Some user wanted to modify the URL by hand and succeeded to crash the elogd process with npp=now
It appears that npp=0 crashes elogd with the following error message:

Program received signal SIGFPE, Arithmetic exception.
0x0808eba2 in show_elog_list (lbs=0xab3c770, past_n=0, last_n=0, page_n=1,
    default_page=1, info=0x0) at src/elogd.c:20214
20214            sprintf(str + strlen(str), loc("Page %d of %d"), page_n, (n_msg - 1) / n_page + 1);

I guess this bug is not OS dependent: you can crash every logbook that you can search ;-)

> [...] It appears that npp=0 crashes elogd [...]

Here's a patch: search for "npp" in src/elogd.c and add the following line:
  if (n_page<=0) n_page = 20;

Here's the diff output for version 2.9.0-2414
*** 20092,20096 ****
     if (isparam("npp"))
        n_page = atoi(getparam("npp"));
+    if (n_page<=0) n_page = 20;

     if (page_mid) {

A query to a logbook can crash the demon.

Query:
https://pc8059.psi.ch:444/SwissFEL+Injector/?jcmd=Find&m0a=10&d0a=27&y0a=2011&npp=1&reverse=0

gdb dump:
SSLServer listening on port 444 ...

Program received signal SIGSEGV, Segmentation fault.
show_elog_list (lbs=0xae72618, past_n=0, last_n=0, page_n=0, default_page=1, info=0x0) at src/elogd.c:20797
20797         message_id = msg_list[index].lbs->el_index[msg_list[index].index].message_id;

ELOG seems to enter a loop when you do certain opeations on certain messages: I moved a message to a different logbook and the deamon just gets stuck.

If I restart the daemon, the message was in fact moved: I can move it back to its original destination without problems.

I started in GDB and break with ctrl-C when the process gets stuck, to be told :

Program received signal SIGINT, Interrupt.
0x000000000040a968 in find_thread_head ()

I then made a core dump.

I put the files here: http://cern.ch/poulsen2/elog-error-report-110430.zip (they are too big to upload).

I get into the same problem in other circumstances such as when opening some threads (maybe because they contain "Reply-to" references to non-existing messages, but I have problems reproducing this on the test installation.

I should maybe also submit the incriminating thread.

Soren

 1. It appears that some times find_thread_head is called with message references that do not exist. That is not good.

I put in a little check like this  before seeing if the message has an "in_reply_to" reference:

The line:

if (lbs->el_index[i].in_reply_to)

becomes:

if (i < *lbs->n_el_index && lbs->el_index[i].in_reply_to)
 

2. The trouble started when I deleted a message in the middle of a thread, which left the thread badly "connected" (references to a deleted message).

3. Also, when a thread is badly connected, it is a problem moving messages to a different logbook. ELOG complains that it cannot access the message (with the invalid reference). But ELOG should ignore it, since the message was deleted.

Soren