Segmentation fault (core dumped)

[Maxim Dounin]

Hello!

On Fri, Jun 08, 2012 at 02:46:34AM -0400, den_saw wrote:

> (gdb) fr 0
> #0  0x0000000000408137 in ngx_hash_wildcard_init (hinit=0x7fffffc06010,
> names=0x807c4e2c0, nelts=1) at src/core/ngx_hash.c:493
> 493     in src/core/ngx_hash.c
> (gdb) p *hinit
> $1 = {hash = 0x0, key = 0x408680 <ngx_hash_key_lc>, max_size = 4096,
> bucket_size = 2048, name = 0x4aec84 "server_names_hash",
>   pool = 0x801435000, temp_pool = 0x80784c000}
> (gdb) p *names
> $2 = {key = {len = 18446744073707016271, data = 0x807c4e078
> "\210\236u\002\b"}, key_hash = 0, value = 0x802759e88}
> (gdb)

Workaround - убрать таки из конфига конфликты имён, на которые 
nginx ругается.  Патч, исправляющий падения:

# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1339166923 -14400
# Node ID 0e77e5ebb320075618c48d3aeac8b9aa129001f8
# Parent  4609a1a31cade1accc4c5b777733b1d1404de306
Fixed handling of conflicting wildcard server names.

With previous code wildcard names were added to hash even if conflict
was detected.  This resulted in identical names in hash and segfault
later in ngx_hash_wildcard_init().

diff --git a/src/core/ngx_hash.c b/src/core/ngx_hash.c
--- a/src/core/ngx_hash.c
+++ b/src/core/ngx_hash.c
@@ -924,17 +924,6 @@ wildcard:
     }
 
 
-    hk = ngx_array_push(hwc);
-    if (hk == NULL) {
-        return NGX_ERROR;
-    }
-
-    hk->key.len = last - 1;
-    hk->key.data = p;
-    hk->key_hash = 0;
-    hk->value = value;
-
-
     /* check conflicts in wildcard hash */
 
     name = keys->elts;
@@ -972,5 +961,18 @@ wildcard:
 
     ngx_memcpy(name->data, key->data + skip, name->len);
 
+
+    /* add to wildcard hash */
+
+    hk = ngx_array_push(hwc);
+    if (hk == NULL) {
+        return NGX_ERROR;
+    }
+
+    hk->key.len = last - 1;
+    hk->key.data = p;
+    hk->key_hash = 0;
+    hk->value = value;
+
     return NGX_OK;
 }


Maxim Dounin