Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: <20160805091327.6D05E3A0046@svn01-us-west.apache.org>
References: <20160805091327.6D05E3A0046@svn01-us-west.apache.org>
From: Yann Ylavic <ylavic.dev@gmail.com>
Date: Fri, 5 Aug 2016 16:59:07 +0200
Message-ID: <CAKQ1sVMEtEWF-bFd4Z8dhWf_svPk5Qj8-ROd0A0jzG+amHb3Zg@mail.gmail.com>
Subject: Re: svn commit: r1755264 - /httpd/httpd/trunk/server/protocol.c
To: httpd-dev <dev@httpd.apache.org>
Content-Type: text/plain; charset=UTF-8
archived-at: Fri, 05 Aug 2016 14:59:14 -0000

On Fri, Aug 5, 2016 at 11:13 AM,  <wrowe@apache.org> wrote:
> Author: wrowe
> Date: Fri Aug  5 09:13:26 2016
> New Revision: 1755264
>
> URL: http://svn.apache.org/viewvc?rev=1755264&view=rev
> Log:
> Stop reflecting irrelevant data to the request error notes, particularly
> for abusive and malformed traffic the non-technical consumer of a user-agent
> has no control over.
>
> Simply take note where the administrator-configured limits have been exceeded,
> that administrator can find details in the error log if desired.
>
>
> Modified:
>     httpd/httpd/trunk/server/protocol.c
>
> Modified: httpd/httpd/trunk/server/protocol.c
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/server/protocol.c?rev=1755264&r1=1755263&r2=1755264&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/server/protocol.c (original)
> +++ httpd/httpd/trunk/server/protocol.c Fri Aug  5 09:13:26 2016
> @@ -808,23 +808,9 @@ AP_DECLARE(void) ap_get_mime_headers_cor
>               * exceeds the configured limit for a field size.
>               */
>              if (rv == APR_ENOSPC) {
> -                const char *field_escaped;
> -                if (field && len) {
> -                    /* ensure ap_escape_html will terminate correctly */
> -                    field[len - 1] = '\0';
> -                    field_escaped = ap_escape_html(r->pool, field);
> -                }
> -                else {
> -                    field_escaped = field = "";
> -                }

'field' can still be NULL here when rgetline returns NOSPC, hence
field_name_len(field) below segfaults.

That's I guess what Jim observes in t/apache/limits.t...