Nginx 1.3.10 Segfault

姚伟斌 yaoweibin at gmail.com
Sat Jan 5 05:32:50 UTC 2013 

We confirm this bug. And the patch could fix this bug.

2013/1/5 ビリビリⅤ <orz at loli.my>

> here is my log_format
> log_format logger
> '$http_host||$remote_addr||$msec||$status||$request_length||$bytes_sent||"$request"||"$http_referer"||"$http_user_agent"||$upstream_cache_status||$upstream_status||$request_time||$upstream_response_time';
>
>
>
> 2013/1/4 Valentin V. Bartenev <vbart at nginx.com>
>
>> Please, try the patch from ticket 268:
>> http://trac.nginx.org/nginx/ticket/268
>>
>>
>>  wbr, Valentin V. Bartenev
>>
>> --
>> http://nginx.com/support.html
>> http://nginx.org/en/donation.html
>>
>>
>> On Friday 04 January 2013 19:29:08 ビリビリⅤ wrote:
>> > #0  0x000000348a289087 in memcpy () from /lib64/libc.so.6
>> > Missing separate debuginfos, use: debuginfo-install
>> > glibc-2.12-1.80.el6_3.6.x86_64 keyutils-libs-1.4-4.el6.x86_64
>> > krb5-libs-1.9-33.el6_3.3.x86_64 libcom_err-1.41.12-12.el6.x86_64
>> > libselinux-2.0.94-5.3.el6.x86_64 openssl-1.0.0-25.el6_3.1.x86_64
>> > zlib-1.2.3-27.el6.x86_64
>> > (gdb) bt
>> > #0  0x000000348a289087 in memcpy () from /lib64/libc.so.6
>> > #1  0x00000000004565c5 in ngx_http_log_variable (r=<value optimized
>> out>,
>> > buf=0xaf0fd08bab1b748d <Address 0xaf0fd08bab1b748d out of bounds>,
>> > op=<value optimized out>) at src/http/modules/ngx_http_log_module.c:901
>> > #2  0x0000000000456ec5 in ngx_http_log_handler (r=0x1bf0070) at
>> > src/http/modules/ngx_http_log_module.c:308
>> > #3  0x000000000044b847 in ngx_http_log_request (r=0x1bf0070, rc=<value
>> > optimized out>) at src/http/ngx_http_request.c:3109
>> > #4  ngx_http_free_request (r=0x1bf0070, rc=<value optimized out>) at
>> > src/http/ngx_http_request.c:3064
>> > #5  0x000000000044ca9b in ngx_http_close_request (r=0x1bf0070, rc=400)
>> at
>> > src/http/ngx_http_request.c:3017
>> > #6  0x000000000044ed1e in ngx_http_read_request_header (r=0x1bf0070) at
>> > src/http/ngx_http_request.c:1214
>> > #7  0x000000000044f890 in ngx_http_process_request_line
>> > (rev=0x7f39d37d4750) at src/http/ngx_http_request.c:743
>> > #8  0x0000000000438dc1 in ngx_epoll_process_events (cycle=0x15753e0,
>> > timer=<value optimized out>, flags=<value optimized out>) at
>> > src/event/modules/ngx_epoll_module.c:683
>> > #9  0x000000000042e957 in ngx_process_events_and_timers
>> (cycle=0x15753e0)
>> > at src/event/ngx_event.c:247
>> > #10 0x0000000000436249 in ngx_worker_process_cycle (cycle=0x15753e0,
>> > data=<value optimized out>) at src/os/unix/ngx_process_cycle.c:807
>> > #11 0x00000000004347d4 in ngx_spawn_process (cycle=0x15753e0,
>> proc=0x436180
>> > <ngx_worker_process_cycle>, data=0x3, name=0x4e4875 "worker process",
>> > respawn=8) at src/os/unix/ngx_process.c:198
>> > #12 0x000000000043723f in ngx_reap_children (cycle=0x15753e0) at
>> > src/os/unix/ngx_process_cycle.c:619
>> > #13 ngx_master_process_cycle (cycle=0x15753e0) at
>> > src/os/unix/ngx_process_cycle.c:180
>> > #14 0x0000000000414a0b in main (argc=<value optimized out>, argv=<value
>> > optimized out>) at src/core/nginx.c:412
>> > (gdb) bt full
>> > #0  0x000000348a289087 in memcpy () from /lib64/libc.so.6
