Thread: Bug #924: Segmentation fault in libpq/PQconsumeInput on SSL connection

Sergey N. Yatskevich (syatskevich@n21lab.gosniias.msk.ru) reports a bug with a severity of 3
The lower the number the more severe it is.

Short Description
Segmentation fault in libpq/PQconsumeInput on SSL connection

Long Description
When I start SSL connection and try to handle async query:

// run query action handler
void
SqlDialog::sendQuery (const QString &_query) {
    PQsendQuery (m_conn, _query.utf8 ());
    connect(m_idle_timer, SIGNAL(timeout()), this, processQuery())
}

// run in idle loop
void
SqlDialog::processQuery () {
    // load data from server
    PQconsumeInput (conn);

    // if data not ready yet - return
    if (PQisBusy (conn))
        return;

    // process next query result when data completly loaded
    PQresult *res = PQgetResult (conn);
    if (res) {
        ...

        // wait next result
        return;
    }

    // all results handled
    disconnect(m_idle_timer, SIGNAL(timeout()), this, processQuery());
}

I get segmentation fault in PQconsumeInput. I run gdb
and found that pqsecure_read recursive call itself infinite on
SSL_ERROR_WANT_READ return code from libssl. I don't know why but
this code don't work well for me and cause Stack Overflow
(reported by OS (ALTLinux) as Segmentation Fault) error.

I solve this problem easy: instead recirsive call pqsecure_read
on SSL_ERROR_WANT_READ I simple return 0 as count of readed bytes.
    n = pqsecure_read (...)
replace with
    n = 0;
in pqsecure_read. I do that in pqsecure_write on SSL_ERROR_WANT_WRITE
also.

I check all places where pqsecure_* called and found that 0
handled currectly at all.

OS: ALTLinux - Sisyphus
Kernel: Linux-2.4.20
PostgreSQL: 7.3.2
Qt: 3.0.5, 3.1.2
libssl: 0.9.6i


Sample Code


No file was uploaded with this report

I believe this will be fixed in the upcoming 7.3.3 release.  Thanks for
the report.

---------------------------------------------------------------------------

pgsql-bugs@postgresql.org wrote:
> Sergey N. Yatskevich (syatskevich@n21lab.gosniias.msk.ru) reports a bug with a severity of 3
> The lower the number the more severe it is.
>
> Short Description
> Segmentation fault in libpq/PQconsumeInput on SSL connection
>
> Long Description
> When I start SSL connection and try to handle async query:
>
> // run query action handler
> void
> SqlDialog::sendQuery (const QString &_query) {
>     PQsendQuery (m_conn, _query.utf8 ());
>     connect(m_idle_timer, SIGNAL(timeout()), this, processQuery())
> }
>
> // run in idle loop
> void
> SqlDialog::processQuery () {
>     // load data from server
>     PQconsumeInput (conn);
>
>     // if data not ready yet - return
>     if (PQisBusy (conn))
>         return;
>
>     // process next query result when data completly loaded
>     PQresult *res = PQgetResult (conn);
>     if (res) {
>         ...
>
>         // wait next result
>         return;
>     }
>
>     // all results handled
>     disconnect(m_idle_timer, SIGNAL(timeout()), this, processQuery());
> }
>
> I get segmentation fault in PQconsumeInput. I run gdb
> and found that pqsecure_read recursive call itself infinite on
> SSL_ERROR_WANT_READ return code from libssl. I don't know why but
> this code don't work well for me and cause Stack Overflow
> (reported by OS (ALTLinux) as Segmentation Fault) error.
>
> I solve this problem easy: instead recirsive call pqsecure_read
> on SSL_ERROR_WANT_READ I simple return 0 as count of readed bytes.
>     n = pqsecure_read (...)
> replace with
>     n = 0;
> in pqsecure_read. I do that in pqsecure_write on SSL_ERROR_WANT_WRITE
> also.
>
> I check all places where pqsecure_* called and found that 0
> handled currectly at all.
>
> OS: ALTLinux - Sisyphus
> Kernel: Linux-2.4.20
> PostgreSQL: 7.3.2
> Qt: 3.0.5, 3.1.2
> libssl: 0.9.6i
>
>
> Sample Code
>
>
> No file was uploaded with this report
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 4: Don't 'kill -9' the postmaster
>

--
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 359-1001
  +  If your life is a hard drive,     |  13 Roberts Road
  +  Christ can be your backup.        |  Newtown Square, Pennsylvania 19073