Commit 4ab0b8cf authored by Jim Jagielski's avatar Jim Jagielski
Browse files

Merge r1666361 from trunk: 

Avoid a potential integer underflow in the lock timeout value sent back to a client. The answer to a LOCK request could be an extremly large integer if the time needed to lock the resource was longer that the requested timeout given in the LOCK request. In such a case, we now answer "Second-0".  PR55420
Submitted by: jailletc36
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1670319 13f79535-47bb-0310-9956-ffa450edef68
parent ac496aa3

CHANGES

+7 −0
Changes for CHANGES: 7 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -12,6 +12,13 @@ Changes with Apache 2.4.13 
     calls r:wsupgrade() can cause a child process crash. 

     [Edward Lu <Chaosed0 gmail.com>]



  *) mod_dav: Avoid a potential integer underflow in the lock timeout value sent

     back to a client. The answer to a LOCK request could be an extremly large

     integer if the time needed to lock the resource was longer that the

     requested timeout given in the LOCK request. In such a case, we now answer

     "Second-0".  PR55420

     [Christophe Jaillet]



  *) mod_cgid: Within the first minute of a server start or restart, 

     allow mod_cgid to retry connecting to its daemon process. Previously,

     'No such file or directory: unable to connect to cgi daemon...' could

STATUS

+2 −8
Changes for STATUS: 2 added lines, 8 removed lines.
Original line number Diff line number Diff line
@@ -106,11 +106,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) mod_dav: Avoid a potential integer underflow in the lock timeout value sent

     back to a client. PR 55420

     trunk patch: http://svn.apache.org/r1666361

     2.4.x patch: trunk works (modulo CHANGES)

     +1: jailletc36, ylavic, covener



  *) core: Add expression support to ErrorDocument. Switch from a fixed

     sized 664 byte array per merge to a hash table.
@@ -129,11 +124,10 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK: 
     trunk patch: http://svn.apache.org/r1609680

                  http://svn.apache.org/r1609688

                  http://svn.apache.org/r1641381

     2.4.x patch: http://people.apache.org/~ylavic/httpd-2.4.x-ap_proxy_define_match_worker.patch

     +1: ylavic

     -1: jim (does not cleanly apply)

     ylavic: Merge patch provided (reusing new->real to avoid double de_socketfy() call).

             Also added missing r1609688 to the patchset.

     2.4.x patch: http://people.apache.org/~ylavic/httpd-2.4.x-ap_proxy_define_match_worker.patch

     +1: ylavic



   * mod_buffer: Forward flushed input data immediately and avoid (unlikely)

                 access to freed memory.

modules/dav/main/util_lock.c

+10 −0
Changes for modules/dav/main/util_lock.c: 10 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -133,9 +133,19 @@ DAV_DECLARE(const char *) dav_lock_get_activelock(request_rec *r, 
        }

        else {

            time_t now = time(NULL);

            

            /*

            ** Check if the timeout is not, for any reason, already elapsed.

            ** (e.g., because of a large collection, or disk under heavy load...)

             */

            if (now >= lock->timeout) {

                dav_buffer_append(p, pbuf, "Second-0");

            }

            else {

                apr_snprintf(tmp, sizeof(tmp), "Second-%lu", (long unsigned int)(lock->timeout - now));

                dav_buffer_append(p, pbuf, tmp);

            }

        }



        dav_buffer_append(p, pbuf,

                          "</D:timeout>" DEBUG_CR