# NGINX crash

**URL:** <https://www.ruby-forum.com/t/nginx-crash/221965>\
**Category:** NGINX\
**Created:** [August 7, 2012, 4:39pm UTC](https://www.ruby-forum.com/t/nginx-crash/221965 "2012-08-07T16:39:41Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [August 7, 2012, 4:39pm UTC](https://www.ruby-forum.com/t/nginx-crash/221965/1 "2012-08-07T16:39:41Z")

</div>

Hello,  
“nginx” crashes in “ngx\_http\_limit\_req\_handler”.  
This does not happen, if “limit\_req” is not nested.  
We couldn’t reproduce this issue in a testing environment.  
Thanks a lot

_ **Request** _

GET / HTTP/1.1  
Host: [hostname.com](http://hostname.com)  
X-REAL-IP: 123.123.12.123

_ **Config** _ (simplified)

http {  
# ipaddress + ipaddress/16 + ipaddress/24  
map $http\_x\_real\_ip $ipaddress {  
default $remote\_addr;  
“~^\d+.\d+.\d+.\d+$” $http\_x\_real\_ip;  
}  
map $ipaddress $ipaddress\_net {  
default “”;  
“~^(?P\d+.\d+).\d+.\d+$” $ip;  
}  
map $ipaddress $ipaddress\_host {  
default “”;  
“~^(?P\d+.\d+.\d+).\d+$” $ip;  
}

```
# limit requests
limit_req_log_level warn;
limit_req_zone $ipaddress zone=staticzone_ip:32m

```

rate=100r/s;  
limit\_req zone=staticzone\_ip burst=50;  
limit\_req\_zone $ipaddress zone=dynamiczone\_ip:32m  
rate=2r/s;  
limit\_req\_zone $ipaddress zone=dynamiczone\_ddos:32m  
rate=6r/m;  
limit\_req\_zone $ipaddress\_host  
zone=dynamiczone\_host:32m rate=10r/s;  
limit\_req\_zone $ipaddress\_net zone=dynamiczone\_net:32m  
rate=20r/s;

```
server {
    location / {
        limit_req zone=dynamiczone_ip burst=10;
        limit_req zone=dynamiczone_ddos burst=1000

```

nodelay;  
limit\_req zone=dynamiczone\_host burst=20;  
limit\_req zone=dynamiczone\_net burst=40;

```
        fastcgi_pass unix:/var/run/fastcgi.sock;
        ...
    }
}

```

}

_ **Backtrace** _

#0 0x000000000040b25d in ngx\_vslprintf (buf=0x7fff4f9be1df “”,  
last=0x7fff4f9be970 “0”, fmt=0x48231b “v"”, args=0x7fff4f9be970) at  
src/core/ngx\_string.c:245  
p = 0x7fff4f9be192 “0: \*1901681 the value of the "ipaddress"  
variable is more than 65535 bytes: "”  
zero = 32 ’ ’  
d = 0  
f = 6.9058890903168798e-310  
len = 1937  
slen = 18446744073709551615  
i64 = 0  
ui64 = 0  
frac = 0  
ms = 140734529003968  
width = 0  
sign = 1  
hex = 0  
max\_width = 0  
frac\_width = 0  
scale = 18446744070750200624  
n = 0  
v = 0x1b958148  
vv = 0x1b99a040

#1 0x000000000040535c in ngx\_log\_error\_core (level=4, log=0x1b9f0e70,  
err=0, fmt=0x4822e0 “the value of the "%V" variable is more than 65535  
bytes: "%v"”) at src/core/ngx\_log.c:120  
args = {{gp\_offset = 48, fp\_offset = 48, overflow\_arg\_area =  
0x7fff4f9bea70, reg\_save\_area = 0x7fff4f9be9a0}}  
p = 0x7fff4f9be19e “the value of the "ipaddress" variable is  
more than 65535 bytes: "”  
last = 0x7fff4f9be970 “0”  
msg = 0x7fff4f9be19e “the value of the "ipaddress" variable is  
more than 65535 bytes: "”  
errstr = “2012/08/07 16:17:42 [error] 30667#0: _1901681 the  
value of the "ipaddress" variable is more than 65535 bytes:  
"\000\000\000\000\000\000\000\000\000\>\001\000\006\000\000\000\000`\233\231\033\000\000\000\000\303)\000\000\000\000\000\000\341\346\233O\377\177\000\000he\233\033\000\000\000\000V\\000\000\000\000\000\000\000\200\001\000\000\000\000\000pd\233\033\000\000\000\000p\312s\033\371_\000\000\000\000\000\000\000\000\000\000P\363\233O\377\177\000\000\020c\233\033\000\000\000\000”…

