owasp-modsecurity / owasp-modsecurity/ModSecurity
Encountering SIGSEGV when parsing multiple rule sets in parallel
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
Hello!
I'm encountering an error when creating multiple rule sets and adding rules to each of them in a multi-threaded environment.
Logs and dumps
I've traced it back to yylex in yy::seclang_parser::parse():
#0 0x00007bb94eea02d8 in yylex(modsecurity::Parser::Driver&) ()
from /usr/lib/libmodsecurity.so.3
#1 0x00007bb94ee78c0e in yy::seclang_parser::parse() ()
from /usr/lib/libmodsecurity.so.3
#2 0x00007bb94eeba170 in modsecurity::Parser::Driver::parse(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) ()
from /usr/lib/libmodsecurity.so.3
#3 0x00007bb94eeba4a6 in modsecurity::Parser::Driver::parseFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) ()
from /usr/lib/libmodsecurity.so.3
#4 0x00007bb94eed0a17 in modsecurity::RulesSet::loadFromUri(char const*) ()
from /usr/lib/libmodsecurity.so.3
#5 0x00007bb94eed0b68 in msc_rules_add_file ()
from /usr/lib/libmodsecurity.so.3
...(omitted for brevity)
Is this a known issue? Is Rules meant to be initialized and filled only once and in a single-threaded context?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with modsecurity::RulesSet::loadFromUri and msc_rules_add_file, then trace the call path through Parser::Driver::parseFile, parse, and yylex. Reproduce parallel rule-set loading and establish whether these entry points are safe to use concurrently; done means the SIGSEGV cause and supported initialization behavior are identified and covered by an appropriate regression check.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100