Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 990240 - segfault in qpidd if client attempts to transactionally dequeue the same message twice
segfault in qpidd if client attempts to transactionally dequeue the same mess...
Status: CLOSED ERRATA
Product: Red Hat Enterprise MRG
Classification: Red Hat
Component: qpid-cpp (Show other bugs)
2.3
Unspecified Unspecified
high Severity unspecified
: 2.3.6
: ---
Assigned To: Gordon Sim
Leonid Zhaldybin
:
Depends On:
Blocks: 1026347 1048198
  Show dependency treegraph
 
Reported: 2013-07-30 12:05 EDT by Gordon Sim
Modified: 2014-11-09 17:39 EST (History)
5 users (show)

See Also:
Fixed In Version: qpid-cpp-0.18-18
Doc Type: Bug Fix
Doc Text:
Cause: In a transactional session, if a client accepts a message, the commits, then accepts the same message again, then commits again, the broker will crash Consequence: The broker will crash. Fix: The broker now ignores the extraneous accept. Result: The broker does not crash.
Story Points: ---
Clone Of:
: 1048198 (view as bug list)
Environment:
Last Closed: 2013-11-21 19:43:45 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
reproducer (1.04 KB, text/x-python)
2013-07-30 12:05 EDT, Gordon Sim
no flags Details


External Trackers
Tracker ID Priority Status Summary Last Updated
Apache JIRA QPID-5025 None None None Never
Red Hat Product Errata RHBA-2013:1755 normal SHIPPED_LIVE Red Hat Enterprise MRG Messaging 2.3.6 update 2013-11-21 21:41:16 EST

  None (edit)
Description Gordon Sim 2013-07-30 12:05:16 EDT
Created attachment 780732 [details]
reproducer

Description of problem:

On a transactional session, a client accepts a given message then commits, then issues another accept for the same message and commits again. This results in a segfault on the broker (though it is an invalid sequence of requests the broker clearly should not crash).

Version-Release number of selected component (if applicable):

2.3

How reproducible:

100%

Steps to Reproduce:
1. run attached python script (uses old client API to do steps as described above)

Actual results:

Broker crashes with segfault

Expected results:

No crash, broker simply ignores the extraneous accept
Additional info:
Comment 1 Gordon Sim 2013-07-30 12:54:14 EDT
Fixed upstream by https://svn.apache.org/r1508516 (which should port simply to 0.18 based tree as well)
Comment 2 Gordon Sim 2013-08-01 13:42:34 EDT
Patch backported to 0.18 and uploaded to https://issues.apache.org/jira/secure/attachment/12595451/QPID-5025-0.18.patch (a move of the curly bracket prevents patch applying the change from trunk cleanly)
Comment 5 Leonid Zhaldybin 2013-11-06 09:10:23 EST
Tested on RHEL5.9 and RHEL6.4 (both i386 and x86_64). The reproducer script was running in a loop for longer than 24 hours without triggering the issue. This seems to be fixed.

Packages used for testing:

RHEL5.9
python-qpid-0.18-5.el5_9
python-qpid-qmf-0.18-18.el5_9
qpid-cpp-client-0.18-18.el5_9
qpid-cpp-client-devel-0.18-18.el5_9
qpid-cpp-client-devel-docs-0.18-18.el5_9
qpid-cpp-client-ssl-0.18-18.el5_9
qpid-cpp-server-0.18-18.el5_9
qpid-cpp-server-cluster-0.18-18.el5_9
qpid-cpp-server-devel-0.18-18.el5_9
qpid-cpp-server-ssl-0.18-18.el5_9
qpid-cpp-server-store-0.18-18.el5_9
qpid-cpp-server-xml-0.18-18.el5_9
qpid-java-client-0.18-8.el5_9
qpid-java-common-0.18-8.el5_9
qpid-java-example-0.18-8.el5_9
qpid-jca-0.18-8.el5
qpid-jca-xarecovery-0.18-8.el5
qpid-qmf-0.18-18.el5_9
qpid-tools-0.18-10.el5_9

RHEL6.4
python-qpid-0.18-5.el6_4
python-qpid-qmf-0.18-18.el6_4
qpid-cpp-client-0.18-18.el6
qpid-cpp-client-devel-0.18-18.el6
qpid-cpp-client-devel-docs-0.18-18.el6
qpid-cpp-client-ssl-0.18-18.el6
qpid-cpp-server-0.18-18.el6
qpid-cpp-server-cluster-0.18-18.el6
qpid-cpp-server-devel-0.18-18.el6
qpid-cpp-server-ssl-0.18-18.el6
qpid-cpp-server-store-0.18-18.el6
qpid-cpp-server-xml-0.18-18.el6
qpid-java-client-0.18-8.el6_4
qpid-java-common-0.18-8.el6_4
qpid-java-example-0.18-8.el6_4
qpid-jca-0.18-8.el6
qpid-jca-xarecovery-0.18-8.el6
qpid-qmf-0.18-18.el6_4
qpid-tools-0.18-10.el6_4

-> VERIFIED
Comment 6 errata-xmlrpc 2013-11-21 19:43:45 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1755.html

Note You need to log in before you can comment on or make changes to this bug.