passenger 5.0.17 → 5.0.18

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    YzJjYjMxNmJjNzhhMGY5MDI4YzFkODExOTJkMGYxYmRmMTM5ZjA3OA==
+    MjljNjEwOTUwNWI3MzI5MmZhMzY5MjczYmRmNjUyNTVlYjViMTQxOA==
   data.tar.gz: !binary |-
-    NzVmNTBhOWE3NjhkYTYwNGZiZmVkMWU5YzhmYjZkYjU2YjM3YzRlOA==
+    YzRhZGRkYjRmZWM5ZDM0ZmUyYzVmNDUxNmVmMzJmZmU3MTQxZmUxOQ==
 SHA512:
   metadata.gz: !binary |-
-    NjNlNGI1YmI1ZjMzMGVmOTRkMjRlMzY0ZTU1MmFlMTk2MjliZDJjMzVlMTg0
-    NjI3NmYxZTdlNTkxNGNiOTc5NmRjZmJjYzg4MTdhZjE3YTMxZmJkYWQzNDU3
-    NThjYzBlYTkxMWI4NWNmNzVhOWIwYjg1OGJlMzM1ZTU0NDYzMDM=
+    ZWRlMDc2MjYxMDY3ZjFhYjdlNmZjODY2N2U5MDViNTQ3OGE3YjUyZjFkZTli
+    ODI4NTE5MjVmZTE4ZWQ1ZWIxZmFiMjFmOWYwMDU1NWU2NzMxYzkxNWYzMGJj
+    ODM0NjczMjNiMzg0ZDc5NjVlZjczN2RiNzc3ODlkYmI4NTM4MTk=
   data.tar.gz: !binary |-
-    MDhiNGZiZWI1OGI4ZTkzZGVjNzBkYzgxYzEwYTFmZDA4MzA0YTZiNjk3MTZk
-    YjhhYWNhMmExNDVkZWQ2Y2NlYTE5MTRhZjIzZmU1MmVkNTY4ZjdkNmYzYjk3
-    OGMyMzM5Mzg0M2JiMDZiOWE2MGMwZjI2MGVlNTRhNTE3NjcxMWI=
+    NDJkNDc1MDRmMGM3NDJjNTUzN2NmMTYzOTAxZGRkMWY5ZWFmYjJmYTYxNmMx
+    OTU3YWE4ZjgxOGFjNjZmMGU2MTNlNjYwNTNjZGIwY2FjODc0M2VkYzY1ZjFh
+    YWEwYTBiMGViMTZkNWMyNmY1MmIyY2MwMDFiNzM5MzBhNGQ4NGM=

checksums.yaml.gz.asc

@@ -2,11 +2,11 @@
 Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
 Comment: GPGTools - http://gpgtools.org
 
-iQEcBAABAgAGBQJV7ioZAAoJECrHRaUKISqMzGMH/2hOLPNIte03VdFX8eYr6YhE
-OPz0UoX3GOnqd+cUdGHS/+Z54LN2r7GYGKu4jdMY/8OjOhTX3iylPlK0VtsPfKoR
-ne6IPl2S2msbwwATiveOl0v6fIOf/sg/ZO3uKpnuKN03AKB1ny8KAcw8WIlCFNff
-GTwUCY72eBo5GUgnl/CzCn589OTDtMsxckTM3x7OeJ1j8eSNYw1sRCtkeQmcR3Lv
-XX+vFGs3PV4+qry1ALwg3MjjX4jCtEMjOa8fvaTEqLLtPTwxYETXY2aVQraPVuM6
-I6/aDBOFqtBp/Lz3vpJ3+m3xSSHaNWM1PqxOm3ZiG4LbnJdjTUP+4wCy/g5KCKE=
-=FEca
+iQEcBAABAgAGBQJV8AsAAAoJECrHRaUKISqMT+QH/3p3202VncV1kRmFvpNQm7wk
+bZOLmhlArG0yAXxALXA3kQxRNrRx4KayZjOeYyLCW0B1u6TunuKwhYDMNayMh1ZA
+OhTfi3vd7yuZIswFc5o8Ll6Pe2dbeO6DOnB6N2B1oxfZP9PTSi4L1iOTsLrsmjHL
+tOW5DxKlTBuC6+6s7QPCXmUyhCjpjpJxHfGNLsQknqkZzLMCAlsfYQHA9eK5+VRl
+BgSwWjNVe//sEdFIwJ2TTPSnuls5L9bBFH9S+T0OSsvFBleWPAtFBDcZ1hABV9ho
+lnUD1su7Oa1oVfu7cN9jdVrP+4QtLeNs+bC40biELIygVPS9rR4/u3MjoX1V7r0=
+=tMMx
 -----END PGP SIGNATURE-----