>> > No symbol table info available.
>> > #1  0x00000000004565c5 in ngx_http_log_variable (r=<value optimized
>> out>,
>> > buf=0xaf0fd08bab1b748d <Address 0xaf0fd08bab1b748d out of bounds>,
>> > op=<value optimized out>) at src/http/modules/ngx_http_log_module.c:901
>> >         value = 0x1a82fe8
>> > #2  0x0000000000456ec5 in ngx_http_log_handler (r=0x1bf0070) at
>> > src/http/modules/ngx_http_log_module.c:308
>> >         line = <value optimized out>
>> >         p = <value optimized out>
>> >         len = <value optimized out>
>> >         i = <value optimized out>
>> >         l = <value optimized out>
>> >         log = <value optimized out>
>> >         op = 0x1576bc0
>> >         buffer = 0x157e640
>> >         lcf = 0x1ae1868
>> > #3  0x000000000044b847 in ngx_http_log_request (r=0x1bf0070, rc=<value
>> > optimized out>) at src/http/ngx_http_request.c:3109
>> >         i = <value optimized out>
>> >         n = 1
>> >         log_handler = 0x1ca4cb8
>> > #4  ngx_http_free_request (r=0x1bf0070, rc=<value optimized out>) at
>> > src/http/ngx_http_request.c:3064
>> >         log = 0x1ba82b0
>> >         linger = {l_onoff = 28185920, l_linger = 0}
>> >         cln = <value optimized out>
>> >         ctx = <value optimized out>
>> > #5  0x000000000044ca9b in ngx_http_close_request (r=0x1bf0070, rc=400)
>> at
>> > src/http/ngx_http_request.c:3017
>> >         c = 0x7f39d3978610
>> > #6  0x000000000044ed1e in ngx_http_read_request_header (r=0x1bf0070) at
>> > src/http/ngx_http_request.c:1214
>> >         n = <value optimized out>
>> >         rev = 0x7f39d37d4750
>> >         c = 0x7f39d3978610
>> > #7  0x000000000044f890 in ngx_http_process_request_line
>> > (rev=0x7f39d37d4750) at src/http/ngx_http_request.c:743
>> >         host = <value optimized out>
>> >         n = <value optimized out>
>> >         rc = -2
>> >         rv = <value optimized out>
>> >         c = 0x7f39d3978610
>> >         r = 0x1bf0070
>> > #8  0x0000000000438dc1 in ngx_epoll_process_events (cycle=0x15753e0,
>> > timer=<value optimized out>, flags=<value optimized out>) at
>> > src/event/modules/ngx_epoll_module.c:683
>> >         events = <value optimized out>
>> >         revents = <value optimized out>
>> >         instance = <value optimized out>
>> >         i = <value optimized out>
>> >         level = <value optimized out>
>> >         err = <value optimized out>
>> >         rev = 0x7f39d37d4750
>> >         wev = <value optimized out>
>> >         queue = <value optimized out>
>> >         c = 0x7f39d3978610
>> > #9  0x000000000042e957 in ngx_process_events_and_timers
>> (cycle=0x15753e0)
>> > at src/event/ngx_event.c:247
>> >         flags = <value optimized out>
>> >         timer = <value optimized out>
>> >         delta = 1357311866947
>> > #10 0x0000000000436249 in ngx_worker_process_cycle (cycle=0x15753e0,
>> > data=<value optimized out>) at src/os/unix/ngx_process_cycle.c:807
>> >         worker = <value optimized out>
>> >         i = <value optimized out>
>> >         c = <value optimized out>
>> > #11 0x00000000004347d4 in ngx_spawn_process (cycle=0x15753e0,
>> proc=0x436180
>> > <ngx_worker_process_cycle>, data=0x3, name=0x4e4875 "worker process",
