Hi,

We have apt-get install sogo from Debian Jessie, make some conf with LDAP + CAS, put into production and we see sogod process from the pool at high CPU usage. This happens many times per hour with 3500 potential users (but not much parallel requests seen in logs).

On those process, strace -p <pid> says : no syscalls.

gdbserver / ddd says : infinite loop in sope-2.2.9/sope-core/NGStreams/NGByteBuffer.m line 247, in a curiously named function la() with some "//TODO" in it, copyrighted from 2000 to 2005.

The infinite loop, with some ellipsis :

readStram=YES;
while (readStream) {
desiredBytes = 738;
cntReadBytes = self->readBytes(... ,desiredBytes) // readBytes always return 0
if (cntReadBytes == NGStreamError) {
break; // Never reached
} else {
if (cntReadBytes == desiredBytes)
readStream = NO; // Never reached
} else {
while (cntReadBytes > 0) {
// [...] // Never reached
}
}
}

Function readBytes(...) calls nearly directly GNUTLS :

(unsigned)readBytes:(void *)_buf count:(unsigned)_len {
// [...]
ret = gnutls_record_recv((gnutls_session_t) self->session, _buf, _len);
if (ret < 0)
return NGStreamError;
else
return ret;
}