http session in_pool pointer double free

tcp9 commented 6 years ago

daemon off;
master_process off;
error_log /dev/stdout info;
rtmp {
    timeout             60s;
    ping                60s;
    ping_timeout        30s;
    max_streams         32;
    chunk_size          4096;
    ack_window          5000000;
    max_message         10M;
    buflen              5s;
    sync                10ms;

    out_queue           2048;
    out_cork            8;
    idle_streams        off;
    interleave          on;
    server {
        listen 1936;
        service cctv {
            hostname direct-bi proto-all *.test.com;
            application cctv {
                live on;
            }
        }
    }
}
http {
    server {
        listen      8081;
        location / {
        }
    }
}
events{}

curl -v -o /dev/null "http://x.test.com:8081/cctv/unexist.flv"

访问一个不存在的flv后缀流名，会造成session的double free blame了下似乎是个很久之前的代码？ ngx_http_flv_cleanup -> ngx_http_flv_close_session_handler -> ngx_rtmp_fire_event(s, NGX_RTMP_DISCONNECT, NULL, NULL); 在此之后，还会做

 368     if (s->in_pool) {
 369         ngx_destroy_pool(s->in_pool);
 370     }

gnolizuh commented 6 years ago

我用你的配置和步骤尝试了，但无法重现

tcp9 commented 6 years ago

@gnolizuh 抱歉，没有告知nginx版本，我用的是openresty-1.13.6.1, 在这个版本下不兼容导致的吗？在此版本下

2018/05/10 18:41:49 [info] 11163#0: *1 http_flv handle uri: '/cctv/test1.flv' args: '', client: 127.0.0.1, server: , request: "GET /cctv/test1.flv HTTP/1.1", host: "x.test.com:8081"
2018/05/10 18:41:49 [info] 11163#0: *1 http_flv client connected '127.0.0.1', client: 127.0.0.1, server: , request: "GET /cctv/test1.flv HTTP/1.1", host: "x.test.com:8081"
2018/05/10 18:41:49 [info] 11163#0: *1 http_flv handle host: 'x.test.com' app: 'cctv' name: 'test1' args: '', client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:41:49 [info] 11163#0: *1 local connect: app='cctv' args='' flashver='' swf_url='' tc_url='http://x.test.com/cctv' page_url='' acodecs=0 vcodecs=0 object_encoding=0, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:41:49 [info] 11163#0: *1 local play: name='test1' args='' start=0 duration=0 reset=0 silent=0, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:41:49 [info] 11163#0: *1 http flv play: name='test1' start=0 duration=0 reset=0, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:41:49 [error] 11163#0: *1 http flv: stream not found, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:41:49 [info] 11163#0: *1 gop cache play: name='test1' start=0 duration=0 reset=0, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:41:49 [info] 11163#0: *1 http_flv close connection while closing request, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:41:49 [info] 11163#0: *1 http_flv close session while closing request, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:41:49 [info] 11163#0: *1 disconnect while closing request, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:41:49 [info] 11163#0: *1 deleteStream while closing request, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:41:49 [info] 11163#0: *1 disconnect while keepalive, client: 127.0.0.1
2018/05/10 18:41:49 [info] 11163#0: *1 deleteStream while keepalive, client: 127.0.0.1
*** Error in `./bin/openresty': double free or corruption (!prev): 0x00000000011778a0 ***

使用另一个openresty版本 openresty-1.11.2.5

2018/05/10 18:43:49 [info] 11459#0: *3 http_flv handle uri: '/cctv/test1.flv' args: '', client: 127.0.0.1, server: , request: "GET /cctv/test1.flv HTTP/1.1", host: "x.test.com:8081"
2018/05/10 18:43:49 [info] 11459#0: *3 http_flv client connected '127.0.0.1', client: 127.0.0.1, server: , request: "GET /cctv/test1.flv HTTP/1.1", host: "x.test.com:8081"
2018/05/10 18:43:49 [info] 11459#0: *3 http_flv handle host: 'x.test.com' app: 'cctv' name: 'test1' args: '', client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:43:49 [info] 11459#0: *3 local connect: app='cctv' args='' flashver='' swf_url='' tc_url='http://x.test.com/cctv' page_url='' acodecs=0 vcodecs=0 object_encoding=0, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:43:49 [info] 11459#0: *3 local play: name='test1' args='' start=0 duration=0 reset=0 silent=0, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:43:49 [info] 11459#0: *3 http flv play: name='test1' start=0 duration=0 reset=0, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:43:49 [error] 11459#0: *3 http flv: stream not found, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:43:49 [info] 11459#0: *3 gop cache play: name='test1' start=0 duration=0 reset=0, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:43:49 [info] 11459#0: *3 disconnect, client: 127.0.0.1, server: 0.0.0.0:1936
2018/05/10 18:43:49 [info] 11459#0: *3 deleteStream, client: 127.0.0.1, server: 0.0.0.0:1936

gnolizuh / BLSS

http session in_pool pointer double free #105