Bug #3275: mod_ssi exec not working - Lighttpd - lighty labs

Actions

Copy link

Bug #3275

closed

mod_ssi exec not working

Added by tor 4 days ago. Updated about 19 hours ago.

Status:

Fixed

Priority:

Normal

Category:

mod_ssi

Target version:

1.4.78

ASK QUESTIONS IN Forums:

Description

While porting an old web application that uses mod_ssi and exec it would not work. It seems like there is a memory corruption somewhere.

With latest git with mod_ssi enabled and a simple page:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8" />
    <title>Testpage</title>
</head>
<body>
<!--#exec cmd="date"--></br>
</body>
</html>

Results in a garbled page and a partial transfer and "sendfile(): fd: 10 file truncated" in the error log file.

Doing a git bisect indicates that the bbd0a7d6e658f9bf4da8ce920fe0c6b9f0651416 commit is the first one with the problem. (https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/bbd0a7d6e658f9bf4da8ce920fe0c6b9f0651416)

Building the previous version 825ddb9849f65367b13e3b849b780623ccdfd1d6 works.

Actions

Copy link

Updated by gstrauss 4 days ago · Edited

Status changed from New to Patch Pending
Target version changed from 1.4.xx to 1.4.78

Thanks for the report. This patch fixes the problem:

--- a/src/mod_ssi.c
+++ b/src/mod_ssi.c
@@ -1160,6 +1160,9 @@ static int process_ssi_stmt(request_st * const r, handler_ctx * const p, const c
                /* send cmd output to a temporary file */
                if (0 != chunkqueue_append_mem_to_tempfile(cq, "", 0, errh)) break;
                c = cq->last;
+               off_t flen = c->file.length;
+               if (flen != lseek(c->file.fd, flen, SEEK_SET))
+                       log_perror(errh, __FILE__, __LINE__, "lseek failed");

                int status = 0;
                struct stat stb;
@@ -1184,7 +1187,7 @@ static int process_ssi_stmt(request_st * const r, handler_ctx * const p, const c
                        if (0 == fstat(c->file.fd, &stb)) {
                        }
                }
-               chunkqueue_update_file(cq, c, stb.st_size);
+               chunkqueue_update_file(cq, c, stb.st_size - flen);
                break;
        }
        case SSI_IF: {

Yikes! I think this may have been broken since lighttpd 1.4.56 in commit 9f8a8968 which had the wrong file size if there was data in the .shtml prior to the #exec (which would be common) and then also broken by later changes to use pwrite(), which did not update file offset, and sendfile(), which errors out with the wrong file size.

The garbled and truncated output you saw is in the temporary file, as the output of the #exec overwrites the beginning of the temporary file which contains the generated SSI output. There is no memory corruption in lighttpd from this bug.

I'll add another test case to src/t/test_mod_ssi.c

From what version of lighttpd are you upgrading?

Actions

Copy link