nginx 0.8.45-0.8.49 segfault bug

[Maxim Dounin]

Hello!

On Wed, Sep 01, 2010 at 12:19:55PM -0400, zhijianpeng wrote:

> Sorry,I forgot about that my friend patch 0.8.47 for me.
> 
> Let's forget about it,  and [b]0.8.49 is clean[/b]

[...]

>         [b]proxy_ignore_client_abort       on;[/b]

[...]

> 2010/09/02 00:14:53 [debug] 15807#0: *3 connect to 81.19.68.137:80, fd:9
> #4
> 2010/09/02 00:14:53 [debug] 15807#0: *3 http upstream connect: -2
> 2010/09/02 00:14:53 [debug] 15807#0: *3 event timer add: 9:
> 60000:1283357753347
> 2010/09/02 00:14:53 [debug] 15807#0: timer delta: 991
> 2010/09/02 00:14:53 [debug] 15807#0: posted events 0000000000000000
> 2010/09/02 00:14:53 [debug] 15807#0: worker cycle
> 2010/09/02 00:14:53 [debug] 15807#0: epoll timer: 60000
> 2010/09/02 00:14:53 [debug] 15807#0: epoll: fd:3 ev:0005
> d:00002B77E3EDC160
> 2010/09/02 00:14:53 [debug] 15807#0: *3 http run request: "/aa/bb?"
> 2010/09/02 00:14:53 [debug] 15807#0: *3 http read client request body
> 2010/09/02 00:14:53 [debug] 15807#0: *3 add cleanup: 0000000010258CE0
> 2010/09/02 00:14:53 [debug] 15807#0: *3 hashed path:
> /opt/itc/vmsnginx/client_body_temp/0000000002
> 2010/09/02 00:14:53 [debug] 15807#0: *3 temp fd:10
> 2010/09/02 00:14:53 [warn] 15807#0: *3 a client request body is buffered
> to a temporary file /opt/itc/vmsnginx/client_body_temp/0000000002 while
> connecting to upstream, client: 127.0.0.1, server: localhost, request:
> "POST /aa/bb HTTP/1.1", upstream: "http://81.19.68.137:80/aa/bb", host:
> "www.nginx.net"
> 2010/09/02 00:14:53 [debug] 15807#0: *3 write: 10, 000000001025E6B0, 5,
> 0
> 2010/09/02 00:14:53 [debug] 15807#0: *3 recv: fd:3 0 of 0
> 2010/09/02 00:14:53 [debug] 15807#0: *3 http client request body recv 0
> 2010/09/02 00:14:53 [info] 15807#0: *3 client closed prematurely
> connection while connecting to upstream, client: 127.0.0.1, server:
> localhost, request: "POST /aa/bb HTTP/1.1", upstream:
> "http://81.19.68.137:80/aa/bb", host: "www.nginx.net"
> 2010/09/02 00:14:53 [debug] 15807#0: *3 http finalize request: 400,
> "/aa/bb?" a:1, c:1

[...]

This seems to be (somewhat known) issue with 
"proxy_ignore_client_abort on;" and requests with body.  It 
doesn't modify request handlers correctly (don't clear request 
body read handler if one was set) and this may cause unexpected 
behaviour.

I'll take a look at this more closely later.  Thanks for your 
debugging.

Maxim Dounin