Nginx master process segfault after second call nginx configuration reload (/etc/init.d/nginx reload) about nginx-upload-progress-module HOT 5 CLOSED

Thanks, I'll have a look. Can you send me the minimal nginx configuration needed to reproduce the issue?

from nginx-upload-progress-module.

You can reproduce bug with default nginx configuration.
My nginx build script on Ubuntu 9.10:

VER=0.7.64
MODSDIR=/usr/src/nginx-modules

aptitude install libpcre3-dev libssl-dev

if [ ! -e $MODSDIR ]; then
    mkdir $MODSDIR
fi

cd $MODSDIR
if [ ! -f ./masterzen-nginx-upload-progress-module-ac62a29.tar.gz ]; then
    wget -c http://github.com/masterzen/nginx-upload-progress-module/tarball/v0.7
    tar -zxf ./masterzen-nginx-upload-progress-module-ac62a29.tar.gz
fi


cd /usr/src
wget -c http://sysoev.ru/nginx/nginx-$VER.tar.gz
tar -zxf ./nginx-$VER.tar.gz
cd ./nginx-$VER
./configure \
  --sbin-path=/usr/sbin/nginx \
  --conf-path=/etc/nginx/nginx.conf \
  --pid-path=/var/run/nginx.pid \
  --lock-path=/var/lock/nginx.lock \
  --error-log-path=/var/log/nginx/error.log \
  --http-log-path=/var/log/nginx/access.log \
  --http-client-body-temp-path=/var/lib/nginx/body \
  --http-proxy-temp-path=/var/lib/nginx/proxy \
  --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
  --with-http_stub_status_module \
  --with-md5=/usr/lib \
  --with-http_ssl_module \
  --with-http_gzip_static_module \
  --add-module=$MODSDIR/masterzen-nginx-upload-progress-module-ac62a29 \

make && make install

from nginx-upload-progress-module.

I'm sorry, but I can't seem to reproduce the issue with either the default nginx.conf or one containing some upload progress config.
Can you please recompile without optimization and re-send a bt full.
Then in gdb up up to ngx_http_upload_progress_set_template, and then issue:
p *t

Thanks,

from nginx-upload-progress-module.

Here is bt full without optimization:

