RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1364206 - crash in httpd mod_perl Perl_sv_pvn_force_flags
Summary: crash in httpd mod_perl Perl_sv_pvn_force_flags
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: perl
Version: 6.8
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: perl-maint-list
QA Contact: Martin Kyral
Lenka Špačková
URL:
Whiteboard:
Depends On:
Blocks: 1355984
TreeView+ depends on / blocked
 
Reported: 2016-08-04 17:47 UTC by Paulo Andrade
Modified: 2019-11-14 08:53 UTC (History)
6 users (show)

Fixed In Version: perl-5.10.1-143.el6
Doc Type: Release Note
Doc Text:
Perl interpreter no longer crashes when attempting to report Can't coerce HASH to string When running an *XML::LibXSLT* Perl script in a *mod_perl* environment, the Perl interpreter could terminate unexpectedly with a segmentation fault while it tried to report the `Can't coerce HASH to string` runtime error. The code printing the error message has been modified to handle missing script line details correctly, and the Perl interpreter no longer crashes in this scenario.
Clone Of:
Environment:
Last Closed: 2017-03-21 09:25:23 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
perl-5.10.1-sfdc01645410.patch (791 bytes, patch)
2016-08-04 17:47 UTC, Paulo Andrade 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0598 0 normal SHIPPED_LIVE perl bug fix update 2017-03-21 12:26:01 UTC

Description Paulo Andrade 2016-08-04 17:47:32 UTC 
Created attachment 1187599 [details]
perl-5.10.1-sfdc01645410.patch

Backtrace looks like this:

(gdb) bt
#0  0x00007fec821d3284 in Perl_sv_pvn_force_flags (my_perl=0x7fec8d802410, sv=0x7fec9399f350, lp=0x7fff6b6d54a8, flags=<value optimized out>)
    at sv.c:8062
#1  0x00007fec821c8641 in Perl_sv_vcatpvfn (my_perl=0x7fec8d802410, sv=0x7fec9399f350, pat=0x7fec813cd50d "%s:%d: ", patlen=7, 
    args=0x7fff6b6d55c0, svargs=0x0, svmax=0, maybe_tainted=0x0) at sv.c:8975
#2  0x00007fec7d7f5e39 in LibXSLT_error_handler_ctx (ctxt=0x7fec9399f350, msg=0x7fec813cd50d "%s:%d: ") at LibXSLT.xs:159
#3  0x00007fec812f4560 in xmlReportError (err=0x7fec95fe57a8, ctxt=0x7fec95fe5550, 
    str=0x7fec95ff2080 "xmlns: URI bnsrequest is not absolute\n", channel=0x7fec7d7f5d50 <LibXSLT_error_handler_ctx>, data=0x7fec9399f350)
    at error.c:290
#4  0x00007fec812f5c85 in __xmlRaiseError (schannel=0, channel=0x7fec812f50e0 <xmlParserWarning__internal_alias>, data=0x7fec95fe5550, 
    ctx=0x7fec95fe5550, nod=0x0, domain=3, code=100, level=XML_ERR_WARNING, file=0x7fec95fabcd0 "body.xml", line=10, 
    str1=0x7fec95fc7485 "bnsrequest", str2=0x0, str3=0x0, int1=0, col=33, msg=0x7fec813cf770 "xmlns: URI %s is not absolute\n")
    at error.c:626

  It was supposed to print "Can't coerce HASH to string at %s"
where %s would be 'OP_NAME(PL_op)' but PL_op (my_perl->Iop) is
null.

  User reports updating to packages from a perl build with the
attached patch corrects the problem.
Comment 2 Jitka Plesnikova 2016-08-10 13:17:45 UTC 
Could you please provide a reproducer that we can use for test?
Comment 3 Paulo Andrade 2016-08-10 17:19:01 UTC 
  Unfortunately I do not have a reproducer neither
could create one. I have only the coredump image
showing the crash condition.
Comment 4 Petr Pisar 2016-08-30 08:28:59 UTC 
It looks like mod_perl botches PL_op (Perl script line details) and that causes the segfault inside the perl. Recent perl has the same code in Perl_sv_pvn_force_flags() and I was not able to find any similar bug report against perl, mod_perl, or XML-LibXSLT, so it's possible the bug is still in the current upstream code. Unfortunately, without reproducer I cannot verify it.

The patch looks sane and it copies handling read-only SVs so I have no problem with applying it onto RHEL-6 perl to mitigate the crash.
Comment 8 Jitka Plesnikova 2016-09-09 11:57:40 UTC 
I was not able to reproduce the bug in our environment and tested the fix. However, the support provided perl with attached patch to the customer and it solved the issue for him.
Comment 14 errata-xmlrpc 2017-03-21 09:25:23 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2017-0598.html
Note You need to log in before you can comment on or make changes to this bug.