332518 - Bugzilla crashes when the sslbase parameter points to an invalid host

Status: RESOLVED FIXED

(Bugzilla :: Administration, task)

Description

[victory <[e-mail]>]

step to reproduce:
 enter sslbase param https://example.orghttp:/
 submit


actual result: crash
Saving new parameters
Software error:

Bad arg length for Socket::pack_sockaddr_in, length is 0, should be 4 at /usr/lib/perl5/5.8.5/i386-linux-thread-multi/Socket.pm line 373.


expected result: show this error instead of crash.

Saving new parameters
New value for sslbase is invalid: must be a legal URL, that starts with https and ends with a slash.

Please hit Back and try again.

Comment 1

[victory <[e-mail]>]

Attachment: patch for tip v1

Comment 2

[Frédéric Buclin]

Comment on attachment 216982 [details] [diff] [review]
patch for tip v1

>+        if ($host =~ /:/) {
>+            return "must not contain ':' character. " .
>+           "Bugzilla supports only well-known port for https.";
>         }

The error message should eventually be updated, but we don't want such a hack. ;)

Comment 3

[Frédéric Buclin]

Not Wontfix. Denying review for a patch doesn't mean we shouldn't fix the bug.

Comment 5

[david m. chinn]

I entered 394415....

At present, a reasonable error message occurs when the following url is used:

    https://dev.hocprofessional.com:443/

and the error message is:

    the new value for sslbase is invalid: must not contain a port

The *crash* occurs when entering any of the following:

    http://dev.hocprofessional.com/
    https://dev.hocprofessional.com/
    https://example.comhttp:/

Although patch above ("if ($host =~ /:/) {") may fix the problem <victory> observed, it would *not* fix the problem that I saw.  

Note that the error messages *are* the same.

Comment 6

[david m. chinn]

ps... of course it should be noted that the first two urls in the last comment are completely valid.

Comment 7

[Frédéric Buclin]

Is fixed on 3.2 as part of bug 358588.