Bug 456810
| Summary: | Firefox crashes when resolving host name with many addresses | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Pete Zaitcev <zaitcev> | ||||
| Component: | glibc | Assignee: | Jakub Jelinek <jakub> | ||||
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | low | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | rawhide | CC: | drepper, wtc | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | glibc-2.8.90-10 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2008-07-31 19:48:01 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Pete Zaitcev
2008-07-27 15:43:57 UTC
I looked at the HTML code at that URL and found this: [zaitcev@niphredil ~]$ host body.imho.ru ;; Truncated, retrying in TCP mode. body.imho.ru has address 81.19.80.26 body.imho.ru has address 81.19.80.27 body.imho.ru has address 81.19.80.28 body.imho.ru has address 81.19.80.31 body.imho.ru has address 81.19.80.32 body.imho.ru has address 81.19.80.33 body.imho.ru has address 81.19.80.34 body.imho.ru has address 81.19.80.11 body.imho.ru has address 81.19.80.12 body.imho.ru has address 81.19.80.14 body.imho.ru has address 81.19.80.15 body.imho.ru has address 81.19.80.16 body.imho.ru has address 81.19.80.17 body.imho.ru has address 81.19.80.18 body.imho.ru has address 81.19.80.21 body.imho.ru has address 81.19.80.22 body.imho.ru has address 81.19.80.24 body.imho.ru has address 81.19.80.25 [zaitcev@niphredil ~]$ Maybe that explains why nss tries to move 48KB of data. This morning, the host(1) does not say ";; Truncated ..." anymore, and the browser does not crash (it still fails to work, reports incorrectly that "address not found"). But the number of printed A records is the same, 18. There must have been some garbage in the nameserver replies that made them bigger. If the problem is in getaddrinfo then you should be able to reproduce a crash with getent. At least the valgrind should show something. I've tried the URLs you showed. I do see the truncate message but I don't see a crash with getent nor does valgrind complain. I haven't tried firefox (yet) since my rawhide machine is practically headless. Also, it would help if you'd install the glibc debuginfo package. And Pete, if you can reproduce the crash, capture the DNS traffic. I.e., kill nscd, start wireshark to record port 53, and run firefox. Actually, I can now see a problem. I'm looking at it... Created attachment 312749 [details]
tcpdump -w ffox.dump -s 1600
Weirdness galore. Now that I have the glibc-debuginfo installed, I cannot get the crash backtrace. The Firefox just hangs (but it crashes again if run without debugger). I've checked in upstream a whole bunch of patches for the new resolver code. I have seen the problem with the listed host names although in the moment I cannot confirm it works since the results provided right now are short enough for UDP. Anyway, the main problem for this bug was that TCP replies weren't handled correctly. These are only needed if the reply is really large due to many addresses. I've tested it with my local DNS server and it seems to work nicely now. Jakub should be able to build a new glibc real soon. Please test it when available. Will test and close. Tested to work with glibc-2.8.90-10.x86_64. |