Attachment 429096 Details for Bug 690734

[patch] take LimitRequestFieldsize config option into account when parsing headers from backend.

fix-answer-header-trashing.diff (text/plain), 1.78 KB, created by Adrian Schröter on 2011-05-11 14:05:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Adrian Schröter

Created: 2011-05-11 14:05:22 UTC

Size: 1.78 KB

patch

obsolete

>--- server/util_script.c.orig	2011-05-11 11:37:43.818485000 +0000
>+++ server/util_script.c	2011-05-11 11:45:06.908276000 +0000
>@@ -406,6 +406,7 @@ AP_DECLARE(int) ap_scan_script_header_er
> {
>     char x[MAX_STRING_LEN];
>     char *w, *l;
>+    int wlen;
>     int p;
>     int cgi_status = HTTP_UNSET;
>     apr_table_t *merge;
>@@ -414,7 +415,13 @@ AP_DECLARE(int) ap_scan_script_header_er
>     if (buffer) {
>         *buffer = '\0';
>     }
>-    w = buffer ? buffer : x;
>+    if (r->server->limit_req_fieldsize + 2 > MAX_STRING_LEN) {
>+        w = apr_palloc(r->pool, r->server->limit_req_fieldsize + 2);
>+        wlen = r->server->limit_req_fieldsize + 2;
>+    } else {
>+        w = buffer ? buffer : x;
>+        wlen = MAX_STRING_LEN;
>+    }
> 
>     /* temporary place to hold headers to merge in later */
>     merge = apr_table_make(r->pool, 10);
>@@ -430,7 +437,7 @@ AP_DECLARE(int) ap_scan_script_header_er
> 
>     while (1) {
> 
>-        int rv = (*getsfunc) (w, MAX_STRING_LEN - 1, getsfunc_data);
>+        int rv = (*getsfunc) (w, wlen - 1, getsfunc_data);
>         if (rv == 0) {
>             ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_TOCLIENT, 0, r,
>                           "Premature end of script headers: %s",
>@@ -537,9 +544,12 @@ AP_DECLARE(int) ap_scan_script_header_er
> 
>             if (!buffer) {
>                 /* Soak up all the script output - may save an outright kill */
>-                while ((*getsfunc) (w, MAX_STRING_LEN - 1, getsfunc_data)) {
>+                while ((*getsfunc) (w, wlen - 1, getsfunc_data)) {
>                     continue;
>                 }
>+            } else if (w != buffer) {
>+                strncpy(buffer, w, MAX_STRING_LEN - 1);
>+                buffer[MAX_STRING_LEN - 1] = 0;
>             }
> 
>             ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_TOCLIENT, 0, r,

Actions: View | Diff

Attachments on bug 690734: 427187 | 427188 | 429096