You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2014/01/07 14:07:51 UTC
svn commit: r1556206 - in /httpd/httpd/trunk: CHANGES
docs/log-message-tags/next-number docs/manual/rewrite/flags.xml
modules/mappers/mod_rewrite.c
Author: covener
Date: Tue Jan 7 13:07:51 2014
New Revision: 1556206
URL: http://svn.apache.org/r1556206
Log:
avoid a tight busy loop with memory allocations when the [N] flag
isn't making progress.
If backported, probably increase the hard-coded limit to 32k from 10k.
Modified:
httpd/httpd/trunk/CHANGES
httpd/httpd/trunk/docs/log-message-tags/next-number
httpd/httpd/trunk/docs/manual/rewrite/flags.xml
httpd/httpd/trunk/modules/mappers/mod_rewrite.c
Modified: httpd/httpd/trunk/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?rev=1556206&r1=1556205&r2=1556206&view=diff
==============================================================================
--- httpd/httpd/trunk/CHANGES [utf-8] (original)
+++ httpd/httpd/trunk/CHANGES [utf-8] Tue Jan 7 13:07:51 2014
@@ -1,6 +1,10 @@
-*- coding: utf-8 -*-
Changes with Apache 2.5.0
+ *) mod_rewrite: Protect against looping with the [N] flag by enforcing a
+ default limit of 10000 iterations, and allowing each rule to change its
+ limit. [Eric Covener]
+
*) mod_ssl: Fix config merging of SSLOCSPEnable and SSLOCSPOverrideResponder.
[Jeff Trawick]
Modified: httpd/httpd/trunk/docs/log-message-tags/next-number
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/log-message-tags/next-number?rev=1556206&r1=1556205&r2=1556206&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/log-message-tags/next-number (original)
+++ httpd/httpd/trunk/docs/log-message-tags/next-number Tue Jan 7 13:07:51 2014
@@ -1 +1 @@
-2596
+2597
Modified: httpd/httpd/trunk/docs/manual/rewrite/flags.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/rewrite/flags.xml?rev=1556206&r1=1556205&r2=1556206&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/manual/rewrite/flags.xml (original)
+++ httpd/httpd/trunk/docs/manual/rewrite/flags.xml Tue Jan 7 13:07:51 2014
@@ -392,14 +392,22 @@ certain string or letter repeatedly in a
will replace A with B everywhere in a request, and will continue doing
so until there are no more As to be replaced.
</p>
-
<highlight language="config">RewriteRule (.*)A(.*) $1B$2 [N]</highlight>
-
<p>You can think of this as a <code>while</code> loop: While this
pattern still matches (i.e., while the URI still contains an
<code>A</code>), perform this substitution (i.e., replace the
<code>A</code> with a <code>B</code>).</p>
+<p>In 2.5.0 and later, this module returns an error after 10,000 iterations to
+protect against unintended looping. An alternative maximum number of
+iterations can be specified by adding to the N flag. </p>
+<highlight language="config">
+# Be willing to replace 1 character in each pass of the loop
+RewriteRule (.+)[><;]$ $1 [N=32000]
+# ... or, give up if after 10 loops
+RewriteRule (.+)[><;]$ $1 [N=10]
+</highlight>
+
</section>
<section id="flag_nc"><title>NC|nocase</title>
Modified: httpd/httpd/trunk/modules/mappers/mod_rewrite.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mappers/mod_rewrite.c?rev=1556206&r1=1556205&r2=1556206&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/mappers/mod_rewrite.c (original)
+++ httpd/httpd/trunk/modules/mappers/mod_rewrite.c Tue Jan 7 13:07:51 2014
@@ -235,6 +235,9 @@ static const char* really_last_key = "re
#define subreq_ok(r) (!r->main || \
(r->main->uri && r->uri && strcmp(r->main->uri, r->uri)))
+#ifndef REWRITE_MAX_ROUNDS
+#define REWRITE_MAX_ROUNDS 10000
+#endif
/*
* +-------------------------------------------------------+
@@ -312,6 +315,7 @@ typedef struct {
data_item *env; /* added environment variables */
data_item *cookie; /* added cookies */
int skip; /* number of next rules to skip */
+ int maxrounds; /* limit on number of loops with N flag */
} rewriterule_entry;
typedef struct {
@@ -3502,6 +3506,10 @@ static const char *cmd_rewriterule_setfl
}
else if (!*key || !strcasecmp(key, "ext")) { /* next */
cfg->flags |= RULEFLAG_NEWROUND;
+ if (val && *val) {
+ cfg->maxrounds = atoi(val);
+ }
+
}
else if (((*key == 'S' || *key == 's') && !key[1])
|| !strcasecmp(key, "osubreq")) { /* nosubreq */
@@ -3653,6 +3661,7 @@ static const char *cmd_rewriterule(cmd_p
newrule->env = NULL;
newrule->cookie = NULL;
newrule->skip = 0;
+ newrule->maxrounds = REWRITE_MAX_ROUNDS;
if (a3 != NULL) {
if ((err = cmd_parseflagfield(cmd->pool, newrule, a3,
cmd_rewriterule_setflag)) != NULL) {
@@ -4196,6 +4205,7 @@ static int apply_rewrite_list(request_re
int rc;
int s;
rewrite_ctx *ctx;
+ int round = 1;
ctx = apr_palloc(r->pool, sizeof(*ctx));
ctx->perdir = perdir;
@@ -4284,6 +4294,15 @@ static int apply_rewrite_list(request_re
* the rewriting ruleset again.
*/
if (p->flags & RULEFLAG_NEWROUND) {
+ if (++round >= p->maxrounds) {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02596)
+ "RewriteRule '%s' and URI '%s' exceeded "
+ "maximum number of rounds (%d) via the [N] flag",
+ p->pattern, r->uri, p->maxrounds);
+
+ r->status = HTTP_INTERNAL_SERVER_ERROR;
+ return ACTION_STATUS;
+ }
goto loop;
}