Commit c9e943d6 authored by Jim Jagielski's avatar Jim Jagielski
Browse files

*) mod_proxy: Prevent segmentation faults by correctly adjusting the lifetime 

     of the buckets read from the proxy backend. PR 45792 [Ruediger Pluem]



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@713146 13f79535-47bb-0310-9956-ffa450edef68
parent d7b7d160

CHANGES

+3 −0
Changes for CHANGES: 3 added lines, 0 removed lines.
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.2.11



  *) mod_proxy: Prevent segmentation faults by correctly adjusting the lifetime

     of the buckets read from the proxy backend. PR 45792 [Ruediger Pluem]



  *) mod_proxy_ajp: Fix wrongly formatted requests where client

     sets Content-Length header, but doesn't provide a body.

     Servlet container always expects that next packet is

include/ap_mmn.h

+2 −1
Changes for include/ap_mmn.h: 2 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -133,6 +133,7 @@ 
 * 20051115.17 (2.2.10) Add scolonsep to proxy_balancer

 * 20051115.18 (2.2.10) Add chroot support to unixd_config

 * 20051115.19 (2.2.11) Added ap_timeout_parameter_parse to util.c / httpd.h

 * 20051115.20 (2.2.11) Add ap_proxy_buckets_lifetime_transform to mod_proxy.h

 */



#define MODULE_MAGIC_COOKIE 0x41503232UL /* "AP22" */
@@ -140,7 +141,7 @@ 
#ifndef MODULE_MAGIC_NUMBER_MAJOR

#define MODULE_MAGIC_NUMBER_MAJOR 20051115

#endif

#define MODULE_MAGIC_NUMBER_MINOR 19                    /* 0...n */

#define MODULE_MAGIC_NUMBER_MINOR 20                    /* 0...n */



/**

 * Determine if the server's current MODULE_MAGIC_NUMBER is at least a

modules/proxy/mod_proxy.h

+23 −0
Changes for modules/proxy/mod_proxy.h: 23 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -750,6 +750,29 @@ PROXY_DECLARE(void) ap_proxy_backend_broke(request_rec *r, 
#define PROXY_HAS_SCOREBOARD 0

#endif



/**

 * Transform buckets from one bucket allocator to another one by creating a

 * transient bucket for each data bucket and let it use the data read from

 * the old bucket. Metabuckets are transformed by just recreating them.

 * Attention: Currently only the following bucket types are handled:

 *

 * All data buckets

 * FLUSH

 * EOS

 *

 * If an other bucket type is found its type is logged as a debug message

 * and APR_EGENERAL is returned.

 * @param r    current request record of client request. Only used for logging

 *             purposes

 * @param from the brigade that contains the buckets to transform

 * @param to   the brigade that will receive the transformed buckets

 * @return     APR_SUCCESS if all buckets could be transformed APR_EGENERAL

 *             otherwise

 */

PROXY_DECLARE(apr_status_t)

ap_proxy_buckets_lifetime_transform(request_rec *r, apr_bucket_brigade *from,

                                        apr_bucket_brigade *to);



#define PROXY_LBMETHOD "proxylbmethod"



/* The number of dynamic workers that can be added when reconfiguring.

modules/proxy/mod_proxy_ftp.c

+0 −1
Changes for modules/proxy/mod_proxy_ftp.c: 0 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -969,7 +969,6 @@ static int proxy_ftp_handler(request_rec *r, proxy_worker *worker, 
        }

        /* TODO: see if ftp could use determine_connection */

        backend->addr = connect_addr;

        backend->r = r;

        ap_set_module_config(c->conn_config, &proxy_ftp_module, backend);

    }

modules/proxy/mod_proxy_http.c

+7 −1
Changes for modules/proxy/mod_proxy_http.c: 7 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -1338,6 +1338,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, 
    request_rec *rp;

    apr_bucket *e;

    apr_bucket_brigade *bb, *tmp_bb;

    apr_bucket_brigade *pass_bb;

    int len, backasswards;

    int interim_response = 0; /* non-zero whilst interim 1xx responses

                               * are being read. */
@@ -1350,6 +1351,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, 
    const char *te = NULL;



    bb = apr_brigade_create(p, c->bucket_alloc);

    pass_bb = apr_brigade_create(p, c->bucket_alloc);



    /* Get response from the remote server, and pass it up the

     * filter chain
@@ -1768,6 +1770,9 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, 
                        break;

                    }



                    /* Switch the allocator lifetime of the buckets */

                    ap_proxy_buckets_lifetime_transform(r, bb, pass_bb);



                    /* found the last brigade? */

                    if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(bb))) {

                        /* signal that we must leave */
@@ -1775,7 +1780,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, 
                    }



                    /* try send what we read */

                    if (ap_pass_brigade(r->output_filters, bb) != APR_SUCCESS

                    if (ap_pass_brigade(r->output_filters, pass_bb) != APR_SUCCESS

                        || c->aborted) {

                        /* Ack! Phbtt! Die! User aborted! */

                        backend->close = 1;  /* this causes socket close below */
@@ -1784,6 +1789,7 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r, 


                    /* make sure we always clean up after ourselves */

                    apr_brigade_cleanup(bb);

                    apr_brigade_cleanup(pass_bb);



                } while (!finish);

            }