>> > respawn=8) at src/os/unix/ngx_process.c:198
>> >         on = 1
>> >         pid = 0
>> >         s = <value optimized out>
>> > #12 0x000000000043723f in ngx_reap_children (cycle=0x15753e0) at
>> > src/os/unix/ngx_process_cycle.c:619
>> >         i = <value optimized out>
>> >         live = <value optimized out>
>> >         n = <value optimized out>
>> >         ch = {command = 2, pid = 22951, slot = 8, fd = -1}
>> >         ccf = <value optimized out>
>> > #13 ngx_master_process_cycle (cycle=0x15753e0) at
>> > src/os/unix/ngx_process_cycle.c:180
>> >         title = <value optimized out>
>> >         p = <value optimized out>
>> >         size = <value optimized out>
>> >         i = <value optimized out>
>> > ---Type <return> to continue, or q <return> to quit---
>> >         n = <value optimized out>
>> >         sigio = 0
>> >         set = {__val = {0 <repeats 16 times>}}
>> >         itv = {it_interval = {tv_sec = 0, tv_usec = 21766488},
>> it_value =
>> > {tv_sec = 0, tv_usec = 0}}
>> >         live = <value optimized out>
>> >         delay = 0
>> >         ls = <value optimized out>
>> >         ccf = 0x1575c78
>> > #14 0x0000000000414a0b in main (argc=<value optimized out>, argv=<value
>> > optimized out>) at src/core/nginx.c:412
>> >         i = <value optimized out>
>> >         log = <value optimized out>
>> >         cycle = 0x14c2140
>> >         init_cycle = {conf_ctx = 0x0, pool = 0x14c1360, log = 0x728f80,
>> > new_log = {log_level = 0, file = 0x0, connection = 0, handler = 0, data
>> =
>> > 0x0, action = 0x0}, files = 0x0, free_connections = 0x0,
>> >           free_connection_n = 0, reusable_connections_queue = {prev =
>> 0x0,
>> > next = 0x0}, listening = {elts = 0x0, nelts = 0, size = 0, nalloc = 0,
>> pool
>> > = 0x0}, paths = {elts = 0x0, nelts = 0, size = 0, nalloc = 0,
>> >             pool = 0x0}, open_files = {last = 0x0, part = {elts = 0x0,
>> > nelts = 0, next = 0x0}, size = 0, nalloc = 0, pool = 0x0},
>> shared_memory =
>> > {last = 0x0, part = {elts = 0x0, nelts = 0, next = 0x0}, size = 0,
>> >             nalloc = 0, pool = 0x0}, connection_n = 0, files_n = 0,
>> > connections = 0x0, read_events = 0x0, write_events = 0x0, old_cycle =
>> 0x0,
>> > conf_file = {len = 21, data = 0x4e0370 "/etc/nginx/nginx.conf"},
>> >           conf_param = {len = 0, data = 0x0}, conf_prefix = {len = 11,
>> data
>> > = 0x4e0370 "/etc/nginx/nginx.conf"}, prefix = {len = 11, data = 0x4e0364
>> > "/usr/local/"}, lock_file = {len = 0, data = 0x0}, hostname = {
>> >             len = 0, data = 0x0}}
>> >         ccf = 0x14c3058
>> > (gdb)
>>
>>
>>
>>
>> _______________________________________________
>> nginx-devel mailing list
>> nginx-devel at nginx.org
>> http://mailman.nginx.org/mailman/listinfo/nginx-devel
>>
>
>
> _______________________________________________
> nginx-devel mailing list
> nginx-devel at nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx-devel
>



-- 
Weibin Yao
Developer @ Server Platform Team of Taobao
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx-devel/attachments/20130105/3568ed7e/attachment-0001.html>

More information about the nginx-devel mailing list