svn commit: r1932498 - in httpd/httpd/trunk: changes-entries modules/proxy

[rp...@apache.org]

Author: rpluem
Date: Tue Mar 24 09:39:55 2026
New Revision: 1932498

Log:
* Compare the source buffers usage with the destination buffers size.
  This is just hardening as the code is currently not used.

Submitted by: Elhanan Haenel <el...@gmail.com>
Reviewed by: rpluem

Added:
   httpd/httpd/trunk/changes-entries/mod_proxy_ajp_msg_copy.txt   (contents, props changed)
Modified:
   httpd/httpd/trunk/modules/proxy/ajp_msg.c

Added: httpd/httpd/trunk/changes-entries/mod_proxy_ajp_msg_copy.txt
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ httpd/httpd/trunk/changes-entries/mod_proxy_ajp_msg_copy.txt	Tue Mar 24 09:39:55 2026	(r1932498)
@@ -0,0 +1,2 @@
+  *) mod_proxy_ajp: Fix a wrong comparison in ajp_msg_copy.
+     [Elhanan Haenel <el...@gmail.com>]

Modified: httpd/httpd/trunk/modules/proxy/ajp_msg.c
==============================================================================
--- httpd/httpd/trunk/modules/proxy/ajp_msg.c	Tue Mar 24 08:30:24 2026	(r1932497)
+++ httpd/httpd/trunk/modules/proxy/ajp_msg.c	Tue Mar 24 09:39:55 2026	(r1932498)
@@ -582,7 +582,7 @@ apr_status_t ajp_msg_create(apr_pool_t *
  */
 apr_status_t ajp_msg_copy(ajp_msg_t *smsg, ajp_msg_t *dmsg)
 {
-    if (smsg->len > smsg->max_size) {
+    if (smsg->len > dmsg->max_size) {
         ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL, APLOGNO(01082)
                      "ajp_msg_copy(): destination buffer too "
                      "small %" APR_SIZE_T_FMT ", max size is %" APR_SIZE_T_FMT,