Commit 1f1375a2 authored by Eric Covener's avatar Eric Covener
Browse files

Merge r1657261 from trunk: 

  *) SECURITY: CVE-2015-0228 (cve.mitre.org)
     mod_lua: A maliciously crafted websockets PING after a script
     calls r:wsupgrade() can cause a child process crash.
     [Edward Lu <Chaosed0 gmail.com>]

Discovered by Guido Vranken <guidovranken gmail.com>

Submitted by: Edward Lu
Committed by: covener




git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1664118 13f79535-47bb-0310-9956-ffa450edef68
parent 1de0ca5c

CHANGES

+5 −0
Changes for CHANGES: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -2,6 +2,11 @@ 


Changes with Apache 2.4.13



  *) SECURITY: CVE-2015-0228 (cve.mitre.org)

     mod_lua: A maliciously crafted websockets PING after a script

     calls r:wsupgrade() can cause a child process crash. 

     [Edward Lu <Chaosed0 gmail.com>]



  *) mod_lua: After a r:wsupgrade(), mod_lua was not properly

     responding to a websockets PING but instead invoking the specified 

     script. PR57524. [Edward Lu <Chaosed0 gmail.com>]

STATUS

+0 −8
Changes for STATUS: 0 added lines, 8 removed lines.
Original line number Diff line number Diff line
@@ -106,14 +106,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) SECURITY: CVE-2015-0228 (cve.mitre.org)

     mod_lua: A maliciously crafted websockets PING after a script

     calls r:wsupgrade() can cause a child process crash.

     trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1657261

     2.4.x patch: trunk works

     Note: Technically CTR but it's a CVE.

     +1: covener, minfrin, ylavic





PATCHES PROPOSED TO BACKPORT FROM TRUNK:

  [ New proposals should be added at the end of the list ]

modules/lua/lua_request.c

+5 −1
Changes for modules/lua/lua_request.c: 5 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -2229,6 +2229,7 @@ static int lua_websocket_read(lua_State *L) 
{

    apr_socket_t *sock;

    apr_status_t rv;

    int do_read = 1;

    int n = 0;

    apr_size_t len = 1;

    apr_size_t plen = 0;
@@ -2246,6 +2247,8 @@ static int lua_websocket_read(lua_State *L) 
    mask_bytes = apr_pcalloc(r->pool, 4);

    sock = ap_get_conn_socket(r->connection);



    while (do_read) { 

    do_read = 0;

    /* Get opcode and FIN bit */

    if (plaintext) {

        rv = apr_socket_recv(sock, &byte, &len);
@@ -2379,7 +2382,8 @@ static int lua_websocket_read(lua_State *L) 
                frame[0] = 0x8A;

                frame[1] = 0;

                apr_socket_send(sock, frame, &plen); /* Pong! */

                lua_websocket_read(L); /* read the next frame instead */

                do_read = 1;

            }

        }

    }

    }