data.tar.gz.asc

@@ -2,11 +2,11 @@
 Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
 Comment: GPGTools - http://gpgtools.org
 
-iQEcBAABAgAGBQJV7ioYAAoJECrHRaUKISqMfqUH/jjqWUz7G3w7odcWAPmc1awo
-XvOhFpJqTvwV6d1Cyr1gum7W3/LJ5qvfARGuZ6FcH11/rECTeg93wQmx8yHMwmTS
-TKEhFQPPpMWt192t2qcHlJ1ybmkNP9e/47A9ca8H/Gq+xCJmHUa9Im3dd5mqcT3L
-OmwnngZ7hv9xJ2fmtVgVAWL9LN7v5aIYJ9EcTmnQxQO7GCrqqGl72DPAxByfGItA
-OfjEZZdHd5uyrMVN0/I9XPsIFhH6Zx1iTDhuYnxETiNlqQS/EX0yhmrO5FeZiC7Z
-gvN33l70BDHEXPnDA6nP6pk2JdMXn2vBs7l3JtOLCO7mGKpiVrGpEZSspFe4YLI=
-=sW38
+iQEcBAABAgAGBQJV8Ar/AAoJECrHRaUKISqMFzgH/0ttxtkYKe5ixj9SSR+4wYel
+kz53Np2qA4U9HPYpLR8bT8ldt91e8xMJQ1xC/ZaWTQyXmGMrqdwO594N2sHc7Jsz
+cLvFRsVD+8tT1LYS4lomMQYUrBKGk0+/CtyPSZVTS9lLABAi5wJtWVYbA5B9z+gN
+TllnzGAPEvlA6UTiXpAbEetRsX5SJQAQyaBTYmKDGKSq1/nVLaq9xeSuGNzQJFso
+NqPqaU8MtrwuTvxBDCr3e61GEG0imU9GLyJu1HPQYwnF75oOySf4iLuSSve5EA1m
+aHcSEKwKf0mMlxYYdZ0RXMRsC5v4oWT9R7CC7mqFlJ6W9jSXZBJ+uof17Po15Do=
+=6U+j
 -----END PGP SIGNATURE-----

data/CHANGELOG

@@ -1,3 +1,10 @@
+Release 5.0.18
+--------------
+
+ * Fixes more memory corruption issues in the palloc subsystem.
+ * Fixes memory corruption issues in the Passenger core that may occur if the application sets many response headers. The issue was caused by an off-by-one bug.
+
+
 Release 5.0.17
 --------------
 

data/ext/common/Constants.h

@@ -120,7 +120,7 @@
 
 	#define PASSENGER_DEFAULT_USER "nobody"
 
-	#define PASSENGER_VERSION "5.0.17"
+	#define PASSENGER_VERSION "5.0.18"
 
