Segmentation fault with nginx versions 1.9.12 and 1.10.0

[degtyaryov]

Hello.

Fedora 23 nginx-1.9.12 nginx-rtmp-module-1.1.7(git commit f62a083):
My config /etc/nginx/nginx-rtmp.conf:

user  nginx;                                                                                                                                                                                                                                                                  
worker_processes  2;                                                                                                                                                                                                                                                          

error_log  /var/log/nginx-rtmp/error.log;                                                                                                                                                                                                                                     

pid        /run/nginx-rtmp.pid;                                                                                                                                                                                                                                               


worker_rlimit_nofile 16384;                                                                                                                                                                                                                                                   

events {
    worker_connections  50000;
}

rtmp_auto_push on;
rtmp_auto_push_reconnect 1s;

rtmp {
    server {
        listen IPv4:1935;
        listen [IPv6]:1935;
        application live {
            live on;
        }
    }
}

# nginx -t -c /etc/nginx/nginx-rtmp.conf 
nginx: the configuration file /etc/nginx/nginx-rtmp.conf syntax is ok
nginx: configuration file /etc/nginx/nginx-rtmp.conf test is successful

nginx started, but segmentation fault when the client is connected:

# coredumpctl gdb 39633
Core was generated by `nginx: worker process                        '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  ngx_rtmp_auto_push_publish (s=0x55c26c738cd0, v=0x55c26b22ca40 <v>) at nginx-rtmp-module-1.1.7/ngx_rtmp_auto_push_module.c:477
477         ctx->push_evt.log = s->connection->log;
Missing separate debuginfos, use: dnf debuginfo-install bzip2-libs-1.0.6-19.fc23.x86_64 glibc-2.22-11.fc23.x86_64 krb5-libs-1.14.1-1.fc23.x86_64 libgcc-5.3.1-2.fc23.x86_64 libstdc++-5.3.1-2.fc23.x86_64 nss-softokn-freebl-3.22.2-1.0.fc23.x86_64 openssl-libs-1.0.2g-2.fc23.x86_64 sssd-client-1.13.3-5.fc23.x86_64
(gdb) backtrace
#0  ngx_rtmp_auto_push_publish (s=0x55c26c738cd0, v=0x55c26b22ca40 <v>) at nginx-rtmp-module-1.1.7/ngx_rtmp_auto_push_module.c:477
#1  0x000055c26af8ed5a in ngx_rtmp_amf_message_handler (s=0x55c26c738cd0, h=0x55c26c739d80, in=<optimized out>) at nginx-rtmp-module-1.1.7/ngx_rtmp_receive.c:437
#2  0x000055c26af8a679 in ngx_rtmp_receive_message (s=s@entry=0x55c26c738cd0, h=h@entry=0x55c26c739d80, in=in@entry=0x55c26c73ac80) at nginx-rtmp-module-1.1.7/ngx_rtmp_handler.c:799
#3  0x000055c26af8abc1 in ngx_rtmp_recv (rev=<optimized out>) at nginx-rtmp-module-1.1.7/ngx_rtmp_handler.c:464
#4  0x000055c26aee7a03 in ngx_event_process_posted (cycle=cycle@entry=0x55c26c71f310, posted=0x55c26b9362a0 <ngx_posted_events>) at src/event/ngx_event_posted.c:33
#5  0x000055c26aee74df in ngx_process_events_and_timers (cycle=cycle@entry=0x55c26c71f310) at src/event/ngx_event.c:259
#6  0x000055c26aeee6b5 in ngx_worker_process_cycle (cycle=cycle@entry=0x55c26c71f310, data=data@entry=0x1) at src/os/unix/ngx_process_cycle.c:753
#7  0x000055c26aeed03d in ngx_spawn_process (cycle=cycle@entry=0x55c26c71f310, proc=0x55c26aeee670 <ngx_worker_process_cycle>, data=0x1, name=0x55c26afc1bf2 "worker process", respawn=respawn@entry=1) at src/os/unix/ngx_process.c:198
#8  0x000055c26aeefd78 in ngx_reap_children (cycle=0x55c26c71f310) at src/os/unix/ngx_process_cycle.c:621
#9  ngx_master_process_cycle (cycle=0x55c26c71f310) at src/os/unix/ngx_process_cycle.c:174
#10 0x000055c26aec9916 in main (argc=<optimized out>, argv=<optimized out>) at src/core/nginx.c:367

