Commit 8abdd37a authored by Yann Ylavic's avatar Yann Ylavic
Browse files

Merge r1688274 from trunk. 

http: Fix LimitRequestBody checks when there is no more bytes to read.

Submitted by: Michael Kaufmann <mail michael-kaufmann.ch>
Committed by: ylavic
Reviewed  by: ylavic, mrumph, wrowe


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1688935 13f79535-47bb-0310-9956-ffa450edef68
parent 0546a01f

CHANGES

+2 −0
Original line number Diff line number Diff line
@@ -2,6 +2,8 @@ 


Changes with Apache 2.4.16



  *) http: Fix LimitRequestBody checks when there is no more bytes to read.

     [Michael Kaufmann <mail michael-kaufmann.ch>]



Changes with Apache 2.4.15

STATUS

+0 −7
Original line number Diff line number Diff line
@@ -119,13 +119,6 @@ RELEASE SHOWSTOPPERS: 
     race to 3 +1's]

     [docs/manual .xml's require 'build all' regeneration]



  *) http: Fix LimitRequestBody checks when there is no more bytes to read.

     [Michael Kaufmann <mail michael-kaufmann.ch>]

     trunk patch: http://svn.apache.org/r1688274

     2.4.x patch: http://people.apache.org/~ylavic/httpd-2.4.x-fix_LimitRequestBody.patch

                  (modulo CHANGES, patch needed because of bail_out_on_error)

     +1: ylavic, mrumph, wrowe





PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]

modules/http/http_filters.c

+19 −16
Original line number Diff line number Diff line
@@ -321,7 +321,6 @@ apr_status_t ap_http_filter(ap_filter_t *f, apr_bucket_brigade *b, 
    apr_bucket *e;

    http_ctx_t *ctx = f->ctx;

    apr_status_t rv;

    apr_off_t totalread;

    int http_error = HTTP_REQUEST_ENTITY_TOO_LARGE;

    apr_bucket_brigade *bb;

    int again;
@@ -557,6 +556,7 @@ apr_status_t ap_http_filter(ap_filter_t *f, apr_bucket_brigade *b, 
                readbytes = ctx->remaining;

            }

            if (readbytes > 0) {

                apr_off_t totalread;



                rv = ap_get_brigade(f->next, b, mode, block, readbytes);
@@ -599,6 +599,24 @@ apr_status_t ap_http_filter(ap_filter_t *f, apr_bucket_brigade *b, 
                    }

                }



                /* We have a limit in effect. */

                if (ctx->limit) {

                    /* FIXME: Note that we might get slightly confused on

                     * chunked inputs as we'd need to compensate for the chunk

                     * lengths which may not really count.  This seems to be up

                     * for interpretation.

                     */

                    ctx->limit_used += totalread;

                    if (ctx->limit < ctx->limit_used) {

                        ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, f->r,

                                      APLOGNO(01591) "Read content length of "

                                      "%" APR_OFF_T_FMT " is larger than the "

                                      "configured limit of %" APR_OFF_T_FMT,

                                      ctx->limit_used, ctx->limit);

                        return bail_out_on_error(ctx, f,

                                                 HTTP_REQUEST_ENTITY_TOO_LARGE);

                    }

                }

            }



            /* If we have no more bytes remaining on a C-L request,
@@ -610,21 +628,6 @@ apr_status_t ap_http_filter(ap_filter_t *f, apr_bucket_brigade *b, 
                ctx->eos_sent = 1;

            }



            /* We have a limit in effect. */

            if (ctx->limit) {

                /* FIXME: Note that we might get slightly confused on chunked inputs

                 * as we'd need to compensate for the chunk lengths which may not

                 * really count.  This seems to be up for interpretation.  */

                ctx->limit_used += totalread;

                if (ctx->limit < ctx->limit_used) {

                    ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, f->r, APLOGNO(01591)

                                  "Read content-length of %" APR_OFF_T_FMT

                                  " is larger than the configured limit"

                                  " of %" APR_OFF_T_FMT, ctx->limit_used, ctx->limit);

                    return bail_out_on_error(ctx, f, HTTP_REQUEST_ENTITY_TOO_LARGE);

                }

            }



            break;

        }

        case BODY_CHUNK_TRAILER: {