httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Greg Ames <ames.g...@gmail.com>
Subject Re: mod_deflate DoS using HEAD
Date Wed, 15 Jul 2009 18:25:53 GMT
On Tue, Jul 14, 2009 at 11:47 AM, "Plüm, Rüdiger, VF-Group" <
ruediger.pluem@vodafone.com> wrote:

>
> All very true. But how about the following patch. It should do no
> harm and should solve the issue in at least some cases (I think
> in most cases):
>
> Index: modules/filters/mod_deflate.c
>
> +        if (r->header_only && r->bytes_sent) {
> +            ap_remove_output_filter(f);
> +            return ap_pass_brigade(f->next, bb);
> +        }
>

+1

It doesn't break HTTP or caching, is simple, and any "extra" overhead (if
you want to call it that) is limited to one zlib buffer as you pointed out
later.

Greg

Mime
View raw message