#565951 libc6 weird memory corruption error while using custom module in apache2-mpm-prefork

Package:
libc6
Source:
glibc
Description:
GNU C Library: Shared libraries
Submitter:
Radek Antoniuk
Date:
2010-01-21 16:33:06 UTC
Severity:
normal
#565951#5
Date:
2010-01-19 23:25:12 UTC
From:
To:
I am getting a segfault or segabort &  stacktrace in apache error logs while invoking custom module by apache2-mpm-prefork with php5.
    *** glibc detected *** /usr/sbin/apache2: malloc(): memory corruption: 0x0847b468 ***
    ======= Backtrace: =========
    /lib/libc.so.6[0xb7d9a845]
    /lib/libc.so.6[0xb7d9cde2]
    /lib/libc.so.6(__libc_malloc+0x96)[0xb7d9e586]
    /lib/libc.so.6[0xb7d8b4ff]
    /lib/libc.so.6(fopen+0x2c)[0xb7d8b5cc]
    /lib/libnss_files.so.2[0xb6d9aa80]
    /lib/libnss_files.so.2(_nss_files_getprotobyname_r+0x37)[0xb6d9b067]
    /lib/libc.so.6(getprotobyname_r+0xa2)[0xb7e12302]
    /lib/libc.so.6(getprotobyname+0x77)[0xb7e12197]
    /usr/lib/php5/20060613+lfs/mrl.dll(mlSndRcv+0x1e3)[0xb60f6d93]
    /usr/lib/php5/20060613+lfs/mrl.dll(__call_mrldll+0x556)[0xb60e4558]

It looks like it is triggered by getprotobyname or libnss...
Also, it is not easily reproducible, i.e. it happens occasionally, 4-5 times a day on a busy server.
Any ideas?
#565951#10
Date:
2010-01-20 19:17:20 UTC
From:
To:
It is most probably triggered by a higher level function. Where does
/usr/lib/php5/20060613+lfs/mrl.dll comes from?
#565951#17
Date:
2010-01-21 13:04:53 UTC
From:
To:

Hi,

The connection is of course triggered by that library, because it is its
function :)
It is an external provided library, but afaik the only thing that they don't
release is the protocol pointer.
And anyway, it looks like nss is triggerring that when  uhmm.. protocol is
wrong? that's ok why it shouldn't cause a malloc() error...
The thing is that this error is happening from time to time, 3-4 times a day
making it hard to reproduce..
#565951#22
Date:
2010-01-21 15:25:49 UTC
From:
To:
bts tag 565951 + wontfix
thanks

getprotobyname() is trying to allocate memory to return the value, but
it fails because the memory is corrupted. As this function works
perfectly when called from another program, the most probable reason is
that one of the caller is corrupting memory (writing outside of
allocated memory, calling free twice on the same area, etc.).

Anyway without any easy way to reproduce the problem and given it is
closed source software, this bug is a wontfix.