Intermittent Segfault in Apache httpd due to apr_pool_t corruption

Issue

• The intermittent Segfault occurs in Apache httpd due to apr_pool_t corruption, the httpd coredump shows the following stack trace.

(gdb) bt
#0  apr_palloc (pool=pool@entry=0x7fd227fe4558, in_size=in_size@entry=13) at memory/unix/apr_pools.c:684
#1  0x00007fd226e138b6 in apr_pstrdup (a=0x7fd227fe4558, s=0x7fd16c062db0 "app3-psw-don") at strings/apr_strings.c:78
#2  0x00007fd21d1f069d in ap_proxy_determine_connection (p=p@entry=0x7fd174042af8, r=r@entry=0x7fd174042b70, 
    conf=conf@entry=0x7fd22a7ad618, worker=worker@entry=0x7fd229d3dd48, conn=0x7fd229d3dd48, uri=uri@entry=0x7fd16c062d30, 
    url=url@entry=0x7fd1f3fc69c0, proxyname=proxyname@entry=0x0, proxyport=proxyport@entry=0, 
    server_portstr=server_portstr@entry=0x7fd1f3fc6a60 "\340\060\303)\322\177", 
    server_portstr_size=server_portstr_size@entry=32) at proxy_util.c:2350
#3  0x00007fd21b9613d9 in proxy_http_handler (r=<optimized out>, worker=<optimized out>, conf=0x7fd22a7ad618, 
    url=0x7fd16c062c88 "http://xxxx-xxx-xxx:17180/xxxxxxxxx/xxx/xxxxxxxxxx/xxx-xxxxxxxx-xxxxxx.css", proxyname=0x0, 
    proxyport=0) at mod_proxy_http.c:1971
#4  0x00007fd21d1e6e34 in proxy_run_scheme_handler (r=r@entry=0x7fd174042b70, worker=0x7fd229d3dd48, 
    conf=conf@entry=0x7fd22a7ad618, 
    url=0x7fd16c062c88 "http://xxxx-xxx-xxx:17180/xxxxxxxxx/xxx/xxxxxxxxxx/xxx-xxxxxxxx-xxxxxx.css", 
    proxyhost=proxyhost@entry=0x0, proxyport=proxyport@entry=0) at mod_proxy.c:2746
#5  0x00007fd21d1e7d1d in proxy_handler (r=0x7fd174042b70) at mod_proxy.c:1125
#6  0x00007fd228185b50 in ap_run_handler (r=r@entry=0x7fd174042b70) at config.c:169
#7  0x00007fd228186099 in ap_invoke_handler (r=r@entry=0x7fd174042b70) at config.c:439
#8  0x00007fd22819acaa in ap_process_async_request (r=0x7fd174042b70) at http_request.c:339
#9  0x00007fd22819af92 in ap_process_request (r=r@entry=0x7fd174042b70) at http_request.c:374
#10 0x00007fd228197122 in ap_process_http_sync_connection (c=0x7fd2100a1f28) at http_core.c:190
#11 ap_process_http_connection (c=0x7fd2100a1f28) at http_core.c:231
#12 0x00007fd22818f180 in ap_run_process_connection (c=c@entry=0x7fd2100a1f28) at connection.c:41
#13 0x00007fd22818f568 in ap_process_connection (c=c@entry=0x7fd2100a1f28, csd=csd@entry=0x7fd2100a1d10) at connection.c:202
#14 0x00007fd21d40176b in process_socket (bucket_alloc=0x7fd16c05e228, my_thread_num=60, my_child_num=2, 
    sock=0x7fd2100a1d10, p=0x7fd2100a1c88, thd=0x7fd22ae42568) at worker.c:620
#15 worker_thread (thd=0x7fd22ae42568, dummy=<optimized out>) at worker.c:979
#16 0x00007fd226bebdc5 in start_thread () from ./lib64/libpthread.so.0
#17 0x00007fd22670a28d in clone () from ./lib64/libc.so.6