You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2018/03/20 16:34:31 UTC

[Bug 62198] New: ap_rgetline_core can return without consuming a full line

https://bz.apache.org/bugzilla/show_bug.cgi?id=62198

            Bug ID: 62198
           Summary: ap_rgetline_core can return without consuming a full
                    line
           Product: Apache httpd-2
           Version: 2.5-HEAD
          Hardware: PC
                OS: Mac OS X 10.1
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Core
          Assignee: bugs@httpd.apache.org
          Reporter: hwibell@gmail.com
  Target Milestone: ---

When ap_rgetline_core hits its own length limit, it does not continue to loop
over the core input filter to make sure a full line is consumed, potentially
leaving the trailing portion of a long line to resemble a new line.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 62198] ap_rgetline_core can return without consuming a full line

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62198

--- Comment #2 from Yann Ylavic <yl...@gmail.com> ---
Created attachment 35863
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=35863&action=edit
Handle AP_GETLINE_NOSPC_EOL flag in ap_rgetline_core()

How about this change in ap_rgetline_core() which optionally (up to the caller)
allows to consume the end of line on APR_ENOSPC.

mod_proxy may use it to address Bug 62196.

Also note that in the APR_ENOSPC case, ap_rgetline_core() would now
unconditionnaly fill in the buffer up to its limits, which is not that bad IMHO
(before, we might have returned an half filled or empty buffer depending on the
non-fitting bucket size).

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 62198] ap_rgetline_core can return without consuming a full line

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62198

--- Comment #1 from Eric Covener <co...@gmail.com> ---
seems like one band-aid would be to allow the core input filter to pass a
larger static max length to apr_brigade_split_line, e.g. 2x so callers who real
limits are lost as they call ap_get_brigade() are much safer for the typical
scenarios where the limit is only boosted by a few KB. (8 to 12/16 or KB)

This would mean apr_brigade_split_line would not leave the full line unread for
< 16k even ap_rgetline_core was only willing to take the default 8k or
something like 12 k.

But really ap_rgetline_core() should be ditching all of this excess when
trying to read a line.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 62198] ap_rgetline_core can return without consuming a full line

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62198

Yann Ylavic <yl...@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #35863|0                           |1
        is obsolete|                            |

--- Comment #3 from Yann Ylavic <yl...@gmail.com> ---
Created attachment 35885
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=35885&action=edit
Handle AP_GETLINE_NOSPC_EOL flag in ap_rgetline_core()

After some testing, this v2 is to address the (corner) where the line is to be
truncated at LF (while CR fits in), see comment in the patch.

With this patch and attachment 35864 (bug 62196), mod_proxy_http behaves
correctly for headers above ResponseFieldSize.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 62198] ap_rgetline_core can return without consuming a full line

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62198

--- Comment #5 from Eric Covener <co...@gmail.com> ---
Comment on attachment 35885
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=35885
Handle AP_GETLINE_NOSPC_EOL flag in ap_rgetline_core()

this did the trick for my heisenbug on Windows while testing Hank's original
proxy patch. Thanks!

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 62198] ap_rgetline_core can return without consuming a full line

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62198

Yann Ylavic <yl...@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |FixedInTrunk

--- Comment #4 from Yann Ylavic <yl...@gmail.com> ---
Committed to trunk in r1829557.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 62198] ap_rgetline_core can return without consuming a full line

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62198

Christophe JAILLET <ch...@wanadoo.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Christophe JAILLET <ch...@wanadoo.fr> ---
This has been backported in 2.4.x in r1834093

This is part of 2.4.34

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org