You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2026/04/26 15:57:55 UTC
svn commit: r1933348 - in httpd/httpd/branches/2.4.x: . modules/proxy
Author: covener
Date: Sun Apr 26 15:57:55 2026
New Revision: 1933348
Log:
Merge r1933347 from trunk:
fix ajp_msg_check_header check
Modified:
httpd/httpd/branches/2.4.x/ (props changed)
httpd/httpd/branches/2.4.x/modules/proxy/ajp_msg.c
Modified: httpd/httpd/branches/2.4.x/modules/proxy/ajp_msg.c
==============================================================================
--- httpd/httpd/branches/2.4.x/modules/proxy/ajp_msg.c Sun Apr 26 15:57:15 2026 (r1933347)
+++ httpd/httpd/branches/2.4.x/modules/proxy/ajp_msg.c Sun Apr 26 15:57:55 2026 (r1933348)
@@ -166,11 +166,11 @@ apr_status_t ajp_msg_check_header(ajp_ms
msglen = ((head[2] & 0xff) << 8);
msglen += (head[3] & 0xFF);
- if (msglen > msg->max_size) {
+ if (msglen > (msg->max_size - AJP_HEADER_LEN)) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL, APLOGNO(01081)
"ajp_msg_check_header() incoming message is "
"too big %" APR_SIZE_T_FMT ", max is %" APR_SIZE_T_FMT,
- msglen, msg->max_size);
+ msglen, msg->max_size - AJP_HEADER_LEN);
return AJP_ETOBIG;
}