Commit 29433bf2 authored by Stefan Fritsch's avatar Stefan Fritsch
Browse files

If chunked encoding / content-length are corrupt, we may treat parts 

of one request's body as the next one's headers. To be safe, we should
disable keep-alive in this case.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1103223 13f79535-47bb-0310-9956-ffa450edef68
parent c249202a

modules/http/http_filters.c

+6 −0
Changes for modules/http/http_filters.c: 6 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -78,6 +78,7 @@ typedef struct http_filter_ctx { 
    apr_bucket_brigade *bb;

} http_ctx_t;



/* bail out if some error in the HTTP input filter happens */

static apr_status_t bail_out_on_error(http_ctx_t *ctx,

                                      ap_filter_t *f,

                                      int http_error)
@@ -93,6 +94,11 @@ static apr_status_t bail_out_on_error(http_ctx_t *ctx, 
    e = apr_bucket_eos_create(f->c->bucket_alloc);

    APR_BRIGADE_INSERT_TAIL(bb, e);

    ctx->eos_sent = 1;

    /* If chunked encoding / content-length are corrupt, we may treat parts

     * of this request's body as the next one's headers.

     * To be safe, disable keep-alive.

     */

    f->r->connection->keepalive = AP_CONN_CLOSE;

    return ap_pass_brigade(f->r->output_filters, bb);

}