libmicrohttpd

commit bb9de15b30d7f49dc661d2b306c192b4b50e2bce
parent 02e6d679ac3c7e712f9def8b0c4322bbb0e82d92
Author: Christian Grothoff <christian@grothoff.org>
Date:   Wed, 15 Sep 2010 07:36:41 +0000

Re: [libmicrohttpd] Cleanup callback isn't called
From: 
Erik Slagter <erik@slagter.name>
  To: 
Christian Grothoff <grothoff@net.in.tum.de>
  CC: 
libmicrohttpd@gnu.org
  Date: 
Yesterday 17:31:46
   
  Spam Status: Spamassassin 0% probability of being spam.

Full report:
Probability=No, score=-2.6 required=7.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VERIFIED autolearn=ham version=3.2.5-tuminfo_1  
> >> I think I found & fixed the issue in SVN 12778.  Please try SVN HEAD and
> > > report if it fixes the problem.

> > Okay, will do so. But first I'll be on vacation for two weeks.

> Sure.

The issue indeed has been solved. It's quite a pity the distribution's
packages lag behind by ages, so again I'll have to make my own packages
now.

I've run into another problem and also I think I have found the cause.

When a connection is closed by the peer, my application tends to
segfault.

GDB says:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff6a6c710 (LWP 27005)]
0x00007ffff77a4db0 in pthread_mutex_lock () from /lib64/libpthread.so.0
Missing separate debuginfos, use: debuginfo-install glibc-2.11.2-1.x86_64 libgcc-4.4.4-10.fc12.x86_64 libid3tag-0.15.1b-9.fc12.x86_64 libstdc++-4.4.4-10.fc12.x86_64 zlib-1.2.3-23.fc12.x86_64
(gdb) where
#0  0x00007ffff77a4db0 in pthread_mutex_lock () from /lib64/libpthread.so.0
#1  0x00007ffff7bd97ce in MHD_destroy_response (response=0x7ffff7ed5010) at response.c:341
#2  0x00007ffff7bd760f in MHD_cleanup_connections (daemon=0x62eb60) at daemon.c:964
#3  0x00007ffff7bd8fbc in MHD_select_thread (cls=0x62eb60) at daemon.c:1205
#4  0x00007ffff77a2a3a in start_thread () from /lib64/libpthread.so.0
#5  0x00007ffff6d6077d in clone () from /lib64/libc.so.6
#6  0x0000000000000000 in ?? ()

It looks like pos->response is being "destroyed" twice. If I remove one of the instances, the segfault is gone.

Index: src/daemon/daemon.c
===================================================================
--- src/daemon/daemon.c (revision 12985)
+++ src/daemon/daemon.c (working copy)
@@ -952,7 +952,7 @@
                  abort();
                }
             }
-          MHD_destroy_response (pos->response);
+          // MHD_destroy_response (pos->response);
           MHD_pool_destroy (pos->pool);
 #if HTTPS_SUPPORT
           if (pos->tls_session != NULL)



Diffstat:
M
AUTHORS
 | 
1
+
M
ChangeLog
 | 
3
+++
M
src/daemon/connection.c
 | 
1
+
M
src/daemon/daemon.c
 | 
1
-

4 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/AUTHORS b/AUTHORS
@@ -26,6 +26,7 @@ John Muth <muth@parascale.com>
 Geoffrey McRae <geoff@spacevs.com>
 Piotr Grzybowski <narsil.pl@gmail.com>
 Gerrit Telkamp <g.telkamp@domologic.de>
+Erik Slagter <erik@slagter.name>
 
 Documentation contributions also came from:
 Marco Maggi <marco.maggi-ipsu@poste.it>
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,6 @@
+Wed Sep 15 09:33:46 CEST 2010
+	Fixed double-free. -CG/ES
+
 Fri Sep 10 14:47:11 CEST 2010
 	Releasing libmicrohttpd 0.9.1. -CG
 
diff --git a/src/daemon/connection.c b/src/daemon/connection.c
@@ -1643,6 +1643,7 @@ parse_connection_headers (struct MHD_Connection *connection)
                 "Received `%s' request without `%s' header.\n",
                 MHD_HTTP_VERSION_1_1, MHD_HTTP_HEADER_HOST);
 #endif
+      EXTRA_CHECK (connection->response == NULL);
       response =
         MHD_create_response_from_data (strlen (REQUEST_LACKS_HOST),
                                        REQUEST_LACKS_HOST, MHD_NO, MHD_NO);
diff --git a/src/daemon/daemon.c b/src/daemon/daemon.c
@@ -952,7 +952,6 @@ MHD_cleanup_connections (struct MHD_Daemon *daemon)
 		  abort();
 		}
             }
-          MHD_destroy_response (pos->response);
           MHD_pool_destroy (pos->pool);
 #if HTTPS_SUPPORT
           if (pos->tls_session != NULL)