Re: monit crashing

[Ben Hartshorne]

On Mon, Jun 27, 2005 at 09:20:05PM -0700, Ben Hartshorne wrote:
> Hi all,
> 
> I am getting the following error on running monit.
> 
> 
> *** glibc detected *** free(): invalid next size (fast): 0x095b0418 ***
> Aborted
> 

ok.  it's not time to go home anymore, and I can think a little bit.

A while ago, I reported a bug in how much of a web page is scarfed, and
in the process of fixing it, changed my source tree a bit.  That's going
to make it real difficult for anybody to recreate my bug...  ;)

Anyway, at the end of this email are the differences b/w my source tree
and a stock 4.5.1 downloaded from the public site.  It seems the big
differences are:

HTTP_CONTENT_MAX is 1024^2 instead of 1024*10
http.c is v1.44 instead of v1.42 (the 4.5.1 tree has the older version)

There are a bunch of changes in http.c, and I would guess something's
missing a boundary case when it's getting freed.

Anyway, any help would be much appreciated.

-ben

-=-=-=-=-=-=-8<-=-=-=-=-=-=8<-=-=-=-=-=-8<-=-=-=-=-=

address@hidden:~$ diff -c  monit-4.5.1/monitor.h  monit-4.5.1-ben/monitor.h
*** monit-4.5.1/monitor.h       2005-04-10 14:54:14.000000000 -0700
--- monit-4.5.1-ben/monitor.h   2005-05-09 19:40:53.000000000 -0700
***************
*** 69,75 ****
  #define STRERROR            strerror(errno)
  #define STRLEN             256
  #define ARGMAX             64
! #define HTTP_CONTENT_MAX   (1024*10)
  /* Set log file mode: "-rw-rw-r--" */
  #define LOGMASK            0112
  /* Set pid file mode: "-rw-r--r--" */
--- 69,75 ----
  #define STRERROR            strerror(errno)
  #define STRLEN             256
  #define ARGMAX             64
! #define HTTP_CONTENT_MAX   (1024*1024)
  /* Set log file mode: "-rw-rw-r--" */
  #define LOGMASK            0112
  /* Set pid file mode: "-rw-r--r--" */
address@hidden:~$
address@hidden:~$
address@hidden:~$
address@hidden:~$
address@hidden:~$ diff -c monit-4.5.1/protocols/http.c 
monit-4.5.1-ben/protocols/http.c
*** monit-4.5.1/protocols/http.c        2005-03-25 23:38:20.000000000 -0800
--- monit-4.5.1-ben/protocols/http.c    2005-05-09 19:42:44.000000000 -0700
***************
*** 73,79 ****
   *
   *  @author Jan-Henrik Haukeland, <address@hidden>
   *  @author Martin Pala, <address@hidden>
!  *  @version \$Id: http.c,v 1.42 2005/03/23 22:57:34 hauk Exp $
   *  @file
   */

--- 73,79 ----
   *
   *  @author Jan-Henrik Haukeland, <address@hidden>
   *  @author Martin Pala, <address@hidden>
!  *  @version \$Id: http.c,v 1.44 2005/04/22 22:37:13 hauk Exp $
   *  @file
   */

***************
*** 274,280 ****
--- 274,282 ----
  static int do_regex(Http_T *H, Request_T R) {

    int n;
+   int size= 0;
    int rv= TRUE;
+   int length= 0;
    unsigned char *buf= NULL;
  #ifdef HAVE_REGEX_H
    int regex_return;
***************
*** 295,310 ****
      H->content_length= HTTP_CONTENT_MAX;
    else if(H->content_length > HTTP_CONTENT_MAX)
      H->content_length= HTTP_CONTENT_MAX;
!
    buf= xmalloc(H->content_length);
!
!   n= socket_read(H->s, buf, H->content_length);
!   if(n<=0) {
      rv= FALSE;
      log("HTTP: error receiving data -- %s\n", STRERROR);
      goto error;
    }
!   buf[n]= 0;

  #ifdef HAVE_REGEX_H

--- 297,321 ----
      H->content_length= HTTP_CONTENT_MAX;
    else if(H->content_length > HTTP_CONTENT_MAX)
      H->content_length= HTTP_CONTENT_MAX;
!   n= 0;
!   size= 0;
!   length= H->content_length;
    buf= xmalloc(H->content_length);
!   do {
!       n= socket_read(H->s, &buf[size], length);
!       if(n<=0)
!         break;
!       size+= n;
!       length-= n;
!   } while(length>0);
!   if(size==0) {
      rv= FALSE;
      log("HTTP: error receiving data -- %s\n", STRERROR);
      goto error;
    }
!   buf[size]= 0;
!
!   DEBUG("buffer captured %d bytes and contains:\n%s\n", n, buf);

  #ifdef HAVE_REGEX_H

***************
*** 373,378 ****
--- 384,396 ----
  /* -------------------------------------------------------- State management 
*/


+ /*
+  * Follow redirect responses from the server. FIXME: there is a
+  * BIG shortcoming here since the code only follow redirects on the
+  * same server. What we need to do is to open a new socket against
+  * the server in the location header. This may provide problems since
+  * the socket is owned by the caller. Anyway, do investigate this further.
+  */
  static int do_redirect(Http_T *H) {

    char host[STRLEN];


-=-=-=-=-=-=-8<-=-=-=-=-=-= end diff -=-=-=-=-=-8<-=-=-=-=-=

-- 
Ben Hartshorne
email: address@hidden
http://ben.hartshorne.net

signature.asc
Description: Digital signature