Bug report: SSI -> signal 10 (nginx 0.7.10, Solaris 10)

Hi all,

a SSI bug in 0.7.19 but not in 0.6.32 results in “worker process NNNNN
exited on signal 10 (core dumped)”
if I have many include instructions in one file. 5 includes are ok, 6
not. See details below.

Regards
Hannes

$ cd nginx-0.7.19
$ ./configure --prefix=/cs/nginx --with-pcre=…/pcre-7.8
checking for OS

  • SunOS 5.10 sun4v
    checking for C compiler … found
  • using GNU C compiler
  • gcc version: 4.2.0 (gccfss)
    checking for gcc -pipe switch … found
    checking for gcc variadic macros … found
    checking for C99 variadic macros … found
    checking for unistd.h … found
    checking for inttypes.h … found
    checking for limits.h … found
    checking for sys/filio.h … found
    checking for crypt.h … found
    checking for SunOS specific features
    checking for sendfilev() … found
    checking for event ports … found
    checking for nobody group … found
    checking for poll() … found
    checking for /dev/poll … found
    checking for kqueue … not found
    checking for crypt() … found
    checking for O_DIRECT … not found
    checking for F_NOCACHE … not found
    checking for directio() … found
    checking for zlib library … found
    checking for int size … 4 bytes
    checking for long size … 4 bytes
    checking for long long size … 8 bytes
    checking for void * size … 4 bytes
    checking for uint64_t … found
    checking for sig_atomic_t … found
    checking for sig_atomic_t size … 4 bytes
    checking for socklen_t … found
    checking for in_addr_t … found
    checking for in_port_t … found
    checking for rlim_t … found
    checking for uintptr_t … uintptr_t found
    checking for system endianess … big endianess
    checking for size_t size … 4 bytes
    checking for off_t size … 8 bytes
    checking for time_t size … 4 bytes
    checking for setproctitle() … not found
    checking for pread() … found
    checking for pwrite() … found
    checking for strerror_r() … found
    checking for gnu style strerror_r() … found but is not working
    checking for localtime_r() … found
    checking for posix_memalign() … not found
    checking for memalign() … found
    checking for sched_yield() … found
    checking for mmap(MAP_ANON|MAP_SHARED) … found
    checking for mmap("/dev/zero", MAP_SHARED) … found
    checking for System V shared memory … found
    checking for struct msghdr.msg_control … not found
    checking for ioctl(FIONBIO) … found
    checking for struct tm.tm_gmtoff … not found
    checking for struct dirent.d_namlen … not found
    checking for struct dirent.d_type … not found

Configuration summary

  • using PCRE library: …/pcre-7.8
  • OpenSSL library is not used
  • md5 library is not used
  • sha1 library is not used
  • using system zlib library

nginx path prefix: “/cs/nginx”
nginx binary file: “/cs/nginx/sbin/nginx”
nginx configuration prefix: “/cs/nginx/conf”
nginx configuration file: “/cs/nginx/conf/nginx.conf”
nginx pid file: “/cs/nginx/logs/nginx.pid”
nginx error log file: “/cs/nginx/logs/error.log”
nginx http access log file: “/cs/nginx/logs/access.log”
nginx http client request body temporary files:
“/cs/nginx/client_body_temp”
nginx http proxy temporary files: “/cs/nginx/proxy_temp”
nginx http fastcgi temporary files: “/cs/nginx/fastcgi_temp”

$ make install
nothing special
$ cat >/cs/nginx/conf/nginx.cfg
worker_rlimit_core 1024m;

events {
worker_connections 1024;
}

http {
ssi on;

types {
text/html html htm;
text/css css;ls /cs
application/x-javascripts js;
image/gif gif;
image/jpeg jpeg jpg;
image/png png;
}
default_type application/octet-stream;

server {
listen 7080;
}
}
^D
$ cat >/cs/nginx/html/index.html

include test





^D $ cat >/cs/nginx/html/fragment.html included text ^D $ cd /cs/nginx $ sbin/nginx $ GET -e http://localhost:7080 GET -e http://localhost:7080 Client-Date: Tue, 04 Nov 2008 08:44:06 GMT Client-Peer: 127.0.0.1:7080 Client-Response-Num: 1

$ cat logs/error.log
2008/11/04 09:44:06 [alert] 22399#0: worker process 22400 exited on
signal 10 (core dumped)
$ mdb sbin/nginx core
Loading modules: [ libc.so.1 ld.so.1 ]

