssl_callback_Info> num1 = 1 ret = 1 new_state = 8608 state = 8608 skip = 0 #12 0x00007ffff383bf64 in SSL_accept (s=0x7ffff86d6c20) at ssl_lib.c:869 No locals. #13 0x00007ffff382b199 in ssl23_get_client_hello (s=0x7ffff86d6c20) at s23_srvr.c:577 buf_space = "\026\003\001\000\235\001\000\000\231\003\001" buf = 0x7fffffffdf50 "\026\003\001" p = 0x7ffff86e4a80 "\024\003\001" d = 0x7ffff1162c62 "H\205\300H\211\303tAH\213-߂!" d_len = 0x7fffffffdfd0 "\360\337\377\377\377\177" dd = 0x7ffff86d6c20 "\001\003" i = 0 csl = 0 sil = 32767 cl = 4294958976 n = 11 j = -236375477 type = 3 v = {3, 1} #14 0x00007ffff382a479 in ssl23_accept (s=0x7ffff86d6c20) at s23_srvr.c:203 buf = 0x7ffff86d4960 Time = 1279268959 cb = 0x7ffff1162c30 <ssl_callback_Info> ret = -1 new_state = 8720 state = 8720 #15 0x00007ffff383bf64 in SSL_accept (s=0x7ffff86d6c20) at ssl_lib.c:869 No locals. #16 0x00007ffff1160ab8 in ssl_io_filter_connect (filter_ctx=0x7ffff86d33f8) at /build/buildd/apache2-2.2.14/modules/ssl/ssl_engine_io.c:1103 c = 0x7ffff86d2b38 sc = <value optimized out> cert = <value optimized out> n = <value optimized out> ssl_err = <value optimized out> verify_result = <value optimized out> server = 0x7ffff83af2f8 #17 0x00007ffff1161a38 in ssl_io_filter_input (f=0x7ffff86dc418, bb=0x7ffff86dea38, mode=<value optimized out>, block=APR_BLOCK_READ, readbytes=<value optimized out>) at /build/buildd/apache2-2.2.14/modules/ssl/ssl_engine_io.c:1349 status = <value optimized out> len = 8192 #18 0x00007ffff7fc9626 in ap_rgetline_core (s=0x7ffff86dd508, n=<value optimized out>, read=<value optimized out>, r=<value optimized out>, fold=<value optimized out>, bb=<value optimized out>) at /build/buildd/apache2-2.2.14/server/protocol.c:231 rv = <value optimized out> e = 0x7ffff86dea38 bytes_handled = 0 current_alloc = 0 pos = <value optimized out> last_char = <value optimized out> do_alloc = 1 saw_eos = 0 #19 0x00007ffff7fc9fa6 in read_request_line (conn=0x7ffff86d2b38) at /build/buildd/apache2-2.2.14/server/protocol.c:596 rv = <value optimized out> ll = <value optimized out> pro = <value optimized out> major = 1 minor = 0 http = "\030{ \370\377" len = 140737361292088 num_blank_lines = 0 max_blank_lines = 100 uri = <value optimized out> #20 ap_read_request (conn=0x7ffff86d2b38) at /build/buildd/apache2-2.2.14/server/protocol.c:891 r = 0x7ffff86dd4d8 p = 0x7ffff86dd458 expect = <value optimized out> access_status = <value optimized out> tmp_bb = 0x7ffff86dea38 csd = <value optimized out> cur_timeout = <value optimized out> #21 0x00007ffff7fe4490 in ap_process_http_connection (c=0x7ffff86d2b38) at /build/buildd/apache2-2.2.14/modules/http/http_core.c:183 r = 0x1 csd = 0x0 #22 