Bugs in pass.c of squid 1.1.4(3210?)?

Hi all.

since I haven't read anything in the mailing list about this and haven't found
mention of it on the Squid WWW page:

I seem to have found a bug or two in the pass.c file. I'm running squid on a
rather heaviliy loaded server. After upgrading to squid 1.1.4 (from squid
1.0.22) I noticed that, during times of heavy usage, the program crashed regu-
larly with the error message

Jan 20 15:11:00 proxy unix: squid[9490]: comm_remove_close_handler: Handler not
found!

Anaylzing a core file produced during one of the resultant crashes, I found
that in file pass.c, function passStart, if the comm_open() call failed, the
function comm_write is called with passState->client.fd as first argument.
However, passState->client.fd is only initialised AFTER successfull
comm_open(). Since passState->client.fd is set to fd from the argument list
of passStart, this seems to have fixed that problem:

*** pass.c.orig Mon Jan 20 16:42:51 MET 1997
--- pass.c Mon Jan 20 16:43:06 MET 1997
***************
*** 532,538 ****
            fd_table[fd].ipaddr,
            500,
            xstrerror());
! comm_write(passState->client.fd,
            xstrdup(msg),
            strlen(msg),
            30,
--- 532,538 ----
            fd_table[fd].ipaddr,
            500,
            xstrerror());
! comm_write(fd,
            xstrdup(msg),
            strlen(msg),
            30,

However, the problem still appears occasionally. A traceback from sdb now shows:

*t
 1, 1802ded4 _kill()
 2, 18023020 abort()
 3, 459514 fatal_dump(message="comm_remove_close_handler: Handler not found!\n") [tools.c:388]
 4, 412b18 comm_remove_close_handler(fd=0) [comm.c:1128]
 5, 43d618 passClose(passState=0) [pass.c:73]
 6, 43e4b4 passErrorComplete(fd=63,buf=(null)(invalid character pointer value 0),size=1058,errflag=0,passState=0) [pass.c:426]
 7, 40fb70 RWStateCallbackAndFree(fd=63,code=0) [comm.c:184]
 8, 4145f0 commHandleWrite(fd=63,state=0x1592fb0) [comm.c:1568]
 9, 412410 comm_select(sec=0) [comm.c:1042]
10, 4378f4 main(argc=2,argv=0x7fffeb7c) [main.c:720]
11, 401f04 _start()

It would seem, that in RWStateCallbackAndFree, the information for RWState
is bogus in some cases. I haven't found out yet, when this is the case. Maybe
someone else with more experience with squid knows and can tell me.
For now, I'm circumventing the problem by a check for passState != NULL in
passErrorComplete, but I don't know, what negative side effects this may
have.

Best Regards
Martin Boening
Internet Administration Paderborn

--
Martin Boening, MB3792            | boening.pad@sni.de
SNI AG, OEC OI 4, Heinz-Nixdorf-Ring 1, D-33106 Paderborn, Germany
Phone/FAX: +49 5251 8  15641/31070