Mailing List Archive

WWW Form Bug Report: "Core dump when using a DBM groupfile with a bad group line" on OTHER:DG/UX (fwd)
Ack sent to submitter.


this is a good bug-report. Now, if only everyone could provide information
like this :-)


Forwarded message:
> From nobody@hyperreal.com Wed Sep 20 10:32:29 1995
> Message-Id: <199509201732.KAA24424@taz.hyperreal.com>
> From: dkopper@dg.net
> To: apache-bugs%apache.org@organic.com
> Date: Wed Sep 20 10:32:27 1995
> Subject: WWW Form Bug Report: "Core dump when using a DBM groupfile with a bad group line" on OTHER:DG/UX
>
> Submitter: dkopper@dg.net
> Operating system: OTHER:DG/UX, version: 3.10
> Extra Modules used: mod_dbm_auth.c
> URL exhibiting problem:
>
> Symptoms:
> --
> Core dump of child process during the authentication of a user level request when using DBM user/group files with a bad group entry. My group entry was: Key: user Value: group dbx led me to get_dbm_grp and the second strchr. The first strchr returned a NULL, the second scanned starting at NULL. It probably shouldn't core dump... and I couldn't find the documentation on the format of the group entry for the DBM file. Changing my group entry to: Key: user Value :group: Let it work great...
> --
>
> Backtrace:
> --
> Frame 0, pc 0x8003acf4 (kill+12) Frame 1, pc 0x80033698 (abort+80) Frame 2, line 571, routine seg_fault(), file http_main.c Frame 3, pc 0x80057f30 (__sigacthandler2+64) Frame 4, pc 0x80042dfc (strchr+4) Frame 5, line 137, routine dbm_get_grp(r=0x00165cf4, user=0x00154ed4 -> "fred", auth_dbmgrpfile=0x00154d28 -> "/usr/opt/infosvr/html_docs/Orders/.groups"), file mod_auth_dbm.c Frame 6, line 206, routine dbm_check_auth(r=0x00165cf4), file mod_auth_dbm.c Frame 7, line 235, routine run_method(r=0x00165cf4, offset=48, run_all=0), file http_config.c Frame 8, line 275, routine check_auth(r=0x00165cf4), file http_config.c Frame 9, line 593, routine process_request_internal(r=0x00165cf4), file http_request.c Frame 10, line 616, routine process_request(r=0x00165cf4), file http_request.c Frame 11, line 816, routine child_main(child_num_arg=5), file http_main.c Frame 12, line 849, routine make_child(server_conf=0x00149ef0, child_num=5), file http_main.c Frame 13, line 965, routine stand!
> alone_main(argc=3, argv=0xeffffbf0), file http_main.c Frame 14, line 1011, routine main(argc=3, argv=0xeffffbf0), file http_main.c Frame 15, pc 0x1031bc (_start+416) (Lets hope thats right... OS/2 won't let me paste the DBX output...)
> --
>
Re: WWW Form Bug Report: "Core dump when using a DBM groupfile with a bad group line" on OTHER:DG/UX (fwd) [ In reply to ]
> > Submitter: dkopper@dg.net
> Summary:
>
> key=user value=group core dumps
> key=user value=:group works

I've replied to the submitter. Basically the DBM group patch was designed
to allow the group and password to reside in the same DBM (like what we
use on telescope.org). So the password DBM ignores everthing after the
first : and the group DBM ignores before the first : and everything after
the second :.

I really should have documented this with Brian's DBM password docs; I'll
write it up today.

I'll also submit a patch for 0.8.14. If no :'s exist in key then assume it
is simply value= group. This will not affect any existing installations;
the only side-effect being that value= group:anyother data will not be
allowed.

Regards,
Mark
Mark J Cox, mark@telescope.org -- URL:http://www.telescope.org/mark.html
University of Bradford, England ---------- tel +44.1274.384070/fax 391333