From: Robert Thau <rst@...>
Date: 2008-06-25T01:37:05+09:00
Subject: Re: Server crashes since ruby upgrade

Ken Dunlap wrote:
> I've built ruby 1.8.6-p230 due to vulnerabilities in older versions.
> Previously using 1.8.6-p110.  Built in a NetBSD 3.1 environment.
> I have a rails app using the rails 2.0.2.  This is running fine on
> the production server using ruby 1.8.6-p110, but the test server
> using 1.8.6-p230 crashes and dumps core with either a segmentation fault
> or an illegal hardware error, depending on the page I was trying to 
> load.


It's not just you.  There's been quite a bit of discussion on
the problem in another thread on this mailing list, following
up the original announcement; if you've already tossed those
messages and would like to look back, see here:

  http://www.ruby-forum.com/topic/157034

At this point, there's a patch available for the released
1.8.6-p230 here, which undoes one apparently problematic
change (and appears to be working for folks):

  http://dev.smartleaf.com/misc/p230_fixit_patch.txt

and also multiple patch sets which attempt to cherry-pick
the security fixes only for application to an earlier
release, including one from the mod_rails guys here:

  http://blog.phusion.nl/

which also (I believe) incorporates their storage
management hacks.  (FWIW, "p230_fixit_patch" is something
I made available, but the contents are the output of
"svn diff" on the problematic revision, pretty much
straight.)  See also discussion in comments on the
official rails blog, following up on their announcement:

  http://weblog.rubyonrails.com/2008/6/21/multiple-ruby-security-vulnerabilities

Robert Thau
rst AT {ai,alum}.mit.edu
-- 
Posted via http://www.ruby-forum.com/.