[Varnish] #498: Segfault with weird headers

[Varnish]

#498: Segfault with weird headers
--------------------+-------------------------------------------------------
 Reporter:  sky     |       Owner:       
     Type:  defect  |      Status:  new  
 Priority:  normal  |   Milestone:       
Component:  build   |     Version:  trunk
 Severity:  normal  |    Keywords:       
--------------------+-------------------------------------------------------
 {{{
 gdb) bt
 #0  0x00007f3e1ac83095 in raise () from /lib/libc.so.6
 #1  0x00007f3e1ac84af0 in abort () from /lib/libc.so.6
 #2  0x0000000000420e3e in pan_ic (func=0x44e85e "Tcheck", file=0x44e870
 "cache.h", line=647,
     cond=0x44e865 "(t.b) != 0", err=0, xxx=0) at cache_panic.c:317
 #3  0x000000000041ba49 in Tcheck (t={b = 0x0, e = 0x0}) at cache.h:647
 #4  0x000000000041bb00 in http_findhdr (hp=0x7f26c24d00b8, l=13,
 hdr=0x664f71 "Cache-Control:")
     at cache_http.c:155
 #5  0x000000000041bc6f in http_GetHdr (hp=0x7f26c24d00b8, hdr=0x664f71
 "Cache-Control:",
     ptr=0x7f158d546978) at cache_http.c:177
 #6  0x000000000041bd54 in http_GetHdrField (hp=0x7f26c24d00b8,
 hdr=0x664f70 "\016Cache-Control:",
     field=0x458722 "s-maxage", ptr=0x7f158d546a38) at cache_http.c:206
 #7  0x0000000000437fc8 in RFC2616_Ttl (sp=0x7f132e829008,
 hp=0x7f26c24d00b8, obj=0x7f26c24d0000)
     at rfc2616.c:95
 #8  0x000000000043845a in RFC2616_cache_policy (sp=0x7f132e829008,
 hp=0x7f26c24d00b8) at rfc2616.c:199
 #9  0x00000000004128de in cnt_fetch (sp=0x7f132e829008) at
 cache_center.c:409
 #10 0x000000000041480c in CNT_Session (sp=0x7f132e829008) at steps.h:41
 #11 0x00000000004226f9 in wrk_do_cnt_sess (w=0x7f158d54ec00,
 priv=0x7f132e829008) at cache_pool.c:398
 #12 0x0000000000422143 in wrk_thread (priv=0x7f3e1a90a2e0) at
 cache_pool.c:310
 #13 0x00007f3e1b4533f7 in start_thread () from /lib/libpthread.so.0
 #14 0x00007f3e1ad28b3d in clone () from /lib/libc.so.6
 #15 0x0000000000000000 in ?? ()
 (gdb) up
 #1  0x00007f3e1ac84af0 in abort () from /lib/libc.so.6
 (gdb) up
 #2  0x0000000000420e3e in pan_ic (func=0x44e85e "Tcheck", file=0x44e870
 "cache.h", line=647,
     cond=0x44e865 "(t.b) != 0", err=0, xxx=0) at cache_panic.c:317
 317                     abort();
 (gdb) up
 #3  0x000000000041ba49 in Tcheck (t={b = 0x0, e = 0x0}) at cache.h:647
 647             AN(t.b);
 (gdb) p t.b
 $1 = 0x0
 (gdb) p t.e
 $2 = 0x0
 (gdb) up
 #4  0x000000000041bb00 in http_findhdr (hp=0x7f26c24d00b8, l=13,
 hdr=0x664f71 "Cache-Control:")
     at cache_http.c:155
 155                     Tcheck(hp->hd[u]);
 (gdb) p u
 $3 = 7
 (gdb) p hp
 $4 = (const struct http *) 0x7f26c24d00b8
 (gdb) p hp->hd
 $5 = {{b = 0x0, e = 0x0}, {b = 0x0, e = 0x0}, {b = 0x7f26c24d0358
 "HTTP/1.1", e = 0x7f26c24d0360 ""}, {
     b = 0x7f26c24d0361 "301", e = 0x7f26c24d0364 ""}, {b = 0x7f26c24d0365
 "Moved Permanently",
     e = 0x7f26c24d0376 ""}, {b = 0x7f26c24d0377 "Date: Fri, 24 Apr 2009
 23:41:03 GMT",
     e = 0x7f26c24d039a ""}, {b = 0x7f26c24d039b "Server: Apache", e =
 0x7f26c24d03a9 ""}, {b = 0x0,
     e = 0x0}, {b = 0x7f26c24d03aa "Content-Type: text/html", e =
 0x7f26c24d03c1 ""}, {
     b = 0x7f26c24d03c2 "Content-Length: 0", e = 0x7f26c24d03d3 ""}, {b =
 0x0,
     e = 0x0} <repeats 22 times>}
 (gdb) p hp->hd[u]
 $6 = {b = 0x0, e = 0x0}

 }}}

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/498>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator