Radius server crash due to 35# bug

[Liu Linyong]

Hello Alan,

I have a question. For V2-1-7, in hash.c, please refer to the follows, 

static int list_delete(fr_hash_table_t *ht,
		       fr_hash_entry_t **head, fr_hash_entry_t *node)
{
......
	for (cur = *head; cur != &ht->null; cur = cur->next) {
		if (cur == node) {    //  WHY NOT "if (cur->reversed == node->reversed)"  ???
			if (ht->cmp) { 
				int cmp = ht->cmp(node->data, cur->data);  // If cur == node, IS THIS NECESSARY?
				if (cmp > 0) break;
				if (cmp < 0) continue;
			}
.......
}


> Date: Thu, 08 Apr 2010 18:21:26 +0200 
> From: Alan DeKok <aland@???> 
> Subject: Re: Radius server crash due to 35# bug 
> To: FreeRadius developers mailing list 
>     <freeradius-devel@???> 
> Message-ID: <4BBE0286.50509@???> 
> Content-Type: text/plain; charset=ISO-8859-1 
> 
> Liu Linyong wrote: 
> > 4K requests/sec. 
> > start_servers = 5 and max_servers = 32. But totally 9 threads were created.(That is: 3 more threads were created after initializing) 
> > 
> > Oh, I've set max_requests = 102400 in radiusd.conf. 
> 
> Hmm... I've tested it with sustained 30K packets/s for ~12 hours, and 
> haven't seen an issue. 
> 
> This seems to be a hard problem to reproduce. 
> 
> Alan DeKok. 
>