apr-bugs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 49094] New: apr_pollset_create_ex does not return error codes from pollset providers
Date Mon, 12 Apr 2010 11:02:35 GMT

           Summary: apr_pollset_create_ex does not return error codes from
                    pollset providers
           Product: APR
           Version: HEAD
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: APR
        AssignedTo: bugs@apr.apache.org
        ReportedBy: sami.tolvanen@mywot.com

Created an attachment (id=25263)
 --> (https://issues.apache.org/bugzilla/attachment.cgi?id=25263)
Test case for reproducing the problem

The apr_pollset_create_ex function in APR 1.4.2 (and HEAD) always returns
APR_SUCCESS even if the pollset provider's create function returns an error. In
case of the Linux epoll provider, if epoll_create fails, this also causes a
crash in an unsuspecting application when the pollset is destroyed, as
demonstrated by the attached test case (assumes a Linux system without
epoll_create1, e.g. CentOS 5):

[sami@builder ~]$ gcc -Wall -o test test.c -I /usr/local/apr/include/apr-1 -L
/usr/local/apr/lib -lapr-1
[sami@builder ~]$ ./test
Segmentation fault

The application causes epoll_create failure by passing 0 as the pollset size
and demonstrates how a) apr_pollset_create_ex returns APR_SUCCESS despite the
failure that occurred and that b) apr_pollset_destroy causes a segmentation
fault when impl_pollset_cleanup in epoll.c references a NULL pointer.

Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

To unsubscribe, e-mail: bugs-unsubscribe@apr.apache.org
For additional commands, e-mail: bugs-help@apr.apache.org

View raw message