 	#define POOL_HELPER_THREAD_STACK_SIZE 262144
 

data/ext/common/MemoryKit/palloc.cpp

@@ -132,7 +132,9 @@ psg_reset_pool(psg_pool_t *pool, size_t size)
 		psg_init_pool(pool, size);
 		return true;
 	} else {
+		pool->current = pool;
 		pool->large = NULL;
+
 		for (p = pool; p; p = p->data.next) {
 			char *m = (char *) p;
 			if (p == pool) {
@@ -145,6 +147,7 @@ psg_reset_pool(psg_pool_t *pool, size_t size)
 
 			p->data.failed = 0;
 		}
+
 		return false;
 	}
 }

data/ext/common/MemoryKit/palloc.h

@@ -78,7 +78,7 @@ typedef struct psg_pool_large_s {
 
 typedef struct {
 	char               *last;   /** Last allocated byte inside this block. */
-	char               *end;    /** End of block memory. */
+	char               *end;    /** End of block memory. Read-only */
 	psg_pool_t         *next;
 	unsigned int        failed;
 } psg_pool_data_t;
@@ -91,7 +91,7 @@ struct psg_pool_s {
 	 * not for any subsequent psg_pool_s objects linked through
 	 * `data.next`.
 	 */
-	size_t                max;
+	size_t                max;      /* Read-only */
 	psg_pool_t           *current;
 	psg_pool_large_t     *large;
 };

data/ext/common/agent/Core/RequestHandler/ForwardResponse.cpp

@@ -449,15 +449,19 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 	unsigned int & restrict_ref dataSize,
 	unsigned int & restrict_ref nCacheableBuffers)
 {
-	#define INC_BUFFER_ITER(i) \
+	#define BEGIN_PUSH_NEXT_BUFFER() \
 		do { \
-			if (buffers != NULL && i == maxbuffers) { \
+			if (buffers != NULL && i >= maxbuffers) { \
 				return false; \
 			} \
+		} while (false)
+	#define INC_BUFFER_ITER(i) \
+		do { \
 			i++; \
 		} while (false)
 	#define PUSH_STATIC_BUFFER(str) \
 		do { \
+			BEGIN_PUSH_NEXT_BUFFER(); \
 			if (buffers != NULL) { \
 				buffers[i].iov_base = (void *) str; \
 				buffers[i].iov_len  = sizeof(str) - 1; \
@@ -478,6 +482,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 	PUSH_STATIC_BUFFER("HTTP/");
 
 	if (buffers != NULL) {
+		BEGIN_PUSH_NEXT_BUFFER();
 		const unsigned int BUFSIZE = 16;
 		char *buf = (char *) psg_pnalloc(req->pool, BUFSIZE);
 		const char *end = buf + BUFSIZE;
@@ -504,7 +509,9 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 	statusAndReason = getStatusCodeAndReasonPhrase(resp->statusCode);
 	if (statusAndReason != NULL) {
 		size_t len = strlen(statusAndReason);
+		BEGIN_PUSH_NEXT_BUFFER();
 		if (buffers != NULL) {
+			BEGIN_PUSH_NEXT_BUFFER();
 			buffers[i].iov_base = (void *) statusAndReason;
 			buffers[i].iov_len  = len;
 		}
@@ -513,6 +520,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 
 		PUSH_STATIC_BUFFER("\r\nStatus: ");
 		if (buffers != NULL) {
+			BEGIN_PUSH_NEXT_BUFFER();
 			buffers[i].iov_base = (void *) statusAndReason;
 			buffers[i].iov_len  = len;
 		}
@@ -522,6 +530,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 		PUSH_STATIC_BUFFER("\r\n");
 	} else {
 		if (buffers != NULL) {
+			BEGIN_PUSH_NEXT_BUFFER();
 			const unsigned int BUFSIZE = 8;
 			char *buf = (char *) psg_pnalloc(req->pool, BUFSIZE);
 			const char *end = buf + BUFSIZE;
@@ -533,6 +542,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 			dataSize += size;
 
