Lighttpd

This is probably rather harmless as lighttpd won't start with an invalid config anyway, but I still believe programs should not crash even if given invalid input.

I agree.

I was unable to reproduce with tip of lighttpd git master using:

    server.port                    = 8080
    server.document-root           = "/dev/shm" 
    server.modules                 = ("mod_simple_vhost")

    simple-vhost.server-root       = "/var/www/vhosts/" 
    simple-vhost.default-host      = "default.example.com" 
    simple-vhost.document-root     = "/dev/shm/" 
    simple-vhost.debug             = "enable" 

2017-03-13 18:31:21: (server.c.1277) server started (lighttpd/1.4.46-devel-lighttpd-1.4.45-79-g46ff978) 
2017-03-13 18:31:21: (configfile-glue.c.113) got a string but expected a short: simple-vhost.debug enable 
2017-03-13 18:31:21: (server.c.1285) Configuration of plugins failed. Going down.

Please check if you can reproduce this if you do a clean build, including "./autogen.sh; ./configure ..." before the build.

Appears there is a missing check in mod_simple_vhost.c:mod_simple_vhost_free(), and is present in other modules.

--- a/src/mod_simple_vhost.c
+++ b/src/mod_simple_vhost.c
@@ -55,6 +55,7 @@ FREE_FUNC(mod_simple_vhost_free) {
                size_t i;
                for (i = 0; i < srv->config_context->used; i++) {
                        plugin_config *s = p->config_storage[i];
+                       if (NULL == s) continue;

                        buffer_free(s->document_root);
                        buffer_free(s->default_host);

I'm not exactly sure which combination triggers the segfault, but:

[root@c7build sbin]# ./lighttpd -f config.conf -D
Segmentation fault

[root@c7build sbin]# ./lighttpd -f gstrauss.conf -D
2017-03-14 00:40:56: (server.c.1277) server started (lighttpd/1.4.46-devel-lighttpd-1.4.45-79-g46ff978)
2017-03-14 00:40:56: (configfile-glue.c.113) got a string but expected a short: simple-vhost.debug enable
2017-03-14 00:40:56: (server.c.1285) Configuration of plugins failed. Going down.

where config.conf is the attached config file, and gstrauss.conf is the config you gave above. In any case, the segfault is gone with the patch. Thanks :)

FYI: before patch, will crash with something that adds a per-context config element:

    server.port                    = 8080
    server.document-root           = "/dev/shm" 
    server.modules                 = ("mod_simple_vhost")

    simple-vhost.server-root       = "/var/www/vhosts/" 
    simple-vhost.default-host      = "default.example.com" 
    simple-vhost.document-root     = "/dev/shm/" 
    simple-vhost.debug             = "enable" 

    $HTTP["url"] =~ "\.pdf$" {
        server.range-requests = "disable" 
    }

gstrauss wrote:

Appears there is a missing check in mod_simple_vhost.c:mod_simple_vhost_free(), and is present in other modules.

mod_status.c might also be affected?

edit: ok, you've noticed this already.