jerenkrantz 2003/02/18 22:50:11
Modified: . CHANGES
modules/http http_protocol.c
Log:
Return 413 if chunk-ext-header is too long rather than reading from a truncated
line.
(Previously, we'd count the unread part of the line towards the chunk.)
PR: 15857
Revision Changes Path
1.1081 +3 -0 httpd-2.0/CHANGES
Index: CHANGES
===================================================================
RCS file: /home/cvs/httpd-2.0/CHANGES,v
retrieving revision 1.1080
retrieving revision 1.1081
diff -u -u -r1.1080 -r1.1081
--- CHANGES 19 Feb 2003 05:58:00 -0000 1.1080
+++ CHANGES 19 Feb 2003 06:50:10 -0000 1.1081
@@ -2,6 +2,9 @@
[Remove entries to the current 2.0 section below, when backported]
+ *) Return 413 if chunk-ext-header is too long rather than reading from
+ the truncated line. PR 15857. [Justin Erenkrantz]
+
*) If mod_mime_magic does not know the content-type, do not attempt to
guess. PR 16908. [Andrew Gapon <agapon@telcordia.com>]
1.465 +13 -2 httpd-2.0/modules/http/http_protocol.c
Index: http_protocol.c
===================================================================
RCS file: /home/cvs/httpd-2.0/modules/http/http_protocol.c,v
retrieving revision 1.464
retrieving revision 1.465
diff -u -u -r1.464 -r1.465
--- http_protocol.c 3 Feb 2003 17:53:04 -0000 1.464
+++ http_protocol.c 19 Feb 2003 06:50:10 -0000 1.465
@@ -897,6 +897,7 @@
char line[30];
apr_bucket_brigade *bb;
apr_size_t len = 30;
+ apr_off_t brigade_length;
bb = apr_brigade_create(f->r->pool, f->c->bucket_alloc);
@@ -904,9 +905,19 @@
APR_BLOCK_READ, 0);
if (rv == APR_SUCCESS) {
- rv = apr_brigade_flatten(bb, line, &len);
+ /* We have to check the length of the brigade we got back.
+ * We will not accept partial lines.
+ */
+ rv = apr_brigade_length(bb, 1, &brigade_length);
+ if (rv == APR_SUCCESS
+ && brigade_length > f->r->server->limit_req_line)
{
+ rv = APR_ENOSPC;
+ }
if (rv == APR_SUCCESS) {
- ctx->remaining = get_chunk_size(line);
+ rv = apr_brigade_flatten(bb, line, &len);
+ if (rv == APR_SUCCESS) {
+ ctx->remaining = get_chunk_size(line);
+ }
}
}
apr_brigade_cleanup(bb);
|