Commit 9a6f9bcf authored by Eric Covener's avatar Eric Covener
Browse files

Merge r1664205 from trunk: 

  *) SECURITY: CVE-2015-0253 (cve.mitre.org)
     core: Fix a crash introduced in with ErrorDocument 400 pointing
     to a local URL-path with the INCLUDES filter active, introduced
     in 2.4.11. PR 57531. [Yann Ylavic]


Submitted By: ylavic
Committed By: covener






git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1668879 13f79535-47bb-0310-9956-ffa450edef68
parent 101f701c

CHANGES

+5 −0
Changes for CHANGES: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -2,6 +2,11 @@ 


Changes with Apache 2.4.13



  *) SECURITY: CVE-2015-0253 (cve.mitre.org)

     core: Fix a crash introduced in with ErrorDocument 400 pointing

     to a local URL-path with the INCLUDES filter active, introduced

     in 2.4.11. PR 57531. [Yann Ylavic]



  *) SECURITY: CVE-2015-0228 (cve.mitre.org)

     mod_lua: A maliciously crafted websockets PING after a script

     calls r:wsupgrade() can cause a child process crash.

STATUS

+0 −10
Changes for STATUS: 0 added lines, 10 removed lines.
Original line number Diff line number Diff line
@@ -106,16 +106,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) SECURITY: CVE-2015-0253 (cve.mitre.org)

     core: Fix a crash introduced in with ErrorDocument 400 pointing

     to a local URL-path with the INCLUDES filter active, introduced

     in 2.4.11. PR 57531. [Yann Ylavic]

     trunk patch: http://svn.apache.org/r1664205

     2.4.x patch: trunk works

     +1 covener, jim, ylavic







PATCHES PROPOSED TO BACKPORT FROM TRUNK:

  [ New proposals should be added at the end of the list ]

server/protocol.c

+2 −2
Changes for server/protocol.c: 2 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -599,8 +599,6 @@ static int read_request_line(request_rec *r, apr_bucket_brigade *bb) 
             */

            if (APR_STATUS_IS_ENOSPC(rv)) {

                r->status    = HTTP_REQUEST_URI_TOO_LARGE;

                r->proto_num = HTTP_VERSION(1,0);

                r->protocol  = apr_pstrdup(r->pool, "HTTP/1.0");

            }

            else if (APR_STATUS_IS_TIMEUP(rv)) {

                r->status = HTTP_REQUEST_TIME_OUT;
@@ -608,6 +606,8 @@ static int read_request_line(request_rec *r, apr_bucket_brigade *bb) 
            else if (APR_STATUS_IS_EINVAL(rv)) {

                r->status = HTTP_BAD_REQUEST;

            }

            r->proto_num = HTTP_VERSION(1,0);

            r->protocol  = apr_pstrdup(r->pool, "HTTP/1.0");

            return 0;

        }

    } while ((len <= 0) && (++num_blank_lines < max_blank_lines));