#2 0x000000000046d5d2 in ngx\_http\_limit\_req\_handler (r=0x1b99faa0) at  
src/http/modules/ngx\_http\_limit\_req\_module.c:192  
len = 194343136  
hash = 4294967295  
rc = -5  
n = 0  
excess = 0  
delay = 463076000  
vv = 0x1b99a040  
ctx = 0x1b958128  
lrcf = 0x1b9594a0  
limit = 0x1b959f00  
limits = 0x1b959f00

#3 0x0000000000437b08 in ngx\_http\_core\_generic\_phase (r=0x1b99faa0,  
ph=0x1b968e58) at src/http/ngx\_http\_core\_module.c:899  
rc = -5

#4 0x0000000000437ab6 in ngx\_http\_core\_run\_phases (r=0x1b99faa0) at  
src/http/ngx\_http\_core\_module.c:877  
rc = -2  
ph = 0x1b968df8  
cmcf = 0x1b932278

#5 0x0000000000437a32 in ngx\_http\_handler (r=0x1b99faa0) at  
src/http/ngx\_http\_core\_module.c:860  
cmcf = 0x2af91c2ba0a8

#6 0x000000000044459c in ngx\_http\_process\_request (r=0x1b99faa0) at  
src/http/ngx\_http\_request.c:1688  
c = 0x2af91b73d258

#7 0x0000000000443259 in ngx\_http\_process\_request\_headers  
(rev=0x2af91c2ba0a8) at src/http/ngx\_http\_request.c:1132  
p = 0x10 \<Address 0x10 out of bounds\>  
len = 463051616  
n = 43  
rc = 0  
rv = 140734529006688  
h = 0x1b99a1c0  
c = 0x2af91b73d258  
hh = 0x0  
r = 0x1b99faa0  
cscf = 0x1b963668  
cmcf = 0x1b932278

#8 0x0000000000442afe in ngx\_http\_process\_request\_line  
(rev=0x2af91c2ba0a8) at src/http/ngx\_http\_request.c:932  
host = 0x1b999b60 “\211\245\231\033”  
n = 58  
rc = 0  
rv = 368  
c = 0x2af91b73d258  
r = 0x1b99faa0  
cscf = 0x1b99a020

#9 0x00000000004423b5 in ngx\_http\_init\_request (rev=0x2af91c2ba0a8) at  
src/http/ngx\_http\_request.c:519  
tp = 0x6975a0  
i = 463074232  
c = 0x2af91b73d258  
r = 0x1b99faa0  
sin = 0x7fff4f9bed70  
port = 0x1b969230  
addr = 0x1b969240  
ctx = 0x1b9f0eb0  
addr\_conf = 0x1b969248  
hc = 0x1b9f0ec8  
cscf = 0x1b963668  
clcf = 0x1b963700  
cmcf = 0x1b932278

#10 0x00000000004328b2 in ngx\_epoll\_process\_events (cycle=0x1b9316c0,  
timer=500, flags=1) at src/event/modules/ngx\_epoll\_module.c:679  
events = 1  
revents = 1  
instance = 1  
i = 0  
level = 1335619040  
err = 0  
rev = 0x2af91c2ba0a8  
wev = 0x428d62  
queue = 0x0  
c = 0x2af91b73d258

#11 0x0000000000425dc0 in ngx\_process\_events\_and\_timers  
(cycle=0x1b9316c0) at src/event/ngx\_event.c:247  
flags = 1  
timer = 500  
delta = 1344349062687

#12 0x0000000000430d04 in ngx\_worker\_process\_cycle (cycle=0x1b9316c0,  
data=0x0) at src/os/unix/ngx\_process\_cycle.c:808  
i = 140734529008464  
c = 0x0

#13 0x000000000042dda1 in ngx\_spawn\_process (cycle=0x1b9316c0,  
proc=0x430bb0 \<ngx\_worker\_process\_cycle\>, data=0x0, name=0x47d6c8  
“worker process”, respawn=-4) at src/os/unix/ngx\_process.c:198  
on = 1  
pid = 0  
s = 6

#14 0x000000000042ffd7 in ngx\_start\_worker\_processes (cycle=0x1b9316c0,  
n=4, type=-4) at src/os/unix/ngx\_process\_cycle.c:365  
i = 2  
ch = {command = 1, pid = 30666, slot = 5, fd = 15}

#15 0x000000000042fbf7 in ngx\_master\_process\_cycle (cycle=0x1b9316c0) at  
src/os/unix/ngx\_process\_cycle.c:250  
title = 0x1b94e44b “”  
p = 0x1b94e48d “”  
size = 67  
i = 3  
n = 462608624  
sigio = 0  
set = {\_\_val = {0 \<repeats 16 times\>}}  
itv = {it\_interval = {tv\_sec = 0, tv\_usec = 0}, it\_value =  
{tv\_sec = 8, tv\_usec = 18}}  
live = 1  
delay = 0  
ls = 0x4  
ccf = 0x1b931ce8

#16 0x0000000000403280 in main (argc=3, argv=0x7fff4f9bf358) at  
src/core/nginx.c:410  
i = 30  
log = 0x697300  
cycle = 0x1b92d6b0  
init\_cycle = {conf\_ctx = 0x0, pool = 0x1b92c930, log = 0x697300,  
new\_log = {log\_level = 0, file = 0x0, connection = 0, handler = 0, data  
= 0x0, action = 0x0}, files = 0x0,  
free\_connections = 0x0, free\_connection\_n = 0,  
reusable\_connections\_queue = {prev = 0x0, next = 0x0}, listening = {elts  
= 0x1b92ce80, nelts = 1, size = 200, nalloc = 10,  
pool = 0x1b92c930}, pathes = {elts = 0x0, nelts = 0, size =  
0, nalloc = 0, pool = 0x0}, open\_files = {last = 0x0, part = {elts =  
0x0, nelts = 0, next = 0x0}, size = 0,  
nalloc = 0, pool = 0x0}, shared\_memory = {last = 0x0, part =  
{elts = 0x0, nelts = 0, next = 0x0}, size = 0, nalloc = 0, pool = 0x0},  
connection\_n = 0, files\_n = 0,  
connections = 0x0, read\_events = 0x0, write\_events = 0x0,  
old\_cycle = 0x0, conf\_file = {len = 20, data = 0x7fff4f9c0e91 “”},  
conf\_param = {len = 0, data = 0x0}, conf\_prefix = {  
len = 10, data = 0x7fff4f9c0e91 “”}, prefix = {len = 17,  
data = 0x47a67e “/usr/local/nginx/”}, lock\_file = {len = 0, data = 0x0},  
hostname = {len = 0, data = 0x0}}  
ccf = 0x1b92ded8

Posted at Nginx Forum:

> **[NGINX crash](https://forum.nginx.org/read.php?2,229394,229394#msg-229394)**
>
> Hello, "nginx" crashes in "ngx\_http\_limit\_req\_handler". This does not happen, if "limit\_req" is not nested. We couldn't reproduce this issue in a testing environment. Thanks a lot \_\_\_\_\_Request\_\_\_\_\_ GET / HTTP/1.1

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [August 7, 2012, 10:51pm UTC](https://www.ruby-forum.com/t/nginx-crash/221965/2 "2012-08-07T22:51:20Z")

</div>

It does not crash if I remove the limit\_req “dynamiczone\_net”.

Posted at Nginx Forum:

> **[Re: NGINX crash](https://forum.nginx.org/read.php?2,229394,229412#msg-229412)**
>
> Hello, "nginx" crashes in "ngx\_http\_limit\_req\_handler". This does not happen, if "limit\_req" is not nested. We couldn't reproduce this issue in a testing environment. Thanks a lot \_\_\_\_\_Request\_\_\_\_\_ GET / HTTP/1.1

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [August 8, 2012, 12:15pm UTC](https://www.ruby-forum.com/t/nginx-crash/221965/3 "2012-08-08T12:15:02Z")

</div>

Hello!

On Tue, Aug 07, 2012 at 10:38:59AM -0400, double wrote:

> Hello,  
> “nginx” crashes in “ngx\_http\_limit\_req\_handler”.  
> This does not happen, if “limit\_req” is not nested.  
> We couldn’t reproduce this issue in a testing environment.  
> Thanks a lot

What does nginx -V show on the affected host? Any 3rd party  
modules/patches? Which OS, which PCRE library version? Are  
hardware problems ruled out (i.e. are you able to reproduce the  
problem on another host)?

It would be cool if you could obtain debug log.

> _ **Request** _
> 
> GET / HTTP/1.1  
> Host: [hostname.com](http://hostname.com)  
> X-REAL-IP: 123.123.12.123

Is it actual request which corresponds to a backtrace below?

