Re: [BUGS] BUG #3902: Segmentation faults using GSSAPI authentication

From: Tom Lane <tgl(at)sss.pgh.pa.us>
Date: Tue Jan 29 2008 - 23:17:39 EST

"Peter Koczan" <pjkoczan@gmail.com> writes:
> Program received signal SIGSEGV, Segmentation fault.
> 0x0056bfde in getenv () from /lib/libc.so.6
> (gdb) bt
> #0 0x0056bfde in getenv () from /lib/libc.so.6
> #1 0x005c1490 in tzset_internal () from /lib/libc.so.6
> #2 0x005c1fad in tzset () from /lib/libc.so.6
> #3 0x005c6726 in strftime_l () from /lib/libc.so.6
> #4 0x0060b67f in __vsyslog_chk () from /lib/libc.so.6
> #5 0x0060bbaa in syslog () from /lib/libc.so.6
> #6 0x0830e3f9 in write_syslog ()
> #7 0x0830f7a8 in send_message_to_server_log ()
> #8 0x0830daf4 in EmitErrorReport ()
> #9 0x082450bd in PostgresMain ()
> #10 0x08210b9e in BackendRun ()
> #11 0x08210174 in BackendStartup ()
> #12 0x0820dc53 in ServerLoop ()
> #13 0x0820d631 in PostmasterMain ()
> #14 0x081b2ee7 in main ()

Hmm, crash inside getenv?? That's weird, that suggests something has clobbered the environment-strings data structure.

[ pokes around in code... ] And behold, here's a smoking gun: pg_GSS_recvauth() is doing a putenv() with a string that it got from palloc(). The active context at this point is PostmasterContext, which *is* going to go away soon, leaving a gaping hole in the environ list.

I still couldn't reproduce a crash with that knowledge, but I bet that if you apply the attached patch, things will get better.

                        regards, tom lane

Index: src/backend/libpq/auth.c

---

RCS file: /cvsroot/pgsql/src/backend/libpq/auth.c,v retrieving revision 1.162
diff -c -r1.162 auth.c

*** auth.c	1 Jan 2008 19:45:49 -0000	1.162
--- auth.c	30 Jan 2008 04:07:42 -0000

---

• 384,390 **** min_stat, lmin_s, gflags; - char *kt_path; int mtype; int ret; StringInfoData buf; --- 384,389 ----

  ---

• 398,408 ****
  • setenv("KRB5_KTNAME", pg_krb_server_keyfile, 0); except setenv()
  • not always available. */ ! if (!getenv("KRB5_KTNAME")) { ! kt_path = palloc(MAXPGPATH + 13); ! snprintf(kt_path, MAXPGPATH + 13, ! "KRB5_KTNAME=%s", pg_krb_server_keyfile); putenv(kt_path); } } --- 397,415 ----
  • setenv("KRB5_KTNAME", pg_krb_server_keyfile, 0); except setenv()
  • not always available. */ ! if (getenv("KRB5_KTNAME") == NULL) { ! size_t kt_len = strlen(pg_krb_server_keyfile) + 14; ! char *kt_path = malloc(kt_len); ! ! if (!kt_path) ! { ! ereport(LOG, ! (errcode(ERRCODE_OUT_OF_MEMORY), ! errmsg("out of memory"))); ! return STATUS_ERROR; ! } ! snprintf(kt_path, kt_len, "KRB5_KTNAME=%s", pg_krb_server_keyfile); putenv(kt_path); } }

    Do you need help?

    In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related postgresql.org Links pgsql-admin pgsql-advocacy pgsql-announce pgsql-bugs pgsql-cygwin pgsql-docs pgsql-general pgsql-interfaces pgsql-jdbc pgsql-jobs pgsql-novice pgsql-odbc pgsql-performance pgsql-php pgsql-ports pgsql-sql Request more information about Pantek

---------------------------(end of broadcast)---------------------------

TIP 5: don't forget to increase your free space map settings Received on Tue Jan 29 23:18:42 2008