GNU gdb (GDB) 7.0-ubuntu
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu".
For bug reporting instructions, please see:
http://www.gnu.org/software/gdb/bugs/...
Reading symbols from /usr/sbin/nginx...done.
Reading symbols from /lib/tls/i686/cmov/libcrypt.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/tls/i686/cmov/libcrypt.so.1
Reading symbols from /lib/libpcre.so.3...(no debugging symbols found)...done.
Loaded symbols for /lib/libpcre.so.3
Reading symbols from /lib/i686/cmov/libssl.so.0.9.8...(no debugging symbols found)...done.
Loaded symbols for /lib/i686/cmov/libssl.so.0.9.8
Reading symbols from /lib/i686/cmov/libcrypto.so.0.9.8...(no debugging symbols found)...done.
Loaded symbols for /lib/i686/cmov/libcrypto.so.0.9.8
Reading symbols from /lib/tls/i686/cmov/libdl.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/tls/i686/cmov/libdl.so.2
Reading symbols from /lib/libz.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /lib/tls/i686/cmov/libc.so.6...(no debugging symbols found)...done.
Loaded symbols for /lib/tls/i686/cmov/libc.so.6
Reading symbols from /lib/ld-linux.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/tls/i686/cmov/libnss_compat.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/tls/i686/cmov/libnss_compat.so.2
Reading symbols from /lib/tls/i686/cmov/libnsl.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/tls/i686/cmov/libnsl.so.1
Reading symbols from /lib/tls/i686/cmov/libnss_nis.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/tls/i686/cmov/libnss_nis.so.2
Reading symbols from /lib/tls/i686/cmov/libnss_files.so.2...(no debugging symbols found)...done.
Loaded symbols for /lib/tls/i686/cmov/libnss_files.so.2
Core was generated by nginx: master pr'. Program terminated with signal 11, Segmentation fault. #0 0x0804f006 in ngx_array_push_n (a=0x98af484, n=8) at src/core/ngx_array.c:116 116 && p->d.last + size <= p->d.end) (gdb) bt f #0 0x0804f006 in ngx_array_push_n (a=0x98af484, n=8) at src/core/ngx_array.c:116 elt = 0x8068397 new = 0xbf883c58 size = 1258005360 nalloc = 16384 p = 0xf #1 0x080956af in ngx_http_script_add_code (codes=0x98af484, size=8, code=0x0) at src/http/ngx_http_script.c:562 elts = 0x5f6c7373 <Address 0x5f6c7373 out of bounds> p = 0xbf883c78 new = 0xf25da5 #2 0x0809574e in ngx_http_script_add_copy_code (sc=0xbf883d00, value=0xbf883cc8, last=1) at src/http/ngx_http_script.c:589 p = 0x98bd8a0 "\025" size = 3213376680 len = 38 zero = 0 code = 0x804f295 #3 0x08095186 in ngx_http_script_compile (sc=0xbf883d00) at src/http/ngx_http_script.c:367 ch = 9 '\t' name = {len = 38, data = 0x80dbedc "new Object({ 'state' : 'starting' })\r\n"} i = 38 bracket = 160101448 #4 0x080cd656 in ngx_http_upload_progress_set_template (cf=0xbf883fbc, t=0x98af468, source=0x80e61e0) at /usr/src/nginx-modules/masterzen-nginx-upload-progress-module-ac62a29/ngx_http_uploadprogress_module.c:1486 n = 0 sc = {cf = 0xbf883fbc, source = 0x80e61e0, flushes = 0x0, lengths = 0x98af46c, values = 0x98af468, variables = 0, ncaptures = 0, captures_mask = 0, size = 38, main = 0x0, compile_args = 0, complete_lengths = 1, complete_values = 1, zero = 0, conf_prefix = 0, root_prefix = 0, dup_capture = 0, args = 0} #5 0x080cd068 in ngx_http_uploadprogress_init_variables_and_templates (cf=0xbf883fbc) at /usr/src/nginx-modules/masterzen-nginx-upload-progress-module-ac62a29/ngx_http_uploadprogress_module.c:1308 elt = 0x98af468 var = 0x98af414 v = 0x80e60d0 t = 0x98af468 m = 0x80e61a0 n = 0 i = 0 #6 0x08079564 in ngx_http_block (cf=0xbf883fbc, cmd=0x80df680, conf=0x98ab77c) at src/http/ngx_http.c:231 rv = 0x0 mi = 36 m = 40 s = 135132160 pcf = {name = 0x0, args = 0x98ab898, cycle = 0x98ab590, pool = 0x98ab568, temp_pool = 0x98b8d90, conf_file = 0xbf883e9c, log = 0x98af5a4, ctx = 0x98ab760, module_type = 1163022147, cmd_type = 16777216, handler = 0, handler_conf = 0x0} ports = {elts = 0x98ab568, nelts = 160086418, size = 160140688, nalloc = 3213377180, pool = 0xbf883e68} module = 0x80e6100 ctx = 0x98ab998 clcf = 0x6 cscfp = 0x98ab568 cmcf = 0x8060214 #7 0x0805fa40 in ngx_conf_handler (cf=0xbf883fbc, last=1) at src/core/ngx_conf_file.c:393 rv = 0x7b000000 <Address 0x7b000000 out of bounds> conf = 0x98ab77c confp = 0x98b4656 i = 7 multi = 0 name = 0x98ab8ac cmd = 0x80df680 #8 0x0805f683 in ngx_conf_parse (cf=0xbf883fbc, filename=0x98ab638) at src/core/ngx_conf_file.c:243 rv = 0x98b8d90 "" fd = 7 rc = 1 buf = { pos = 0x98b4658 "\n include mime.types;\n default_type application/octet-stream;\n\n #log_format main '$remote_addr - $remote_user [$time_local] \"$request\" '\n #", ' ' <repeats 18 