Re: pkg/43004: www/lighttpd segfaults in ssl3_finish_mac()

[Manuel Bouyer <bouyer%antioche.eu.org@localhost>]

The following reply was made to PR pkg/43004; it has been noted by GNATS.

From: Manuel Bouyer <bouyer%antioche.eu.org@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: pkg-manager%NetBSD.org@localhost, gnats-admin%NetBSD.org@localhost, 
pkgsrc-bugs%NetBSD.org@localhost
Subject: Re: pkg/43004: www/lighttpd segfaults in ssl3_finish_mac()
Date: Fri, 19 Mar 2010 18:22:50 +0100

 On Thu, Mar 18, 2010 at 06:10:00PM +0000, Andreas Gustafsson wrote:
 > >Description:
 > 
 > Using a lighttpd 1.4.26 web server freshly built from current pkgsrc
 > on NetBSD 5.0.2 (i386/xen) to serve https traffic, the lighttpd
 > process occasionally segfaults.  Here is a backtrace:
 > 
 >   Core was generated by `lighttpd'.
 >   Program terminated with signal 11, Segmentation fault.
 >   #0  0xbb7a5b9c in ssl3_finish_mac () from /usr/lib/libssl.so.6
 >   (gdb) where
 >   #0  0xbb7a5b9c in ssl3_finish_mac () from /usr/lib/libssl.so.6
 >   #1  0xbb7a23e6 in ssl3_do_write () from /usr/lib/libssl.so.6
 >   #2  0xbb792392 in ssl3_send_server_hello () from /usr/lib/libssl.so.6
 >   #3  0xbb794783 in ssl3_accept () from /usr/lib/libssl.so.6
 >   #4  0xbb7a9805 in SSL_accept () from /usr/lib/libssl.so.6
 >   #5  0xbb787bcb in ssl23_get_client_hello () from /usr/lib/libssl.so.6
 >   #6  0xbb788356 in ssl23_accept () from /usr/lib/libssl.so.6
 >   #7  0xbb78c0ef in ssl23_read () from /usr/lib/libssl.so.6
 >   #8  0xbb7a90e6 in SSL_read () from /usr/lib/libssl.so.6
 >   #9  0x08052669 in connection_handle_read_ssl (srv=0xbb401400, 
 > con=0xbb404c00) at connections.c:219
 >   #10 0x080528d6 in connection_handle_read (srv=0xbb401400, con=0xbb404c00) 
 > at connections.c:324
 >   #11 0x08053d33 in connection_handle_read_state (srv=0xbb401400, 
 > con=0xbb404c00) at connections.c:890
 >   #12 0x08054807 in connection_handle_fdevent (s=0xbb401400, 
 > context=0xbb404c00, revents=1) at connections.c:1228
 >   #13 0x080503bc in main (argc=3, argv=0xbf7fed84) at server.c:1446
 >   (gdb)
 
 I've seen similar backtrace from freeradius2. I fear the problem is in
 openssl itself :(
 
 -- 
 Manuel Bouyer <bouyer%antioche.eu.org@localhost>
      NetBSD: 26 ans d'experience feront toujours la difference
 --