 			PUSH_STATIC_BUFFER(" Unknown Reason-Phrase\r\nStatus: ");
+			BEGIN_PUSH_NEXT_BUFFER();
 			buffers[i].iov_base = (void *) buf;
 			buffers[i].iov_len  = size;
 			INC_BUFFER_ITER(i);
@@ -563,6 +573,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 		part = it->header->origKey.start;
 		while (part != NULL) {
 			if (buffers != NULL) {
+				BEGIN_PUSH_NEXT_BUFFER();
 				buffers[i].iov_base = (void *) part->data;
 				buffers[i].iov_len  = part->size;
 			}
@@ -570,6 +581,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 			part = part->next;
 		}
 		if (buffers != NULL) {
+			BEGIN_PUSH_NEXT_BUFFER();
 			buffers[i].iov_base = (void *) ": ";
 			buffers[i].iov_len  = sizeof(": ") - 1;
 		}
@@ -578,6 +590,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 		part = it->header->val.start;
 		while (part != NULL) {
 			if (buffers != NULL) {
+				BEGIN_PUSH_NEXT_BUFFER();
 				buffers[i].iov_base = (void *) part->data;
 				buffers[i].iov_len  = part->size;
 			}
@@ -585,6 +598,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 			part = part->next;
 		}
 		if (buffers != NULL) {
+			BEGIN_PUSH_NEXT_BUFFER();
 			buffers[i].iov_base = (void *) "\r\n";
 			buffers[i].iov_len  = sizeof("\r\n") - 1;
 		}
@@ -598,6 +612,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 		unsigned int size;
 
 		if (buffers != NULL) {
+			BEGIN_PUSH_NEXT_BUFFER();
 			const unsigned int BUFSIZE = 60;
 			char *dateStr = (char *) psg_pnalloc(req->pool, BUFSIZE);
 			size = constructDateHeaderBuffersForResponse(dateStr, BUFSIZE);
@@ -622,6 +637,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 				PUSH_STATIC_BUFFER("\r\nSet-Cookie: ");
 			} else {
 				if (buffers != NULL) {
+					BEGIN_PUSH_NEXT_BUFFER();
 					buffers[i].iov_base = (void *) part->data;
 					buffers[i].iov_len  = part->size;
 				}
@@ -638,6 +654,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 	if (resp->bodyType == AppResponse::RBT_CONTENT_LENGTH) {
 		PUSH_STATIC_BUFFER("Content-Length: ");
 		if (buffers != NULL) {
+			BEGIN_PUSH_NEXT_BUFFER();
 			const unsigned int BUFSIZE = 16;
 			char *buf = (char *) psg_pnalloc(req->pool, BUFSIZE);
 			unsigned int size = integerToOtherBase<boost::uint64_t, 10>(
@@ -690,6 +707,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 		part = cookieName->start;
 		while (part != NULL) {
 			if (buffers != NULL) {
+				BEGIN_PUSH_NEXT_BUFFER();
 				buffers[i].iov_base = (void *) part->data;
 				buffers[i].iov_len  = part->size;
 			}
@@ -706,6 +724,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 		PUSH_STATIC_BUFFER("=");
 
 		if (buffers != NULL) {
+			BEGIN_PUSH_NEXT_BUFFER();
 			buffers[i].iov_base = stickySessionIdStr;
 			buffers[i].iov_len  = stickySessionIdSize;
 		}
@@ -715,6 +734,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 		PUSH_STATIC_BUFFER("; Path=");
 
 		if (buffers != NULL) {
+			BEGIN_PUSH_NEXT_BUFFER();
 			buffers[i].iov_base = (void *) baseURI.data();
 			buffers[i].iov_len  = baseURI.size();
 		}
@@ -741,6 +761,7 @@ constructHeaderBuffersForResponse(Request *req, struct iovec *buffers,
 	nbuffers = i;
 	return true;
 