::stack
ngx_read_file+0x70(b025c, b0480, e, 0, 0, 0)
ngx_output_chain+0x840(b0400, b0448, 60000000, 80000000, ffbfe80c,
b0200)
ngx_http_copy_filter+0xd4(afcb8, ffbfe9e8, b0400, 8000, 980a4, b5918)
ngx_http_range_body_filter+0x54(afcb8, ffbfe9e8, b025c, afcb8, e, 45c4c)
ngx_http_output_filter+0x10(afcb8, ffbfe9e8, 3728, 3728, 0, 54f60)
ngx_http_static_handler+0x514(b0200, 0, b025c, afcb8, e, 80)
ngx_http_core_content_phase+0x3c(afcb8, b4078, 2, 1, 5, acb90)
ngx_http_core_run_phases+0x3c(afcb8, 28, a9350, a91d0, 0, 0)
ngx_http_handler+0x180(afcb8, a0, b5918, a0, 800000, b5918)
ngx_http_subrequest+0x3cc(acb90, 20000, 0, ffbfec34, b, 0)
ngx_http_ssi_include+0x528(acb90, ad870, 0, 0, e, 1)
ngx_http_ssi_body_filter+0x1758(acb90, adb85, ffbfed04, 80c90, ad870,
ad884)
ngx_output_chain+0xbf4(ada28, ada70, adc30, 80000000, 5ae20, ada70)
ngx_http_copy_filter+0xd4(acb90, ffbff048, ada28, 8000, 980a4, b5918)
ngx_http_range_body_filter+0x54(acb90, ffbff048, ad7a0, acb90, a, 45c4c)
ngx_http_output_filter+0x10(acb90, ffbff048, 0, 0, 0, 54f60)
ngx_http_static_handler+0x514(ad768, 0, ad7a0, acb90, a, 80)
ngx_http_core_content_phase+0x3c(acb90, b4078, 0, 1, 5, 8)
ngx_http_core_run_phases+0x3c(acb90, 28, a9350, a91d0, 0, 0)
ngx_http_handler+0x180(acb90, a0, b5918, a0, 800000, b5918)
ngx_http_internal_redirect+0x118(acb90, 20, a4c00, 60, 6b, a)
ngx_http_index_handler+0x590(acb90, b, ad6f2, ad700, a, 1)
ngx_http_core_content_phase+0x3c(acb90, b4060, 0, 1, 5, 8)
ngx_http_core_run_phases+0x3c(acb90, 20, a9350, a91d0, 0, 0)
ngx_http_handler+0x180(acb90, 0, b5918, 0, 0, 0)
ngx_http_process_request+0xa4(acb90, 3f400, 3f368, 0, d88e0, 3f000)
ngx_http_process_request_headers+0x5d8(2, a, acb90, 7e768, ad520,
ffbff570)
ngx_http_process_request_line+0x438(cb8d8, acbc8, acc34, acb90, b5918,

ngx_http_init_request+0x418(0, 42500, cb8d8, acb90, b5918, 95c00)
ngx_devpoll_process_events+0x32c(a4d54, a4c04, 40000000, a4c00,
10000000, 0)
ngx_process_events_and_timers+0xd0(a87a8, a4c00, ea60, 1, 19ba,
66ac47aa)
ngx_worker_process_cycle+0x674(a87a8, a4c00, a4b34, 7cd28, a4c2c, a4d7c)
ngx_spawn_process+0x41c(a87a8, 340f0, 0, 7cc50, fffffffe, 0)
ngx_start_worker_processes+0x90(a87a8, 9c800, fffffffe, a4c30, 1, 4)
ngx_master_process_cycle+0x1f8(a87a8, fffffffe, 1a, b411d, b4136, 20)
main+0x720(27, a4c00, 1, a4c00, a8f58, a87a8)
_start+0x5c(0, 0, 0, 0, 0, 0)

Hello!

On Tue, Nov 04, 2008 at 08:21:39PM +0100, Hannes Haug wrote:

a SSI bug in 0.7.19 but not in 0.6.32 results in “worker process NNNNN
exited on signal 10 (core dumped)”
if I have many include instructions in one file. 5 includes are ok, 6
not. See details below.

Could you please check if the following patch fixes this?

diff --git a/src/core/ngx_palloc.c b/src/core/ngx_palloc.c
— a/src/core/ngx_palloc.c
+++ b/src/core/ngx_palloc.c
@@ -171,6 +171,7 @@ ngx_palloc_block(ngx_pool_t *pool, size_
new->d.next = NULL;

 m += sizeof(ngx_pool_data_t);
  • m = ngx_align_ptr(m, NGX_ALIGNMENT);
    new->d.last = m + size;

    current = pool->current;

Maxim D.