0x00007ffff7fddcf8 in ap_run_process_connection (c=0x7ffff86d2b38) at /build/buildd/apache2-2.2.14/server/connection.c:43 n = 1 rv = -127659600 #23 0x00007ffff7fec037 in child_main (child_num_arg=<value optimized out>) at /build/buildd/apache2-2.2.14/server/mpm/prefork/prefork.c:662 current_conn = <value optimized out> csd = 0x7ffff86d2948 ptrans = 0x7ffff86d28c8 allocator = 0x7ffff86d07c0 status = <value optimized out> i = <value optimized out> lr = <value optimized out> pollset = 0x7ffff86d0960 sbh = 0x7ffff86d0958 bucket_alloc = 0x7ffff86d4c38 last_poll_idx = 1 #24 0x00007ffff7fec306 in make_child (s=0x7ffff8214938, slot=0) at /build/buildd/apache2-2.2.14/server/mpm/prefork/prefork.c:702 No locals. #25 0x00007ffff7fec953 in ap_mpm_run (_pconf=<value optimized out>, plog=<value optimized out>, s=<value optimized out>) at /build/buildd/apache2-2.2.14/server/mpm/prefork/prefork.c:978 index = <value optimized out> remaining_children_to_start = <value optimized out> rv = <value optimized out> #26 0x00007ffff7fc2350 in main (argc=4, argv=0x7fffffffe728) at /build/buildd/apache2-2.2.14/server/main.c:742 c = 88 'X' configtestonly = <value optimized out> confname = 0x7ffff7fee92b "/etc/apache2/apache2.conf" def_server_root = 0x7ffff7ff252b "" temp_error_log = 0x0 error = <value optimized out> process = 0x7ffff820c220 server_conf = 0x7ffff8214938 pglobal = 0x7ffff820c128 pconf = 0x7ffff820e138 plog = 0x7ffff82422d8 ptemp = 0x7ffff8216178 pcommands = 0x7ffff8210148 opt = 0x7ffff8210240 rv = <value optimized out> mod = <value optimized out> optarg = 0x0 (gdb) infop [K[K registers rax 0x7ffff86411b0 140737360695728 rbx 0x7ffff214a0e0 140737254826208 rcx 0x0 0 rdx 0x7ffff214ea60 140737254845024 rsi 0x0 0 rdi 0x7ffff86411b0 140737360695728 rbp 0x7fffffffd940 0x7fffffffd940 rsp 0x7fffffffd918 0x7fffffffd918 r8 0x7ffff83f6830 140737358293040 r9 0x3085 12421 r10 0x0 0 r11 0x7ffff71cec20 140737339255840 r12 0x7ffff86d32d8 140737361294040 r13 0x7ffff83af2f8 140737358000888 r14 0x7ffff137b020 140737240346656 r15 0x7ffff86dd508 140737361335560 rip 0x7ffff214ea60 0x7ffff214ea60 <sha1_md> eflags 0x10206 [ PF IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 (gdb) x/16i $pc => 0x7ffff214ea60 <sha1_md>: add %al,(%rax) 0x7ffff214ea63 <sha1_md+3>: add %al,0x0(%rcx) 0x7ffff214ea66 <sha1_md+6>: add %al,(%rax) 0x7ffff214ea68 <sha1_md+8>: adc $0x0,%al 0x7ffff214ea6a <sha1_md+10>: add %al,(%rax) 0x7ffff214ea6c <sha1_md+12>: add %al,(%rax) 0x7ffff214ea6e <sha1_md+14>: add %al,(%rax) 0x7ffff214ea70 <sha1_md+16>: add %al,(%rax) 0x7ffff214ea72 <sha1_md+18>: add %al,(%rax) 0x7ffff214ea74 <sha1_md+20>: add %al,(%rax) 0x7ffff214ea76 <sha1_md+22>: add %al,(%rax) 0x7ffff214ea78 <sha1_md+24>: mov $0x73,%ah 0x7ffff214ea7a <sha1_md+26>: jmpq 0x7ffff294ea70 0x7ffff214ea7f <sha1_md+31>: add %dl,%dl 0x7ffff214ea81 <sha1_md+33>: jae 0x7ffff214ea6c <sha1_md+12> 0x7ffff214ea83 <sha1_md+35>: icebp (gdb) thread apply all backtrace Thread 1 (Thread 0x7ffff7f61740 (LWP 12421)): #0 0x00007ffff214ea60 in sha1_md () from /lib/libcrypto.so.0.9.8 #1 0x00007ffff1e7c7cf in engine_unlocked_init (e=0x7ffff86411b0) at eng_init.c:67 #2 0x00007ffff1e7dc34 in engine_table_select (table=0x7ffff216c860, nid=427) at eng_table.c:274 #3 0x00007ffff1e7f095 in ENGINE_get_cipher_engine (nid=427) at tb_cipher.c:115 #4 0x00007ffff1e96ad6 in do_evp_enc_engine (ctx=0x7ffff86f6f20, pcipher=0x7fffffffda30, impl=0x0) at enc_min.c:161 #5 0x00007ffff1e96c24 in EVP_CipherInit_ex (ctx=0x7ffff86f6f20, cipher=0x7ffff214a0e0, impl=0x0, key=0x7ffff86f6eb8 "O\216\006H\313iF\235\212\203\027\224\213$\t|\252\332\353\204\361\300\257\206\016\017\254\300\313\325\303\066\225UCu\307=\206r\273i\216OKw\250\036\023\004\f9\206\242B#'\032\305\065ֲ\216u\263\064i\003E?\261\032\037\244 \243\324AR%O\274\024\002\345\031v]ܐ\334o\375\022@)\261", iv=0x7ffff86f6ef8 "\263\064i\003E?\261\032\037\244 \243\324AR%O\274\024\002\345\031v]ܐ\334o\375\022@)\261", enc=0) at enc_min.c:229 #6 0x00007ffff382f686 in tls1_change_cipher_state (s=0x7ffff86d6c20, which=33) at t1_enc.c:434 #7 0x00007ffff3828cbe in ssl3_do_change_cipher_spec (s=0x7ffff86d6c20) at s3_pkt.c:1246 #8 0x00007ffff382889b in ssl3_read_bytes (s=0x7ffff86d6c20, type=22, buf=0x7ffff86df440 "\020", len=4, peek=0) at s3_pkt.c:1110 #9 0x00007ffff3829ad9 in ssl3_get_message (s=0x7ffff86d6c20, st1=8608, stn=8609, mt=-1, max=514, ok=0x7fffffffde28) at s3_both.c:394 #10 0x00007ffff381c12b in ssl3_get_cert_verify (s=0x7ffff86d6c20) at s3_srvr.c:2311 #11 0x00007ffff381895b in ssl3_accept (s=0x7ffff86d6c20) at s3_srvr.c:506 #12 0x00007ffff383bf64 in SSL_accept (s=0x7ffff86d6c20) at ssl_lib.c:869 #13 0x00007ffff382b199 in ssl23_get_client_hello (s=0x7ffff86d6c20) at s23_srvr.c:577 #14 0x00007ffff382a479 in ssl23_accept (s=0x7ffff86d6c20) at s23_srvr.c:203 #15 0x00007ffff383bf64 in SSL_accept (s=0x7ffff86d6c20) at ssl_lib.c:869 #16 0x00007ffff1160ab8 in ssl_io_filter_connect (filter_ctx=0x7ffff86d33f8) at /build/buildd/apache2-2.2.14/modules/ssl/ssl_engine_io.c:1103 #17 0x00007ffff1161a38 in ssl_io_filter_input (f=0x7ffff86dc418, bb=0x7ffff86dea38, mode=<value optimized out>, block=APR_BLOCK_READ, readbytes=<value optimized out>) at /build/buildd/apache2-2.2.14/modules/ssl/ssl_engine_io.c:1349 #18 0x00007ffff7fc9626 in ap_rgetline_core (s=0x7ffff86dd508, n=<value optimized out>, read=<value optimized out>, r=<value optimized