+	#undef BEGIN_PUSH_NEXT_BUFFER
 	#undef INC_BUFFER_ITER
 	#undef PUSH_STATIC_BUFFER
 }

data/ext/common/agent/Core/RequestHandler/SendRequest.cpp

@@ -594,15 +594,19 @@ constructHeaderBuffersForHttpProtocol(Request *req, struct iovec *buffers,
 	unsigned int maxbuffers, unsigned int & restrict_ref nbuffers,
 	unsigned int & restrict_ref dataSize, HttpHeaderConstructionCache &cache)
 {
-	#define INC_BUFFER_ITER(i) \
+	#define BEGIN_PUSH_NEXT_BUFFER() \
 		do { \
-			if (buffers != NULL && i == maxbuffers) { \
+			if (buffers != NULL && i >= maxbuffers) { \
 				return false; \
 			} \
+		} while (false)
+	#define INC_BUFFER_ITER(i) \
+		do { \
 			i++; \
 		} while (false)
 	#define PUSH_STATIC_BUFFER(buf) \
 		do { \
+			BEGIN_PUSH_NEXT_BUFFER(); \
 			if (buffers != NULL) { \
 				buffers[i].iov_base = (void *) buf; \
 				buffers[i].iov_len  = sizeof(buf) - 1; \
@@ -626,6 +630,7 @@ constructHeaderBuffersForHttpProtocol(Request *req, struct iovec *buffers,
 	}
 
 	if (buffers != NULL) {
+		BEGIN_PUSH_NEXT_BUFFER();
 		buffers[i].iov_base = (void *) cache.methodStr.data();
 		buffers[i].iov_len  = cache.methodStr.size();
 	}
@@ -635,6 +640,7 @@ constructHeaderBuffersForHttpProtocol(Request *req, struct iovec *buffers,
 	PUSH_STATIC_BUFFER(" ");
 
 	if (buffers != NULL) {
+		BEGIN_PUSH_NEXT_BUFFER();
 		buffers[i].iov_base = (void *) req->path.start->data;
 		buffers[i].iov_len  = req->path.size;
 	}
@@ -658,6 +664,7 @@ constructHeaderBuffersForHttpProtocol(Request *req, struct iovec *buffers,
 				PUSH_STATIC_BUFFER("\r\nSet-Cookie: ");
 			} else {
 				if (buffers != NULL) {
+					BEGIN_PUSH_NEXT_BUFFER();
 					buffers[i].iov_base = (void *) part->data;
 					buffers[i].iov_len  = part->size;
 				}
@@ -682,6 +689,7 @@ constructHeaderBuffersForHttpProtocol(Request *req, struct iovec *buffers,
 		part = it->header->key.start;
 		while (part != NULL) {
 			if (buffers != NULL) {
+				BEGIN_PUSH_NEXT_BUFFER();
 				buffers[i].iov_base = (void *) part->data;
 				buffers[i].iov_len  = part->size;
 			}
@@ -695,6 +703,7 @@ constructHeaderBuffersForHttpProtocol(Request *req, struct iovec *buffers,
 		part = it->header->val.start;
 		while (part != NULL) {
 			if (buffers != NULL) {
+				BEGIN_PUSH_NEXT_BUFFER();
 				buffers[i].iov_base = (void *) part->data;
 				buffers[i].iov_len  = part->size;
 			}
@@ -718,6 +727,7 @@ constructHeaderBuffersForHttpProtocol(Request *req, struct iovec *buffers,
 		part = cache.remoteAddr->start;
 		while (part != NULL) {
 			if (buffers != NULL) {
+				BEGIN_PUSH_NEXT_BUFFER();
 				buffers[i].iov_base = (void *) part->data;
 				buffers[i].iov_len  = part->size;
 			}
@@ -733,6 +743,7 @@ constructHeaderBuffersForHttpProtocol(Request *req, struct iovec *buffers,
 		PUSH_STATIC_BUFFER("Passenger-Txn-Id: ");
 
 		if (buffers != NULL) {
+			BEGIN_PUSH_NEXT_BUFFER();
 			buffers[i].iov_base = (void *) req->options.transaction->getTxnId().data();
 			buffers[i].iov_len  = req->options.transaction->getTxnId().size();
 		}
@@ -747,6 +758,7 @@ constructHeaderBuffersForHttpProtocol(Request *req, struct iovec *buffers,
 	nbuffers = i;
 	return true;
 