times>, "'$status $body_bytes_s"..., last = 0x98b5026 "t", file_pos = 34519823720, file_last = 687799017879025000, start = 0x98b4580 "\n#user nobody;\nworker_processes 1;\n\n#error_log logs/error.log;\n#error_log logs/error.log notice;\n#error_log logs/error.log info;\n\n#pid logs/nginx.pid;\n\n\nevents {\n worker_connections "..., end = 0x98b5580 "", tag = 0xbf883f78, file = 0x804e468, shadow = 0x4000, temporary = 1, memory = 0, mmap = 1, recycled = 0, in_file = 0, flush = 1, sync = 0, last_buf = 1, last_in_chain = 1, last_shadow = 0, temp_file = 1, num = 1} prev = 0x0 conf_file = {file = {fd = 7, name = {len = 21, data = 0x98ab684 "/etc/nginx/nginx.conf"}, info = {st_dev = 2049, __pad1 = 0, __st_ino = 465590, st_mode = 33188, st_nlink = 1, st_uid = 0, st_gid = 0, st_rdev = 0, __pad2 = 0, st_size = 2726, st_blksize = 4096, st_blocks = 8, st_atim = {tv_sec = 1261019890, tv_nsec = 0}, st_mtim = {tv_sec = 1261019890, tv_nsec = 0}, st_ctim = {tv_sec = 1261019890, tv_nsec = 0}, st_ino = 465590}, offset = 2726, sys_offset = 16384, log = 0x98af5a4, valid_info = 1, directio = 0}, buffer = 0xbf883f28, line = 17} type = parse_file #9 0x0805c8ba in ngx_init_cycle (old_cycle=0x98af598) at src/core/ngx_cycle.c:263 rv = 0x98ab894 senv = 0xbf88440c env = 0x7 i = 45 n = 1 log = 0x98af5a4 tp = 0x80e63bc conf = {name = 0x0, args = 0x98ab898, cycle = 0x98ab590, pool = 0x98ab568, temp_pool = 0x98b8d90, conf_file = 0xbf883e9c, log = 0x98af5a4, ctx = 0x98ab998, module_type = 1163022147, cmd_type = 16777216, handler = 0, handler_conf = 0x0} pool = 0x98ab568 cycle = 0x98ab590 old = 0xf2ffc0 shm_zone = 0xbf884098 oshm_zone = 0x0 part = 0x0 opart = 0x269ff4 file = 0x133f44 ls = 0x0 nls = 0x80de0c8 ccf = 0x80497d8 old_ccf = 0x1 module = 0x80df6b8 hostname = "denis\000\210\277\t\362\000\244\365\212\t,A\210\277\000\000\000\000\000\000\000\000q|\037\000\224\344\006\b\004\000\000\000\200@\210\001\226#\033\000\261\233\005\b\030A\210\277\000\000\000\000\001\000\000\000\020A\210\277\000\000\000\000\000\000\000\000\234@\210\277\001", '\000' <repeats 15 times>, "\020A\210\277\020\000\000\000,A\210\277\020\000\000\000\250\350\006\b\b\000\000\000\000\000\000\000\370@\210\277\000\326\344\327\005\000\000\000\002\000\000\000HA\210\277H\030\a\b\004\000\000\000\020A\210\277\020\000\000\000\244\365\212\tXA\210\277\001\000\000\000\331L\000\000\364\237&\000\000\000\000\000\000\000\000\000HA\210\277j\017\a\b\230\365\212\t,A\210\277\000\000\000\000\251!\r\b\002\000\000\000\317L\000\000\016\243)K\026\062\004\000\274c\016\b\001\000\000\000\002\000\000\000\000\000\000\000X\270w\000\000\000̀\247H\025"
#10 0x08070b0c in ngx_master_process_cycle (cycle=0x98af598) at src/os/unix/ngx_process_cycle.c:230
title = 0x98baf5e "master process /usr/sbin/nginx"
p = 0x98baf7c ""
size = 31
i = 1
n = 0
set = {__val = {0 <repeats 32 times>}}
itv = {it_interval = {tv_sec = 0, tv_usec = 0}, it_value = {tv_sec = 160085404, tv_usec = 0}}
live = 1
delay = 0
ls = 0x6
ccf = 0x98af824
#11 0x0804c256 in main (argc=1, argv=0xbf884404) at src/core/nginx.c:389
i = 45
log = 0x80e6314
cycle = 0x98ab590
init_cycle = {conf_ctx = 0x0, pool = 0x98aace0, log = 0x80e6314, new_log = {log_level = 0, file = 0x0, connection = 0,
handler = 0, data = 0x0, action = 0x0}, files = 0x0, free_connections = 0x0, free_connection_n = 0, listening = {elts = 0x0,
nelts = 0, size = 0, nalloc = 0, pool = 0x0}, pathes = {elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool = 0x0},
open_files = {last = 0x0, part = {elts = 0x0, nelts = 0, next = 0x0}, size = 0, nalloc = 0, pool = 0x0}, shared_memory = {
last = 0x0, part = {elts = 0x0, nelts = 0, next = 0x0}, size = 0, nalloc = 0, pool = 0x0}, connection_n = 0, files_n = 0,
connections = 0x0, read_events = 0x0, write_events = 0x0, old_cycle = 0x0, conf_file = {len = 21,
data = 0x80cea6a "/etc/nginx/nginx.conf"}, conf_param = {len = 0, data = 0x0}, conf_prefix = {len = 11,
data = 0x80cea6a "/etc/nginx/nginx.conf"}, prefix = {len = 17, data = 0x80cea58 "/usr/local/nginx/"}, lock_file = {len = 0,
data = 0x0}, hostname = {len = 0, data = 0x0}}
ccf = 0x98abd6c
(gdb) q

And p *t:

(gdb) up
#4 0x080cd656 in ngx_http_upload_progress_set_template (cf=0xbf883fbc, t=0x98af468, source=0x80e61e0)
at /usr/src/nginx-modules/masterzen-nginx-upload-progress-module-ac62a29/ngx_http_uploadprogress_module.c:1486
1486 if (ngx_http_script_compile(&sc) != NGX_OK) {
(gdb) p *t
$1 = {values = 0xf, lengths = 0x98af484}

(nginx.conf from default configuration, without upload progress config options)

from nginx-upload-progress-module.

Fixed in SHA: 4357349

from nginx-upload-progress-module.