Project

General

Profile

Activity

From 2021-11-30 to 2021-12-06

2021-12-05

13:34 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
gstrauss wrote in #note-14:
> Thank you for reporting the error and verifying the patches. lighttpd 1.4.63 has been...
flynn
12:39 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
You are faster than I!
I already saw the memory reduction in my monitoring, it is regardless the server configurat...
flynn
12:02 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
Thank you for reporting the error and verifying the patches. lighttpd 1.4.63 has been released with the fixes.
The ...
gstrauss
12:03 Lighttpd Bug #3119: Segfault on closing connections
Thank you for reporting the error and verifying the patches. lighttpd 1.4.63 has been released with the fixes. Some... gstrauss

2021-12-04

14:41 Lighttpd Revision 18370ed8: - next is 1.4.64
gstrauss
14:00 Lighttpd Bug #3118 (Fixed): Segfault after updating to version 1.4.62
Applied in changeset commit:ef9608f307205a312891d1afaf90a003548e4ff0. gstrauss
13:59 Lighttpd Bug #3118 (Patch Pending): Segfault after updating to version 1.4.62
gstrauss
13:01 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
I applied both patches and seems stable now, I cannot trigger a crash now (--with-pcre).
You are right:
@lighttpd...
flynn
12:26 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
Had prepared this patch before your post above, so the additional data from you suggests this is the primary issue.
...
gstrauss
12:19 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
Bug: r->con->srv->config_captures might not be valid when reqpool is periodically freed, since r->con is overloaded w... gstrauss
12:07 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
This patch solves the my problem only partial:
- no more malloc messages
- crashes are not reproducables any more, ...
flynn
11:37 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
... gstrauss
13:55 Lighttpd Revision 0340dc94: [doc] NEWS
gstrauss
13:06 Lighttpd Bug #3119: Segfault on closing connections
Yes, patching the 3 files fixed the issue, thanks.
dinoex
12:28 Lighttpd Bug #3119 (Duplicate): Segfault on closing connections
gstrauss
11:38 Lighttpd Bug #3119: Segfault on closing connections
Does the patch I posted in #3118 fix the issue for you? gstrauss
08:44 Lighttpd Bug #3119 (Duplicate): Segfault on closing connections
Segfault after updating to version 1.4.62
server crashed reproducable after a couple of seconds after an HTTPS url...
dinoex
12:40 Lighttpd Revision ef9608f3: [core] fix reqpool mem corruption in 1.4.62 (fixes #3118)
x-ref:
"Segfault after updating to version 1.4.62"
https://redmine.lighttpd.net/issues/3118
"Segfault on closin...
gstrauss

2021-12-02

19:34 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
> I use url.rewrite but I do not use %0/1/2 substitutions.
If that is the case, then the memory used for captures is...
gstrauss
19:02 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
At the moment the issue is reprodicable by just calling a pad from etherpad.
A clean build with @--with-pcre@ cras...
flynn
18:37 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
Trying to narrow things down, and operating on the hunch that the memory corruption is related to allocations for reg... gstrauss
17:55 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
I read the changelog and changed my build to --with-pcre2. flynn
15:11 Lighttpd Bug #3118: Segfault after updating to version 1.4.62
In lighttpd 1.4.62, memory allocation changed for regexes for pcre2 support and a similar change was made for pcre su... gstrauss
12:33 Lighttpd Bug #3118 (Fixed): Segfault after updating to version 1.4.62
After updating to version 1.4.62 I get random segfaults. T could not produce a coredump, but a gdb backtrace:
<pre...
flynn
10:48 Lighttpd Revision d6debd43: [core] isolate use of sys/filio.h
isolate use of sys/filio.h to fdevent_ioctl_fionread()
(illumos (OpenIndiana) defines FIONREAD in sys/filio.h)
gstrauss
07:12 Lighttpd Revision 23b07fa3: [core] import xxHash v0.8.1
import xxhash.[ch] as algo_xxhash.[ch]
https://github.com/Cyan4973/xxHash
tag: v0.8.1 35b0373c697b5f160d3db26b1cbb45...
gstrauss
05:23 Lighttpd Revision f4143d95: - next is 1.4.63
gstrauss

2021-12-01

11:00 Lighttpd Bug #3117 (Fixed): Trigger crash when using lighttpd -1 with pipes
Applied in changeset commit:5ca9eca8c403cebc30f9f2f52fdee1f625fb2a8c. gstrauss
10:25 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes
Thank you for your bug report. The bug has been determined to be low-impact and not a denial of service.
.
Rep...
gstrauss
10:12 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes
Okay, I get it, looking forward to the next collaboration povcfe-bug
10:08 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes
I do not believe this is a bug in a real-world use case. As such, I do not believe this qualifies for a CVE.
As I m...
gstrauss
09:57 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes
good work, 'lighttpd -1' is usually used in resource-limited spaces, and will use more resources anyway. Is it possib... povcfe-bug
09:53 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes
Quick patch should work around this issue. However, I am still reviewing to see if there are better solutions.
<pre...
gstrauss
09:49 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes
> Indeed, he cannot be reproduced on xinetd.I mean there's a chance he'll be in a scene like 'xinetd'.
No, no there ...
gstrauss
09:46 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes
stbuehler wrote in #note-1:
> Where exactly is the DoS when crashing a process that only handles the single request ...
povcfe-bug
09:42 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes
gstrauss wrote in #note-2:
> If run from xinetd, then stdin is a socket, not a pipe.
> If run from nc (netcat), std...
povcfe-bug
09:32 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes
If run from xinetd, then stdin is a socket, not a pipe.
If run from nc (netcat), stdin and stdout pipes will be inde...
gstrauss
09:29 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes
Where exactly is the DoS when crashing a process that only handles the single request that triggered the crash? stbuehler
09:22 Lighttpd Bug #3117 (Fixed): Trigger crash when using lighttpd -1 with pipes
h2. 1. vulnerability recurrence(lighttpd-1.4.61)
h3. 1.1 lighttpd default configuration...
povcfe-bug
10:53 Lighttpd Revision a8c93927: [doc] NEWS
gstrauss
10:52 Lighttpd Revision 5ca9eca8: [core] fix crash when using lighttpd -1 with pipes (fixes #3117)
(thx povcfe-bug)
In some scenarios with lighttpd -1 on pipes, the event handler
associated with the connection (con)...
gstrauss

2021-11-30

10:07 Lighttpd Revision 0573ce19: [doc] refresh/update dependency lists in doc
gstrauss
 

Also available in: Atom