lighty labs

2021-12-05

13:34 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

gstrauss wrote in #note-14:
> Thank you for reporting the error and verifying the patches. lighttpd 1.4.63 has been... flynn

12:39 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

You are faster than I!
I already saw the memory reduction in my monitoring, it is regardless the server configurat... flynn

12:02 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

Thank you for reporting the error and verifying the patches. lighttpd 1.4.63 has been released with the fixes.
The ... gstrauss

12:03 Lighttpd Bug #3119: Segfault on closing connections

Thank you for reporting the error and verifying the patches. lighttpd 1.4.63 has been released with the fixes. Some... gstrauss

2021-12-04

14:41 Lighttpd Revision 18370ed8: - next is 1.4.64

gstrauss

14:00 Lighttpd Bug #3118 (Fixed): Segfault after updating to version 1.4.62

Applied in changeset commit:ef9608f307205a312891d1afaf90a003548e4ff0. gstrauss

13:59 Lighttpd Bug #3118 (Patch Pending): Segfault after updating to version 1.4.62

gstrauss

13:01 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

I applied both patches and seems stable now, I cannot trigger a crash now (--with-pcre).
You are right:
@lighttpd... flynn

12:26 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

Had prepared this patch before your post above, so the additional data from you suggests this is the primary issue.
... gstrauss

12:19 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

Bug: r->con->srv->config_captures might not be valid when reqpool is periodically freed, since r->con is overloaded w... gstrauss

12:07 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

This patch solves the my problem only partial:
- no more malloc messages
- crashes are not reproducables any more, ... flynn

11:37 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

... gstrauss

13:55 Lighttpd Revision 0340dc94: [doc] NEWS

gstrauss

13:06 Lighttpd Bug #3119: Segfault on closing connections

Yes, patching the 3 files fixed the issue, thanks.
dinoex

12:28 Lighttpd Bug #3119 (Duplicate): Segfault on closing connections

gstrauss

11:38 Lighttpd Bug #3119: Segfault on closing connections

Does the patch I posted in #3118 fix the issue for you? gstrauss

08:44 Lighttpd Bug #3119 (Duplicate): Segfault on closing connections

Segfault after updating to version 1.4.62
server crashed reproducable after a couple of seconds after an HTTPS url... dinoex

12:40 Lighttpd Revision ef9608f3: [core] fix reqpool mem corruption in 1.4.62 (fixes #3118)

x-ref:
"Segfault after updating to version 1.4.62"
https://redmine.lighttpd.net/issues/3118
"Segfault on closin... gstrauss

2021-12-02

19:34 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

> I use url.rewrite but I do not use %0/1/2 substitutions.
If that is the case, then the memory used for captures is... gstrauss

19:02 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

At the moment the issue is reprodicable by just calling a pad from etherpad.
A clean build with @--with-pcre@ cras... flynn

18:37 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

Trying to narrow things down, and operating on the hunch that the memory corruption is related to allocations for reg... gstrauss

17:55 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

I read the changelog and changed my build to --with-pcre2. flynn

15:11 Lighttpd Bug #3118: Segfault after updating to version 1.4.62

In lighttpd 1.4.62, memory allocation changed for regexes for pcre2 support and a similar change was made for pcre su... gstrauss

12:33 Lighttpd Bug #3118 (Fixed): Segfault after updating to version 1.4.62

After updating to version 1.4.62 I get random segfaults. T could not produce a coredump, but a gdb backtrace:
<pre... flynn

10:48 Lighttpd Revision d6debd43: [core] isolate use of sys/filio.h

isolate use of sys/filio.h to fdevent_ioctl_fionread()
(illumos (OpenIndiana) defines FIONREAD in sys/filio.h) gstrauss

07:12 Lighttpd Revision 23b07fa3: [core] import xxHash v0.8.1

import xxhash.[ch] as algo_xxhash.[ch]
https://github.com/Cyan4973/xxHash
tag: v0.8.1 35b0373c697b5f160d3db26b1cbb45... gstrauss

05:23 Lighttpd Revision f4143d95: - next is 1.4.63

gstrauss

2021-12-01

11:00 Lighttpd Bug #3117 (Fixed): Trigger crash when using lighttpd -1 with pipes

Applied in changeset commit:5ca9eca8c403cebc30f9f2f52fdee1f625fb2a8c. gstrauss

10:25 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes

Thank you for your bug report. The bug has been determined to be low-impact and not a denial of service.
.
Rep... gstrauss

10:12 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes

Okay, I get it, looking forward to the next collaboration povcfe-bug

10:08 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes

I do not believe this is a bug in a real-world use case. As such, I do not believe this qualifies for a CVE.
As I m... gstrauss

09:57 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes

good work, 'lighttpd -1' is usually used in resource-limited spaces, and will use more resources anyway. Is it possib... povcfe-bug

09:53 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes

Quick patch should work around this issue. However, I am still reviewing to see if there are better solutions.
<pre... gstrauss

09:49 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes

> Indeed, he cannot be reproduced on xinetd.I mean there's a chance he'll be in a scene like 'xinetd'.
No, no there ... gstrauss

09:46 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes

stbuehler wrote in #note-1:
> Where exactly is the DoS when crashing a process that only handles the single request ... povcfe-bug

09:42 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes

gstrauss wrote in #note-2:
> If run from xinetd, then stdin is a socket, not a pipe.
> If run from nc (netcat), std... povcfe-bug

09:32 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes

If run from xinetd, then stdin is a socket, not a pipe.
If run from nc (netcat), stdin and stdout pipes will be inde... gstrauss

09:29 Lighttpd Bug #3117: Trigger crash when using lighttpd -1 with pipes

Where exactly is the DoS when crashing a process that only handles the single request that triggered the crash? stbuehler

09:22 Lighttpd Bug #3117 (Fixed): Trigger crash when using lighttpd -1 with pipes

h2. 1. vulnerability recurrence(lighttpd-1.4.61)
h3. 1.1 lighttpd default configuration... povcfe-bug

10:53 Lighttpd Revision a8c93927: [doc] NEWS

gstrauss

10:52 Lighttpd Revision 5ca9eca8: [core] fix crash when using lighttpd -1 with pipes (fixes #3117)

(thx povcfe-bug)
In some scenarios with lighttpd -1 on pipes, the event handler
associated with the connection (con)... gstrauss

2021-11-30

10:07 Lighttpd Revision 0573ce19: [doc] refresh/update dependency lists in doc

gstrauss