> _ **Config** _ (simplified)
> 
> http {  
> # ipaddress + ipaddress/16 + ipaddress/24  
> map $http\_x\_real\_ip $ipaddress {  
> default $remote\_addr;  
> “~^\d+.\d+.\d+.\d+$” $http\_x\_real\_ip;  
> }

It would be better to see full actual config used.

[…]

> ```
> errstr = "2012/08/07 16:17:42 [error] 30667#0: *1901681 the
> delay = 463076000
> vv = 0x1b99a040
> ctx = 0x1b958128
> lrcf = 0x1b9594a0
> limit = 0x1b959f00
> limits = 0x1b959f00
> 
> ```

It looks like the $ipaddress variable was corrupted somehow. Could  
you please show

fr 2  
p \*limit  
p \*ctx  
p \*vv  
p \*r

output from gdb?

[…]

Maxim D.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [August 8, 2012, 12:01pm UTC](https://www.ruby-forum.com/t/nginx-crash/221965/4 "2012-08-08T12:01:36Z")

</div>

On Tuesday 07 August 2012 18:38:59 double wrote:

> Hello,  
> “nginx” crashes in “ngx\_http\_limit\_req\_handler”.  
> This does not happen, if “limit\_req” is not nested.  
> We couldn’t reproduce this issue in a testing environment.  
> Thanks a lot

[…]

Could you provide debug log with crash or/and core dump?

[http://nginx.org/en/docs/debugging\_log.html](http://nginx.org/en/docs/debugging_log.html)

> **[Debugging | NGINX](https://www.nginx.com/resources/wiki/start/topics/tutorials/debugging/)**
>
> This tutorial explains how to use some of NGINX's essential debugging features.

wbr, Valentin V. Bartenev

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [August 10, 2012, 9:51pm UTC](https://www.ruby-forum.com/t/nginx-crash/221965/5 "2012-08-10T21:51:30Z")

</div>

Hello,

Thanks a lot for your answer.  
The machine runs CentOS5 (PCRE from repository).  
I must say, we never had a single crash - not even once.  
If we `telnet` the above request, NGINX crashes immediately.  
For full config or core-dumps please contact us per email:  
sandyherman [at] gmx [dot] net

Thanks a lot  
Sandy

# “http\_fastcgi\_module”, “http\_limit\_conn\_module”,

“http\_limit\_req\_module”  
./configure --prefix=/usr/local/nginx --user=www --group=www  
–with-pcre  
–without-http\_charset\_module --without-http\_gzip\_module  
–without-http\_ssi\_module --without-http\_userid\_module  
–without-http\_autoindex\_module --without-http\_geo\_module  
–without-http\_split\_clients\_module  
–without-http\_referer\_module --without-http\_proxy\_module  
–without-http\_uwsgi\_module --without-http\_scgi\_module  
–without-http\_memcached\_module --without-http\_empty\_gif\_module  
–without-http\_browser\_module  
–without-http\_upstream\_ip\_hash\_module  
–without-mail\_pop3\_module --without-mail\_imap\_module  
–without-mail\_smtp\_module

(gdb) fr 2  
#2 0x000000000046d5d2 in ngx\_http\_limit\_req\_handler (r=0x1b99faa0) at  
src/http/modules/ngx\_http\_limit\_req\_module.c:192  
192 in src/http/modules/ngx\_http\_limit\_req\_module.c

(gdb) p \*limit  
$1 = {shm\_zone = 0x1b9319e8, burst = 10000, nodelay = 0}

(gdb) p \*ctx  
$2 = {sh = 0x2af913765000, shpool = 0x2af913735000, rate = 2000, index =  
2, var = {len = 9, data = 0x1b9580f9 “ipaddress”}, node = 0x0}

(gdb) p \*vv  
$3 = {len = 194343136, valid = 1, no\_cacheable = 0, not\_found = 0,  
escape = 0, data = 0x0}

