You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Michael Kaufmann <ma...@michael-kaufmann.ch> on 2015/06/29 18:57:53 UTC

LimitRequestBody is broken in 2.4.13-2.4.15

Hi,

LimitRequestBody is broken in the (unreleased) Apache versions  
2.4.13-2.4.15 because of this change: http://svn.apache.org/r1684515

In http_filters.c, ap_http_filter(): The variable "totalread" is  
uninitialized if readbytes is 0.

Messages similar to this one are logged: "AH01591: Read content-length  
of 140067070814864 is larger than the configured limit of 104857600",  
and then Apache closes the connection.

I hope that it's possible to fix this for Apache 2.4.16.

Regards,
Michael

Re: LimitRequestBody is broken in 2.4.13-2.4.15

Posted by Michael Kaufmann <ma...@michael-kaufmann.ch>.
>> Thanks for reporting this before the testing/release.
>> Fixed in r1688274 (will now propose a backport), and since this is a
>> showstopper, it will be merged (once reviewed) before 2.4.16/2.2.30.
>
> Proposed patch (for backport) is
> http://people.apache.org/~ylavic/httpd-2.4.x-fix_LimitRequestBody.patch
> Thanks (again) for testing if that's possible.
>

I have tested the patch, it works :-) Thank you very much!

Regards,
Michael

Re: LimitRequestBody is broken in 2.4.13-2.4.15

Posted by Yann Ylavic <yl...@gmail.com>.
On Mon, Jun 29, 2015 at 7:58 PM, Yann Ylavic <yl...@gmail.com> wrote:
> On Mon, Jun 29, 2015 at 6:57 PM, Michael Kaufmann
> <ma...@michael-kaufmann.ch> wrote:
>> LimitRequestBody is broken in the (unreleased) Apache versions 2.4.13-2.4.15
>> because of this change: http://svn.apache.org/r1684515
>>
>> In http_filters.c, ap_http_filter(): The variable "totalread" is
>> uninitialized if readbytes is 0.
>>
>> Messages similar to this one are logged: "AH01591: Read content-length of
>> 140067070814864 is larger than the configured limit of 104857600", and then
>> Apache closes the connection.
>
> Thanks for reporting this before the testing/release.
> Fixed in r1688274 (will now propose a backport), and since this is a
> showstopper, it will be merged (once reviewed) before 2.4.16/2.2.30.

Proposed patch (for backport) is
http://people.apache.org/~ylavic/httpd-2.4.x-fix_LimitRequestBody.patch
Thanks (again) for testing if that's possible.

>
> Regards,
> Yann.

Re: LimitRequestBody is broken in 2.4.13-2.4.15

Posted by Yann Ylavic <yl...@gmail.com>.
On Mon, Jun 29, 2015 at 6:57 PM, Michael Kaufmann
<ma...@michael-kaufmann.ch> wrote:
> LimitRequestBody is broken in the (unreleased) Apache versions 2.4.13-2.4.15
> because of this change: http://svn.apache.org/r1684515
>
> In http_filters.c, ap_http_filter(): The variable "totalread" is
> uninitialized if readbytes is 0.
>
> Messages similar to this one are logged: "AH01591: Read content-length of
> 140067070814864 is larger than the configured limit of 104857600", and then
> Apache closes the connection.

Thanks for reporting this before the testing/release.
Fixed in r1688274 (will now propose a backport), and since this is a
showstopper, it will be merged (once reviewed) before 2.4.16/2.2.30.

Regards,
Yann.