+	#undef BEGIN_PUSH_NEXT_BUFFER
 	#undef INC_BUFFER_ITER
 	#undef PUSH_STATIC_BUFFER
 }
@@ -784,7 +796,8 @@ sendHeaderToAppWithHttpProtocolWithBuffering(Request *req, unsigned int offset,
 	unsigned int nbuffers, dataSize;
 	bool ok;
 
-	ok = constructHeaderBuffersForHttpProtocol(req, NULL, 0, nbuffers, dataSize, cache);
+	ok = constructHeaderBuffersForHttpProtocol(req, NULL, 0, nbuffers,
+		dataSize, cache);
 	assert(ok);
 
 	buffers = (struct iovec *) psg_palloc(req->pool,

data/lib/phusion_passenger.rb

@@ -30,7 +30,7 @@ module PhusionPassenger
 
   PACKAGE_NAME = 'passenger'
   # Run 'rake ext/common/Constants.h' after changing this number.
-  VERSION_STRING = '5.0.17'
+  VERSION_STRING = '5.0.18'
 
   PREFERRED_NGINX_VERSION = '1.8.0'
   NGINX_SHA256_CHECKSUM = '23cca1239990c818d8f6da118320c4979aadf5386deda691b1b7c2c96b9df3d5'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: passenger
 version: !ruby/object:Gem::Version
-  version: 5.0.17
+  version: 5.0.18
 platform: ruby
 authors:
 - Phusion - http://www.phusion.nl/
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-09-08 00:00:00.000000000 Z
+date: 2015-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake

metadata.gz.asc

@@ -2,11 +2,11 @@
 Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
 Comment: GPGTools - http://gpgtools.org
 
-iQEcBAABAgAGBQJV7ioYAAoJECrHRaUKISqMiEgH/0j/WQ+R1IvFOWDI7X8m8Wa0
-cBKEsW/zNGGLLC1zi86EM3r6BZIjmhaADvuq0CPALsVkBdNpKycxxLOe4quA9Brm
-a1QVgKmnhimThewopw0TGJTOiYmLdERR9NTeUpuRRkWytUKJem6MvDyNlW52bQwJ
-88QMLHow5Uu8JZoWEfxhX9nizNgESNus+takRHE85WY6G6F2YGMGx3w3eBSX/M2i
-3Ud6Z2D1X1AgdcsVvbHtsOoYap4+IsE/95Y6H3up9DakJN0PfPYn4hHAKoxzX1Ma
-+yESKP1UrNBPqrwc5j2eHUaPnKP+hgjcc/QEmOQs7QzeXYneIcOSzPo8j38Zgto=
-=7g/4
+iQEcBAABAgAGBQJV8Ar/AAoJECrHRaUKISqMhaIH+QHoT+Y0NMeWH32IxRbq4lN1
+cOXcDv32FyLZoKYYgsze2Z/ptOQOjhaYLM64Q3yFs+24CIWDrwA8W16TnxZLqiuY
+5DFmZISF4aHYNpcc0meXymCLIgMDm9c3XpPoXKg5nWEnoOyvFyFfUZKs0XBN9s5R
+d61QEV3tVzCKS4REfiKfb5hyMHApS7P47c6YUExqeRErKTHFJtCt7t5XBEbSVf+f
+FoomTf8NPRIpaXNx48RMacd2Qb45KsSv+WSc4DnsmKdeAgx83ccQIgEs5Igcrs85
+SfbBvfHpeKlTWrnRGqi+MG7xR2KQQQs1BFTS+lpCF2kFu6phP6wbJX8l7iAYicw=
+=0M6B
 -----END PGP SIGNATURE-----