Defect #32563

Redmine 4 crashing with SEGFAULT under stress test when Markdown is used

Added by Martin Cizek almost 2 years ago. Updated about 1 month ago.

Status:ClosedStart date:
Priority:NormalDue date:
Assignee:-% Done:

0%

Category:Text formatting
Target version:-
Resolution:Wont fix Affected version:4.0.5

Description

Disclosure: my real motivation is to provide even more ammunition for #32424. But this issue is still valid and represents also a DOS and possibly other security vulnerability.

The Redcarpet-based wiki formatter is shared in Redmine, see source:trunk/lib/redmine/wiki_formatting/markdown/formatter.rb. I guess that with Rails 5 on Redmine 4, multithreaded operation became available by default. And when the app server supports multithreading, it just happens that Redmine is multithreaded (not a Rails expert). Redcarpet instance is not thread-safe - I've found this issue, opened for more than three years atm.

Steps to reproduce:
  • docker run redmine4 Note1
  • Configure markdown as rext formatting, create some larger wiki pages, create an API key
  • Run a stress test with parallel requests, we were using 12 workers invoking curl -sf -g -H "X-Redmine-API-Key: $api_key" -o "$o" "$url/$q"

1 Yes, it's using not recommended Webrick within rails server, still hope it's not an excuse for this behavior. :) Actually, we first came across this when creating a rake task for processing markup format conversions in parallel. But it happened also when we were doing rendering tests using standard Redmine stack, which is this issue.

Expected result: everything is rendering fine.

Actual result: ruby segfaults after a few hundred pages rendered.

ruby: markdown.c:2896: sd_markdown_render: Assertion `md->work_bufs[BUFFER_SPAN].size == 0' failed.
/usr/src/redmine/lib/redmine/wiki_formatting/markdown/formatter.rb:82: [BUG] Segmentation fault at 0x0000000000000000
ruby 2.6.5p114 (2019-10-01 revision 67812) [x86_64-linux]

Possible solutions:
  • Do not share Redcarpet formatter
  • Mutex it
  • Make it thread local
  • Document that multithreaded operation must be prevented when Markdown is used
  • Get rid of Redcarpet (yes, please! Plus #32424)

Related issues

Related to Redmine - Patch #32424: CommonMark Markdown Text Formatting New

History

#1 Updated by Go MAEDA almost 2 years ago

  • Related to Patch #32424: CommonMark Markdown Text Formatting added

#2 Updated by Marius BALTEANU about 1 month ago

  • Status changed from New to Closed
  • Resolution set to Wont fix

The current Markdown implementation based on RedCarpet is going to be dropped in the future versions and it will be replaced by the CommonMark Markdown (Github Flavoured) formatter that was just committed for 5.0.0.

Also available in: Atom PDF