out>, fold=<value optimized out>, bb=<value optimized out>) at /build/buildd/apache2-2.2.14/server/protocol.c:231 #19 0x00007ffff7fc9fa6 in read_request_line (conn=0x7ffff86d2b38) at /build/buildd/apache2-2.2.14/server/protocol.c:596 #20 ap_read_request (conn=0x7ffff86d2b38) at /build/buildd/apache2-2.2.14/server/protocol.c:891 #21 0x00007ffff7fe4490 in ap_process_http_connection (c=0x7ffff86d2b38) at /build/buildd/apache2-2.2.14/modules/http/http_core.c:183 #22 0x00007ffff7fddcf8 in ap_run_process_connection (c=0x7ffff86d2b38) at /build/buildd/apache2-2.2.14/server/connection.c:43 #23 0x00007ffff7fec037 in child_main (child_num_arg=<value optimized out>) at /build/buildd/apache2-2.2.14/server/mpm/prefork/prefork.c:662 #24 0x00007ffff7fec306 in make_child (s=0x7ffff8214938, slot=0) at /build/buildd/apache2-2.2.14/server/mpm/prefork/prefork.c:702 #25 0x00007ffff7fec953 in ap_mpm_run (_pconf=<value optimized out>, plog=<value optimized out>, s=<value optimized out>) at /build/buildd/apache2-2.2.14/server/mpm/prefork/prefork.c:978 #26 0x00007ffff7fc2350 in main (argc=4, argv=0x7fffffffe728) at /build/buildd/apache2-2.2.14/server/main.c:742 (gdb) frame 1 #1 0x00007ffff1e7c7cf in engine_unlocked_init (e=0x7ffff86411b0) at eng_init.c:67 67 to_return = e->init(e); (gdb) x 0x7ffff86411b0 0x7ffff86411b0: add (%rax),%al (gdb) info frame Stack level 1, frame at 0x7fffffffd950: rip = 0x7ffff1e7c7cf in engine_unlocked_init (eng_init.c:67); saved rip 0x7ffff1e7dc34 called by frame at 0x7fffffffd9b0, caller of frame at 0x7fffffffd920 source language c. Arglist at 0x7fffffffd940, args: e=0x7ffff86411b0 Locals at 0x7fffffffd940, Previous frame's sp is 0x7fffffffd950 Saved registers: rbp at 0x7fffffffd940, rip at 0x7fffffffd948 (gdb) info locals to_return = 1 (gdb) info args e = 0x7ffff86411b0 (gdb) print e $1 = (ENGINE *) 0x7ffff86411b0 (gdb) print e*e $2 = {id = 0x2 <Address 0x2 out of bounds>, name = 0x7ffff1eff31c "des-cbc", rsa_meth = 0x7ffff214e2c0, dsa_meth = 0x31, dh_meth = 0x7fff00000090, ecdh_meth = 0x7ffff2149d20, ecdsa_meth = 0x7ffff214ea60, rand_meth = 0x7ffff1eec806, store_meth = 0x0, ciphers = 0x31, digests = 0x7fff00000091, destroy = 0x7ffff2149d80 <r4_40_cipher>, init = 0x7ffff214ea60 <sha1_md>, finish = 0x7ffff1eec806 <PKCS12_PBE_keyivgen>, ctrl = 0x7ffff1e80278 <dynamic_ctrl>, load_privkey = 0x31, load_pubkey = 0x7fff00000092, load_ssl_client_cert = 0x7ffff2149ae0 <des_ede3_cbc>, cmd_defns = 0x7ffff214ea60, flags = -236009466, struct_ref = 32767, funct_ref = 0, ex_data = {sk = 0x21, dummy = -146014162}, prev = 0x7ffff74c7ea8, next = 0x20} (gdb) q A debugging session is active. Inferior 1 [process 12421] will be killed. Quit anyway? (y or n)
