Patch: Apache 2 SEGV with mod_fastcgi loaded

Hello everybody,

I had some problems using the WebShpere plugin for Apache 2 together with
mod_fastcgi (Version 2.4.2 and SNAP-0404142202).

Whenever a ressource that would normally be handled by the WebSphere plugin was
addressed (e.g. a JSP matched by the WebSphere plugin configuration), while
mod_fastcgi was loaded into the webserver as a module, this caused the child
process that handled the request to crash with a segmentation fault.

The error could be tracked down to the fixups callback in mod_fastcgi. The real
error (and the SEGV) occurs in the function fcgi_util_fs_get_by_id in
fcgi_util.c.

The problem is that the pointer r->filename (in mod_fastcgi.c:fixups) happens to
be a null-pointer, which then gets dereferenced in
fcgi_util.c:fcgi_util_fs_get_by_id without checking.

I wrote a little patch (see below) to do just this additional null-pointer check
in mod_fastcgi.c:fixups. This surely doesn't affect the behaviour of
mod_fastcgi and can easily be integrated into any recent sourcecode.

Fabian

-----------------------------

diff -uNr mod_fastcgi-2.4.2/mod_fastcgi.c
mod_fastcgi-2.4.2_nullpointer/mod_fastcgi.c
--- mod_fastcgi-2.4.2/mod_fastcgi.c	2003-10-30 02:08:34.000000000 +0100
+++ mod_fastcgi-2.4.2_nullpointer/mod_fastcgi.c	2005-04-07 14:01:18.840508000
+0200
@@ -2850,10 +2850,15 @@

     get_request_identity(r, &uid, &gid);

-    if (fcgi_util_fs_get_by_id(r->filename, uid, gid))
+    /* Only try this if r->filename is not NULL,
+     * otherwise Apache 2 crashes with SIGSEGV... */
+    if (r->filename)
     {
-        r->handler = FASTCGI_HANDLER_NAME;
-        return OK;
+        if (fcgi_util_fs_get_by_id(r->filename, uid, gid))
+        {
+            r->handler = FASTCGI_HANDLER_NAME;
+            return OK;
+        }
     }

     return DECLINED;
___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/