(gdb) p _r  
$4 = {signature = 1347703880, connection = 0x2af91b73d258, ctx =  
0x1b999f70, main\_conf = 0x1b932068, srv\_conf = 0x1b958310, loc\_conf =  
0x1b9590e8,  
read\_event\_handler = 0x445737 \<ngx\_http\_block\_reading\>,  
write\_event\_handler = 0x437a34 \<ngx\_http\_core\_run\_phases\>, cache = 0x0,  
upstream = 0x0, upstream\_states = 0x0, pool = 0x1b999b60,  
header\_in = 0x1ba0dba0, headers\_in = {headers = {last = 0x1b99fb10,  
part = {elts = 0x1b99a190, nelts = 2, next = 0x0}, size = 48, nalloc =  
20, pool = 0x1b999b60}, host = 0x1b99a190,  
connection = 0x0, if\_modified\_since = 0x0, if\_unmodified\_since =  
0x0, user\_agent = 0x0, referer = 0x0, content\_length = 0x0, content\_type  
= 0x0, range = 0x0, if\_range = 0x0,  
transfer\_encoding = 0x0, expect = 0x0, authorization = 0x0,  
keep\_alive = 0x0, user = {len = 0, data = 0x0}, passwd = {len = 0, data  
= 0x0}, cookies = {elts = 0x1b99a550, nelts = 0,  
size = 8, nalloc = 2, pool = 0x1b999b60}, server = {len = 9, data  
= 0x1b9c7625 “[seite.net](http://seite.net)”}, content\_length\_n = -1, keep\_alive\_n = -1,  
connection\_type = 0, msie = 0, msie6 = 0,  
opera = 0, gecko = 0, chrome = 0, safari = 0, konqueror = 0},  
headers\_out = {headers = {last = 0x1b99fc28, part = {elts = 0x1b999bb0,  
nelts = 0, next = 0x0}, size = 48, nalloc = 20,  
pool = 0x1b999b60}, status = 0, status\_line = {len = 0, data =  
0x0}, server = 0x0, date = 0x0, content\_length = 0x0, content\_encoding =  
0x0, location = 0x0, refresh = 0x0,  
last\_modified = 0x0, content\_range = 0x0, accept\_ranges = 0x0,  
www\_authenticate = 0x0, expires = 0x0, etag = 0x0, override\_charset =  
0x0, content\_type\_len = 0, content\_type = {len = 0,  
data = 0x0}, charset = {len = 0, data = 0x0}, content\_type\_lowcase  
= 0x0, content\_type\_hash = 0, cache\_control = {elts = 0x0, nelts = 0,  
size = 0, nalloc = 0, pool = 0x0},  
content\_length\_n = -1, date\_time = 0, last\_modified\_time = -1},  
request\_body = 0x0, lingering\_time = 0, start\_sec = 1344349062,  
start\_msec = 773, method = 2, http\_version = 1001,  
request\_line = {len = 14, data = 0x1b9c7610 “GET / HTTP/1.1\nHost”},  
uri = {len = 1, data = 0x1b9c7614 “/ HTTP/1.1\nHost”}, args = {len = 0,  
data = 0x0}, exten = {len = 0, data = 0x0},  
unparsed\_uri = {len = 1, data = 0x1b9c7614 “/ HTTP/1.1\nHost”},  
method\_name = {len = 3, data = 0x1b9c7610 “GET / HTTP/1.1\nHost”},  
http\_protocol = {len = 8,  
data = 0x1b9c7616 “HTTP/1.1\nHost”}, out = 0x0, main = 0x1b99faa0,  
parent = 0x0, postponed = 0x0, post\_subrequest = 0x0, posted\_requests =  
0x0, virtual\_names = 0x1b969258,  
phase\_handler = 4, content\_handler = 0x472884  
\<ngx\_http\_fastcgi\_handler\>, access\_code = 0, variables = 0x1b99a020,  
ncaptures = 0, captures = 0x0,  
captures\_data = 0x1b99a56d  
"195.162.24.220195.162.24.220\356(F\256ܱz:\365\311&\337bog\267I\265ۉ\324_:E\027\225Y\265)!MiL\262\177/\207\303\021\243]\260t\335శ\222\302\316)dmL\312\*i\333ۏM3\317ah\350\313\\024\204g\a\211\030\306H\370\f\360\f\321\351L\216\f",  
limit\_rate = 65536, header\_size = 0, request\_length = 58, err\_status =  
0, http\_connection = 0x1b9f0ec8,  
log\_handler = 0x446b6e \<ngx\_http\_log\_error\_handler\>, cleanup = 0x0,  
subrequests = 201, count = 1, blocked = 0, aio = 0, http\_state = 2,  
complex\_uri = 0, quoted\_uri = 0, plus\_in\_uri = 0,  
space\_in\_uri = 0, invalid\_header = 0, add\_uri\_to\_alias = 0,  
valid\_location = 1, valid\_unparsed\_uri = 1, uri\_changed = 0, uri\_changes  
= 11, request\_body\_in\_single\_buf = 0,  
request\_body\_in\_file\_only = 0, request\_body\_in\_persistent\_file = 0,  
request\_body\_in\_clean\_file = 0, request\_body\_file\_group\_access = 0,  
request\_body\_file\_log\_level = 5,  
subrequest\_in\_memory = 0, waited = 0, cached = 0, proxy = 0,  
bypass\_cache = 0, no\_cache = 0, limit\_conn\_set = 0, limit\_req\_set = 0,  
pipeline = 0, plain\_http = 0, chunked = 0,  
header\_only = 0, keepalive = 1, lingering\_close = 0, discard\_body = 0,  
internal = 0, error\_page = 0, ignore\_content\_encoding = 0,  
filter\_finalize = 0, post\_action = 0,  
request\_complete = 0, request\_output = 0, header\_sent = 0,  
expect\_tested = 0, root\_tested = 0, done = 0, logged = 0, buffered = 0,  
main\_filter\_need\_in\_memory = 0,  
filter\_need\_in\_memory = 0, filter\_need\_temporary = 0, allow\_ranges =  
0, state = 0, header\_hash = 103689151937377, lowcase\_index = 9,  
lowcase\_header = “x-real-ip”, ‘\000’ \<repeats 22 times\>,  
header\_name\_start = 0x1b9c7649 “\net”, header\_name\_end = 0x1b9c7638 “”,  
header\_start = 0x1b9c763a “195.162.24.220”,  
header\_end = 0x1b9c7649 “\net”, uri\_start = 0x1b9c7614 “/  
HTTP/1.1\nHost”, uri\_end = 0x1b9c7615 " HTTP/1.1\nHost", uri\_ext = 0x0,  
args\_start = 0x0,  
request\_start = 0x1b9c7610 “GET / HTTP/1.1\nHost”, request\_end =  
0x1b9c761e “\nHost”, method\_end = 0x1b9c7612 “T / HTTP/1.1\nHost”,  
schema\_start = 0x0, schema\_end = 0x0, host\_start = 0x0,  
host\_end = 0x0, port\_start = 0x0, port\_end = 0x0, http\_minor = 1,  
http\_major = 1}

