Odtnhj

I have Python code like the following embedded in mod_wsgi / Python 2.7 inside an Apache httpd 2.4 server on Windows. It sometimes raises a WindowsError: [Error 998] Invalid access to memory location. from the CreateProcess call. It happens very infrequently, just around every 1-5 days. 32-Bit process, but also happens with a different error (Access Violation) in 64-Bit.

I checked that pywin32 properly sets a modifiable lpCmdLine argument.
I also tried to do the same via ctypes but had the same problems.
The Apache httpd runs inside a job and a valid desktop name is given.

import os
import win32con
import win32process
import win32api
import subprocess

def launch_sub_process(environ, args, desktop_name, tmp_file):
 myenv = os.environ.copy()
 myenv["PYTHONOPTIMIZE"] = "2"

 # The reason we cannot use subprocess..., it does not allow setting
 # lpDesktop in STARTUPINFO
 startupinfo = win32process.STARTUPINFO()
 startupinfo.lpDesktop = desktop_name

 # CREATE_BREAKAWAY_FROM_JOB = 0x01000000 isn't defined in our
 # pywin32 version.
 createflags = (
 win32con.DETACHED_PROCESS |
 0x01000000 |
 win32con.CREATE_UNICODE_ENVIRONMENT)

 cmdline = subprocess.list2cmdline(args)

 # pywin32 special, if we pass CREATE_UNICODE_ENVIRONMENT
 # we must convert env to unicode ourselfs too, why?
 myenv = unicode(k): unicode(v) for k, v in myenv.items()

 p_handle, th, worker_pid, _ = win32process.CreateProcess(
 None, # appName
 cmdline, # cmdLine
 None, # processAttributes
 None, # threadAttributes
 False, # inherit handles
 createflags, # creation flags
 myenv, # environ
 None, # current directory
 startupinfo # pystartupinfo
 )
 win32api.CloseHandle(th)

 # Wait for the process to start
 child_infos = wait_for_process(tmp_file,
 p_handle,
 worker_pid)

 return child_infos["port"], worker_pid

The only traceback i managed to capture was from inside the Windows API. It looks like a classical overflow that trashed the return address.

The stored exception information can be accessed via .ecxr.
(c8c.9c8): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=01b6bac1 edx=00000053 esi=00000000 edi=01b6c308
eip=75b4360d esp=01b6bf64 ebp=01b6c500 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
KERNELBASE!NtWow64CsrBasepCreateProcess+0xc:
75b4360d c20400 ret 4

0:002> kb
# ChildEBP RetAddr Args to Child 
00 01b6bf60 75b4320f 01b6c308 0a2ad7c4 016ec340 KERNELBASE!NtWow64CsrBasepCreateProcess+0xc
01 01b6c500 75b424dc 00000000 00000000 18092780 KERNELBASE!CreateProcessInternalW+0xcf6

This looks like it happend just after the process creation is done and only the communication with the CSRSS.exe process needs to complete.

Does anyone have a hint what limits might be hit or how to fix this?