Fedora 23 nginx-1.10.0 nginx-rtmp-module-1.1.7(git commit e089592):
My config /etc/nginx/nginx-rtmp.conf:

include /usr/share/nginx/modules/mod-rtmp.conf;

user  nginx;                                                                                                                                                                                                                                                                  
worker_processes  2;                                                                                                                                                                                                                                                          

error_log  /var/log/nginx-rtmp/error.log;                                                                                                                                                                                                                                     

pid        /run/nginx-rtmp.pid;                                                                                                                                                                                                                                               


worker_rlimit_nofile 16384;                                                                                                                                                                                                                                                   

events {
    worker_connections  50000;
}

rtmp_auto_push on;
rtmp_auto_push_reconnect 1s;

rtmp {
    server {
        listen IPv4:1935;
        listen [IPv6]:1935;
        application live {
            live on;
        }
    }
}

# nginx -t -c /etc/nginx/nginx-rtmp.conf 
Segmentation fault (core dumped)

# coredumpctl gdb 135821
Core was generated by `nginx -t -c /etc/nginx/nginx-rtmp.conf'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  ngx_rtmp_core_server (cf=0x7ffdc8e29d00, cmd=<optimized out>, conf=<optimized out>) at nginx-rtmp-module-e08959247dc840bb42cdf3389b1f5edb5686825f/ngx_rtmp_core_module.c:398
398         *cscfp = cscf;
Missing separate debuginfos, use: dnf debuginfo-install glibc-2.22-11.fc23.x86_64 krb5-libs-1.14.1-1.fc23.x86_64 libgcc-5.3.1-2.fc23.x86_64 libstdc++-5.3.1-2.fc23.x86_64 nss-softokn-freebl-3.22.2-1.0.fc23.x86_64 openssl-libs-1.0.2g-2.fc23.x86_64
(gdb) backtrace
#0  ngx_rtmp_core_server (cf=0x7ffdc8e29d00, cmd=<optimized out>, conf=<optimized out>) at nginx-rtmp-module-e08959247dc840bb42cdf3389b1f5edb5686825f/ngx_rtmp_core_module.c:398
#1  0x000055872d7adaf6 in ngx_conf_handler (last=1, cf=0x7ffdc8e29d00) at src/core/ngx_conf_file.c:427
#2  ngx_conf_parse (cf=cf@entry=0x7ffdc8e29d00, filename=filename@entry=0x0) at src/core/ngx_conf_file.c:283
#3  0x00007fd0d83ea70a in ngx_rtmp_block (cf=0x7ffdc8e29d00, cmd=<optimized out>, conf=<optimized out>) at nginx-rtmp-module-e08959247dc840bb42cdf3389b1f5edb5686825f/ngx_rtmp.c:202
#4  0x000055872d7adaf6 in ngx_conf_handler (last=1, cf=0x7ffdc8e29d00) at src/core/ngx_conf_file.c:427
#5  ngx_conf_parse (cf=cf@entry=0x7ffdc8e29d00, filename=filename@entry=0x55872dbb6b78) at src/core/ngx_conf_file.c:283
#6  0x000055872d7ab305 in ngx_init_cycle (old_cycle=0x7ffdc8e29ec0) at src/core/ngx_cycle.c:274
#7  0x000055872d79a82d in main (argc=<optimized out>, argv=<optimized out>) at src/core/nginx.c:276

Build:

./configure --prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/tmp/client_body --http-proxy-temp-path=/var/lib/nginx/tmp/proxy --http-fastcgi-temp-path=/var/lib/nginx/tmp/fastcgi --http-uwsgi-temp-path=/var/lib/nginx/tmp/uwsgi --http-scgi-temp-path=/var/lib/nginx/tmp/scgi --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx --user=nginx --group=nginx --with-file-aio --with-ipv6 --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_stub_status_module --with-http_perl_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-pcre --with-pcre-jit --with-stream=dynamic --with-stream_ssl_module --with-google_perftools_module --add-dynamic-module=nginx-rtmp-module-e08959247dc840bb42cdf3389b1f5edb5686825f --add-dynamic-module=nginx-upload-module-aba1e3f34c754551f4f49e572bc86863d535609d --add-dynamic-module=nginx-upload-progress-module-37182ce2f3b6721bc207c7ebd405c41c14de68ee --with-debug '--with-cc-opt=-O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic ' '--with-ld-opt=-Wl,-z,relro -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-E'
gcc version: 5.3.1 20160406 (Red Hat 5.3.1-6) (GCC)

