"Daniel Stenberg" <daniel_at_haxx.se> wrote:

>> I'll take a look when I have the time (at the weekend?).
>
> Ouch. I have a very interesting way to max out the memory usage beyond unreal:
>
> curl scp://localhost:80/helllo
>
> With an ordinary apache http server running on port 80,
> libssh2_session_startup() gets stuck and initially it spent a lot of CPU but
> primarily it ate some 800MB of ram before I could break it.

Digging into libssh2, I found the same thing; libssh2_session_startup() calls
libssh2_banner_receive() (in session.c). This function never completes, but
gets stuck in the while-loop waiting for the banner. I'm sure the test-server
is running ssh (from what I can see from nmap).

The code:
  ret = recv(session->socket_fd, &c, 1, LIBSSH2_SOCKET_RECV_FLAGS(session));

  if (ret < 0) {
#ifdef WIN32
   switch (WSAGetLastError()) {
    case WSAEWOULDBLOCK:
     errno = EAGAIN;
     break;
    case WSAENOTSOCK:
     errno = EBADF;
     break;
    case WSAENOTCONN:
    case WSAECONNABORTED:
     errno = ENOTCONN;
     break;

The socket is non-blocking. Thus WSAGetLastError() returns WSAEWOULDBLOCK for
some time. Then recv() becomes blocking (!) . The curious thing is that it doesn't return
WSAENOTCONN after the socket enters CLOSE_WAIT. Even closing the socket from
tcpview (a netstat-like program) doesn't cause recv() to return...

I guess I should CC the libssh2 folks, but from what I hear they aren't listening (?)

--gv
Received on 2006-11-14