summaryrefslogtreecommitdiff
path: root/www/apache20/files/patch-CVE-2008-2364
blob: 4848ad92acb1aae3d2ff82c3d7281d59b1cd1f3f (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
--- modules/proxy/proxy_http.c	2010/03/11 15:52:45	921907
+++ modules/proxy/proxy_http.c	2010/03/11 15:54:18	921908
@@ -1290,6 +1290,16 @@
     return 1;
 }
 
+/*
+ * Limit the number of interim respones we sent back to the client. Otherwise
+ * we suffer from a memory build up. Besides there is NO sense in sending back
+ * an unlimited number of interim responses to the client. Thus if we cross
+ * this limit send back a 502 (Bad Gateway).
+ */
+#ifndef AP_MAX_INTERIM_RESPONSES
+#define AP_MAX_INTERIM_RESPONSES 10
+#endif
+
 static
 apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,
                                             proxy_http_conn_t *p_conn,
@@ -1322,7 +1332,7 @@
      */
     rp->proxyreq = PROXYREQ_RESPONSE;
 
-    while (received_continue) {
+    while (received_continue && (received_continue <= AP_MAX_INTERIM_RESPONSES)) {
         apr_brigade_cleanup(bb);
 
         len = ap_getline(buffer, sizeof(buffer), rp, 0);
@@ -1440,7 +1450,9 @@
             if ((buf = apr_table_get(r->headers_out, "Content-Type"))) {
                 ap_set_content_type(r, apr_pstrdup(p, buf));
             }            
-            ap_proxy_pre_http_request(origin,rp);
+            if (!ap_is_HTTP_INFO(r->status)) {
+                ap_proxy_pre_http_request(origin, rp);
+            }
 
             /* handle Via header in response */
             if (conf->viaopt != via_off && conf->viaopt != via_block) {
@@ -1486,6 +1498,7 @@
         if ( r->status != HTTP_CONTINUE ) {
             received_continue = 0;
         } else {
+            received_continue++;
             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, NULL,
                          "proxy: HTTP: received 100 CONTINUE");
         }
@@ -1622,6 +1635,14 @@
         }
     }
 
+    /* See define of AP_MAX_INTERIM_RESPONSES for why */
+    if (received_continue > AP_MAX_INTERIM_RESPONSES) {
+        return ap_proxyerror(r, HTTP_BAD_GATEWAY,
+                             apr_psprintf(p, 
+                             "Too many (%d) interim responses from origin server",
+                             received_continue));
+    }
+
     if ( conf->error_override ) {
         /* the code above this checks for 'OK' which is what the hook expects */
         if ( r->status == HTTP_OK )