sts-sponsors team mailing list archive

[Heather Lemon <1903733@xxxxxxxxxxxxxxxxxx>]

** Description changed:

  [Impact]
  Applications using package python-tornado v5.1.1 or earlier are susceptible to an out of memory error related to websockets.
  
  [Other Info]
  
  Upstream commit(s):
  https://github.com/tornadoweb/tornado/pull/2351/commits/20becca336caae61cd24f7afba0e177c0a210c70
  
  $ git remote -v
  origin	https://github.com/tornadoweb/tornado.git (fetch)
  origin	https://github.com/tornadoweb/tornado.git (push)
  
  $ git describe --contains 20becca3
  v5.1.0b1~28^2~1
  
  $ rmadison python3-tornardo
   => python3-tornado | 4.2.1-1ubuntu3      | xenial
   python3-tornado | 4.5.3-1             | bionic/universe
   => python3-tornado | 4.5.3-1ubuntu0.1    | bionic-updates/universe
   python3-tornado | 6.0.3+really5.1.1-3 | focal/universe
   python3-tornado | 6.0.4-2             | groovy/universe
   python3-tornado | 6.0.4-3             | hirsute/universe
   python3-tornado | 6.1.0-1             | hirsute-proposed/universe
  
  [Original Description]
  
  Tornado has no 'flow control' for websockets. A websocket will receive data as fast as it can, and store the data in a deque. If that data is not consumed as fast as it is written, then that deque will grow in size indefinitely, ultimately leading to a memory error and killing the process.
  Fix is to use a Queue. Read and get messages from the queue on the client side.
  
  Patch file [0]
  Commit history [1]
  GitHub [2]
  Issue [3]
  
  [0] https://patch-diff.githubusercontent.com/raw/tornadoweb/tornado/pull/2351.patch
  [1] https://github.com/tornadoweb/tornado/pull/2351/commits
  [2] https://github.com/tornadoweb/tornado
  [3] https://github.com/tornadoweb/tornado/issues/2341
  
  [Test Case]
  I was unable to provide adequate testing and/or a reproducer for this bug.
- In the bionic patch, the unit tests were failing and I have added another patch to address this 
+ In the bionic patch, the unit tests were failing and I have added another patch to address this in bionic only. 
  
-  d/p/0001-test-Skip-test_source_port_fail-when-running-as-root.patch
+  d/p/0001-test-Skip-test_source_port_fail-when-running-as-root.patch

-- 
You received this bug notification because you are a member of STS
Sponsors, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1903733

Title:
  Out of memory issue for websocket client

Status in python-tornado package in Ubuntu:
  Fix Released
Status in python-tornado source package in Xenial:
  In Progress
Status in python-tornado source package in Bionic:
  In Progress
Status in python-tornado source package in Focal:
  Fix Released
Status in python-tornado source package in Groovy:
  Fix Released
Status in python-tornado source package in Hirsute:
  Fix Released

Bug description:
  [Impact]
  Applications using package python-tornado v5.1.1 or earlier are susceptible to an out of memory error related to websockets.

  [Other Info]

  Upstream commit(s):
  https://github.com/tornadoweb/tornado/pull/2351/commits/20becca336caae61cd24f7afba0e177c0a210c70

  $ git remote -v
  origin	https://github.com/tornadoweb/tornado.git (fetch)
  origin	https://github.com/tornadoweb/tornado.git (push)

  $ git describe --contains 20becca3
  v5.1.0b1~28^2~1

  $ rmadison python3-tornardo
   => python3-tornado | 4.2.1-1ubuntu3      | xenial
   python3-tornado | 4.5.3-1             | bionic/universe
   => python3-tornado | 4.5.3-1ubuntu0.1    | bionic-updates/universe
   python3-tornado | 6.0.3+really5.1.1-3 | focal/universe
   python3-tornado | 6.0.4-2             | groovy/universe
   python3-tornado | 6.0.4-3             | hirsute/universe
   python3-tornado | 6.1.0-1             | hirsute-proposed/universe

  [Original Description]

  Tornado has no 'flow control' for websockets. A websocket will receive data as fast as it can, and store the data in a deque. If that data is not consumed as fast as it is written, then that deque will grow in size indefinitely, ultimately leading to a memory error and killing the process.
  Fix is to use a Queue. Read and get messages from the queue on the client side.

  Patch file [0]
  Commit history [1]
  GitHub [2]
  Issue [3]

  [0] https://patch-diff.githubusercontent.com/raw/tornadoweb/tornado/pull/2351.patch
  [1] https://github.com/tornadoweb/tornado/pull/2351/commits
  [2] https://github.com/tornadoweb/tornado
  [3] https://github.com/tornadoweb/tornado/issues/2341

  [Test Case]
  I was unable to provide adequate testing and/or a reproducer for this bug.
  In the bionic patch, the unit tests were failing and I have added another patch to address this in bionic only. 

   d/p/0001-test-Skip-test_source_port_fail-when-running-as-root.patch

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-tornado/+bug/1903733/+subscriptions