apache 1.3.28/modssl 2.8.15/openssl 0.9.6j crash on macos X

Hi All,

i've just stumbled over an annoying problem on macos X 10.2.6
I've recomplied from scratch
- openssl 0.9.6j
- modssl 2.8.15
- apache 1.3.28 ( using modssl own dbm implementation by specifyting the
--enable-rule=SSL_SDBM config flag ).


and i'm seeing random crashes of httpd when i access my webserver using
ssl ( for testing purposes i've used the default httpd.conf file ).
I managed to nail down the problem to the ssl session management routines.
To me more precise , here's what gdb says when the problem occurs :

Program received signal EXC_BAD_ACCESS, Could not access memory.
0x90074898 in memmove ()
(gdb) bt
#0 0x90074898 in memmove ()
#1 0x900745a0 in memmove ()
#2 0x00338050 in ssl_scache_retrieve ()
#3 0x00330ea8 in ssl_callback_GetSessionCacheEntry ()
#4 0x002fb260 in ssl_get_prev_session ()
#5 0x002eb004 in ssl3_get_client_hello ()
#6 0x002ea848 in ssl3_accept ()
#7 0x002f4520 in ssl23_get_client_hello ()
#8 0x002f3df8 in ssl23_accept ()
#9 0x0032e0a8 in ssl_hook_NewConnection ()
#10 0x00006b28 in new_connection ()
#11 0x0000806c in child_main ()
#12 0x000083e0 in make_child ()
#13 0x000088dc in perform_idle_server_maintenance ()
#14 0x00009158 in standalone_main ()
#15 0x00009a2c in main ()
#16 0x0000266c in _start ()
#17 0x000024ec in start ()

Right now the workaround is to disable SSL session management (
SSLSessionCache none instead of
SSLSessionCache dbm:/Users/cruault/apache/var/run/ssl_scache ).

Has anyone seen this ? Any known fix ?
Thanks for your help.

--
Charles-Edouard Ruault
Idtect SA
http://www.idtect.com
+33-1-42-81-81-84




____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org

Re: apache 1.3.28/modssl 2.8.15/openssl 0.9.6j crash on macos X

A couple of ideas - what happens if you don't ask for the internal
SDBM? If it works on your os, then MM should give better performance -
http://www.ossp.org/pkg/lib/mm/ Running make test should let you know
if it is a plausible way to go.

vh

Mads Toftum
--
Speaking at http://ApacheCon.com/
T03, "Apache 2 mod_ssl tutorial" (3h)
WE03, "Troubleshooting Apache configurations"
WE11, "Apache mod_rewrite, the Swiss Army Knife of URL manipulation"
____________________________________________________________ __________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List modssl-users@modssl.org
Automated List Manager majordomo@modssl.org