1. 05 Jan, 2017 1 commit
  2. 04 Jan, 2017 7 commits
  3. 03 Jan, 2017 4 commits
  4. 02 Jan, 2017 4 commits
  5. 23 Dec, 2016 3 commits
  6. 20 Dec, 2016 1 commit
  7. 07 Dec, 2016 1 commit
  8. 06 Dec, 2016 2 commits
  9. 03 Dec, 2016 1 commit
  10. 01 Dec, 2016 2 commits
  11. 27 Nov, 2016 4 commits
  12. 20 Oct, 2016 1 commit
  13. 05 Oct, 2016 1 commit
  14. 29 Sep, 2016 1 commit
  15. 28 Sep, 2016 1 commit
  16. 17 Sep, 2016 2 commits
  17. 13 Sep, 2016 1 commit
  18. 31 Aug, 2016 3 commits
    • Yann Ylavic's avatar
      Backported. · 586cd4a9
      Yann Ylavic authored
      git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1758673 13f79535-47bb-0310-9956-ffa450edef68
      586cd4a9
    • Yann Ylavic's avatar
      Merge r1710095, r1727544 from trunk: · 51a5a8b2
      Yann Ylavic authored
      core: Limit to ten the number of tolerated empty lines between request,
      and consume them before the pipelining check to avoid possible response
      delay when reading the next request without flushing.
      
      Before this commit, the maximum number of empty lines was the same as
      configured LimitRequestFields, defaulting to 100, which was way too much.
      We now use a fixed/hard limit of 10 (DEFAULT_LIMIT_BLANK_LINES).
      
      check_pipeline() is changed to check for (up to the limit) and comsume the
      trailing [CR]LFs so that they won't be interpreted as pipelined requests,
      otherwise we would block on the next read without flushing data, and hence
      possibly delay pending response(s) until the next/real request comes in or
      the keepalive timeout expires.
       
      Finally, when the maximum number of empty line is reached in
      read_request_line(), or that request line does not contains at least a method
      and an (valid) URI, we can fail early and avoid some failure detected in
      further processing.
      
      
      * Ensure that proto_num and protocol is set in another "error out early" edge
        case. This can happen with invalid CONNECT requests as described in the PR.
      
      PR: 58929
      
      
      Submitted by: ylavic, rpluem
      Reviewed  by: wrowe, covener, ylavic
      
      
      git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1758672 13f79535-47bb-0310-9956-ffa450edef68
      51a5a8b2
    • Yann Ylavic's avatar
      Merge r892678, r1100511, r1102124 from trunk: · 27ca73eb
      Yann Ylavic authored
      Reject requests containing (invalid) NULL characters in request line
      or request headers.
      PR 43039
      
      
      use APR_STATUS_IS_TIMEUP() instead of direct comparison with APR_TIMEUP.
      
      
      Use APR_STATUS_IS_... in some more cases.
      
      While this is not strictly necessary everywhere, it makes it much easier
      to find the problematic cases.
      
      
      Submitted by: niq, covener, sf
      Reviewed  by: wrowe, covener, ylavic
      
      
      git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1758671 13f79535-47bb-0310-9956-ffa450edef68
      27ca73eb