Posted at Nginx Forum:

> **[Re: NGINX crash](https://forum.nginx.org/read.php?2,229394,229582#msg-229582)**
>
> Hello, "nginx" crashes in "ngx\_http\_limit\_req\_handler". This does not happen, if "limit\_req" is not nested. We couldn't reproduce this issue in a testing environment. Thanks a lot \_\_\_\_\_Request\_\_\_\_\_ GET / HTTP/1.1

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [August 13, 2012, 4:27am UTC](https://www.ruby-forum.com/t/nginx-crash/221965/6 "2012-08-13T04:27:39Z")

</div>

Hello!

On Fri, Aug 10, 2012 at 03:51:15PM -0400, double wrote:

[…]

> 2, var = {len = 9, data = 0x1b9580f9 “ipaddress”}, node = 0x0}
> 
> (gdb) p \*vv  
> $3 = {len = 194343136, valid = 1, no\_cacheable = 0, not\_found = 0,  
> escape = 0, data = 0x0}

[…]

Ok, it looks like I see the problem. It might be triggered if the  
same variable is used multiple times on a right side of a map.  
Attached patch should fix this.

Maxim D.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [August 16, 2012, 2:29pm UTC](https://www.ruby-forum.com/t/nginx-crash/221965/7 "2012-08-16T14:29:15Z")

</div>

Hello!

On Mon, Aug 13, 2012 at 07:46:56PM -0400, double wrote:

> Hi Maxim,
> 
> Patch works.  
> You are definitly a genius.
> 
> Thanks a lot

Patch committed, thanks for testing.

Maxim D.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [August 14, 2012, 1:47am UTC](https://www.ruby-forum.com/t/nginx-crash/221965/8 "2012-08-14T01:47:40Z")

</div>

Hi Maxim,

Patch works.  
You are definitly a genius.

Thanks a lot

Posted at Nginx Forum:

> **[Re: NGINX crash](https://forum.nginx.org/read.php?2,229394,229665#msg-229665)**
>
> Hello, "nginx" crashes in "ngx\_http\_limit\_req\_handler". This does not happen, if "limit\_req" is not nested. We couldn't reproduce this issue in a testing environment. Thanks a lot \_\_\_\_\_Request\_\_\_\_\_ GET / HTTP/1.1