Re: heap-use-after-free in object_ref_cleanup

2017-05-31 Thread Stefan Fuhrmann
On 29.05.2017 05:45, Orivej Desh wrote: * Stefan Fuhrmann [2017-05-28] The callstacks suggests that this is a pool cleanup race. Please try the attached patch and report the results. Thanks! With this patch subversion from trunk no longer crashes, and subversion 1.9.5 does not crash with an

Re: heap-use-after-free in object_ref_cleanup

2017-05-28 Thread Orivej Desh
* Stefan Fuhrmann [2017-05-28] > The callstacks suggests that this is a pool cleanup race. > Please try the attached patch and report the results. Thanks! With this patch subversion from trunk no longer crashes, and subversion 1.9.5 does not crash with an empty config, and crashes differently wi

Re: heap-use-after-free in object_ref_cleanup

2017-05-28 Thread Orivej Desh
* Daniel Shahaf [2017-05-23] > > The report says that the use-after-free occured inside the cleanup handler. > It > doesn't say where the accessed object was allocated or freed; to get that > info, > you'd have had to compile APR with pool debugging (--enable-pool-debug), then > the second and

Re: heap-use-after-free in object_ref_cleanup

2017-05-28 Thread Stefan Fuhrmann
On 23.05.2017 10:20, Orivej Desh wrote: Hello, I noticed in dmesg that in my repository svnserve occasionally crashes. This happens at exit, so it is not visible to end users. I captured a few sessions at the svn protocol level that resulted in a crash; client commands are quite different in ea

Re: heap-use-after-free in object_ref_cleanup

2017-05-23 Thread Daniel Shahaf
Orivej Desh wrote on Tue, 23 May 2017 08:20 +: > Hello, > > I noticed in dmesg that in my repository svnserve occasionally crashes. > This happens at exit, so it is not visible to end users. I captured a > few sessions at the svn protocol level that resulted in a crash; client > commands are

heap-use-after-free in object_ref_cleanup

2017-05-23 Thread Orivej Desh
Hello, I noticed in dmesg that in my repository svnserve occasionally crashes. This happens at exit, so it is not visible to end users. I captured a few sessions at the svn protocol level that resulted in a crash; client commands are quite different in each one; sending an input that crashed `svn