[degtyaryov]

I recompiled nginx 1.10.0 with nginx-rtmp-module as static module. Now the same problem as nginx 1.9.12.

# nginx -v
nginx version: nginx/1.10.0

# nginx -t -c /etc/nginx/nginx-rtmp.conf 
nginx: the configuration file /etc/nginx/nginx-rtmp.conf syntax is ok
nginx: configuration file /etc/nginx/nginx-rtmp.conf test is successful

# coredumpctl gdb 88252
Core was generated by `nginx: worker process                        '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  ngx_rtmp_auto_push_publish (s=0x557f83a89cd0, v=0x557f82278b80 <v>) at nginx-rtmp-module-1.1.7/ngx_rtmp_auto_push_module.c:477
477         ctx->push_evt.log = s->connection->log;
Missing separate debuginfos, use: dnf debuginfo-install bzip2-libs-1.0.6-19.fc23.x86_64 glibc-2.22-11.fc23.x86_64 krb5-libs-1.14.1-1.fc23.x86_64 libgcc-5.3.1-2.fc23.x86_64 libstdc++-5.3.1-2.fc23.x86_64 nss-softokn-freebl-3.22.2-1.0.fc23.x86_64 openssl-libs-1.0.2g-2.fc23.x86_64 sssd-client-1.13.3-5.fc23.x86_64
(gdb) backtrace
#0  ngx_rtmp_auto_push_publish (s=0x557f83a89cd0, v=0x557f82278b80 <v>) at nginx-rtmp-module-1.1.7/ngx_rtmp_auto_push_module.c:477
#1  0x0000557f81fc9f7a in ngx_rtmp_amf_message_handler (s=0x557f83a89cd0, h=0x557f83a8ad80, in=<optimized out>) at nginx-rtmp-module-1.1.7/ngx_rtmp_receive.c:437
#2  0x0000557f81fc5899 in ngx_rtmp_receive_message (s=s@entry=0x557f83a89cd0, h=h@entry=0x557f83a8ad80, in=in@entry=0x557f83a8bc80) at nginx-rtmp-module-1.1.7/ngx_rtmp_handler.c:799
#3  0x0000557f81fc5de1 in ngx_rtmp_recv (rev=<optimized out>) at nginx-rtmp-module-1.1.7/ngx_rtmp_handler.c:464
#4  0x0000557f81f21293 in ngx_event_process_posted (cycle=cycle@entry=0x557f83a70310, posted=0x557f829823e0 <ngx_posted_events>) at src/event/ngx_event_posted.c:33
#5  0x0000557f81f20d6f in ngx_process_events_and_timers (cycle=cycle@entry=0x557f83a70310) at src/event/ngx_event.c:259
#6  0x0000557f81f28c25 in ngx_worker_process_cycle (cycle=cycle@entry=0x557f83a70310, data=data@entry=0x0) at src/os/unix/ngx_process_cycle.c:753
#7  0x0000557f81f275ad in ngx_spawn_process (cycle=cycle@entry=0x557f83a70310, proc=0x557f81f28be0 <ngx_worker_process_cycle>, data=0x0, name=0x557f81ffd0a2 "worker process", respawn=respawn@entry=0) at src/os/unix/ngx_process.c:198
#8  0x0000557f81f2a2e8 in ngx_reap_children (cycle=0x557f83a70310) at src/os/unix/ngx_process_cycle.c:621
#9  ngx_master_process_cycle (cycle=0x557f83a70310) at src/os/unix/ngx_process_cycle.c:174
#10 0x0000557f81f01add in main (argc=<optimized out>, argv=<optimized out>) at src/core/nginx.c:367

[RocFang]

See this for explanation:
sergey-dryabzhinsky#127