httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Alexei Kosut <ako...@leland.Stanford.EDU>
Subject Re: YA Apache DoS attack
Date Sat, 08 Aug 1998 00:07:41 GMT
On Fri, 7 Aug 1998, Jim Jagielski wrote:

> Ben Laurie wrote:
> > 
> > 
> > And here's a band-aid for 1.3.1 - I'm sure we'll come up with something better
> > soon. This (untested) patch should prevent the worst effects. A similar patch
> > should work for 1.2.x.
> 
> Even better would be to check the previous header with the present
> one and only increment if the same, since that's the only time this
> is a problem I think (could be wrong though).

Nope:

Header1: foo
Header2: bar
Header1: foo
Header2: bar
Header1: foo
Header2: bar
etc...

It strikes me that the 'best' way to handle this is to add a pfree, or
optimally a prealloc (since that may avoid even the copying that pstrcat
does). Of course, I'm well aware that the pool stuff is very unsuited to
this.

We could also give each table entry its own pool. Though that's probably a
worse idea.

Or we could use straight malloc/realloc/free for the tables, and register
cleanups for them. It would be a bit slower than taking memory straight
from the pool, but it's potentially much quicker when merging table
entries, and it obviously avoids the memory consumption problem we're
seeing here.

-- Alexei Kosut <akosut@stanford.edu> <http://www.stanford.edu/~akosut/>
   Stanford University, Class of 2001 * Apache <http://www.apache.org> *



Mime
View raw message