protocol/8549: 416 errors return Content-Length header followed by no content, causing client hang

[Jeremy Elson <je...@circlemud.org>]

>Number:         8549
>Category:       protocol
>Synopsis:       416 errors return Content-Length header followed by no content, causing client hang
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Tue Oct 16 01:20:01 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator:     jelson@circlemud.org
>Release:        1.3.19
>Organization:
apache
>Environment:
Linux 2.4.2-2 #1 Sun Apr 8 20:41:30 EDT 2001 i686 unknown

Standard apache installation that comes with
redhat 7.1: apache-1.3.19-5.i386.rpm

>Description:
When sending a partial-content request (i.e. resumed download), but requesting a
byte-range beyond what exists, Apache returns a 416 (Requested Range Not 
Satisfyable) as of 1.3.15.  However, the Content-Length of the response is
set to the (complete) size of the requested entity body, followed by no
entity body - causing the client to hang waiting for a body that will
never come.

This trace shows the problem (the "/" document on the test server
is 4592 bytes long):

% telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET / HTTP/1.1
Host: build
Range: bytes=100000-

HTTP/1.1 416 Requested Range Not Satisfiable
Date: Tue, 16 Oct 2001 07:34:21 GMT
Server: Apache/1.3.19 (Unix)  (Red-Hat/Linux) mod_ssl/2.8.1 OpenSSL/0.9.6 DAV/1.0.2 PHP/4.0.4pl1 mod_perl/1.24_01
Last-Modified: Mon, 15 Oct 2001 21:44:58 GMT
ETag: "259f2b-11f0-3bcb58da"
Accept-Ranges: bytes
Content-Length: 4592
Content-Range: bytes */4592
Content-Type: text/html

<no body returned>

Note that the server returns a "Content-Length: 4592" header, followed by
no content.

Section 10.4.17 of RFC2616 says "When [the 416] status code is returned for a
byte-range request, the response SHOULD include a Content-Range entity-header
field specifying the current length of the selected resource."  So, the
Content-Range header generated by apache (which also indicates 4592 bytes
are available) is correct; the Content-Length header, however, causes clients
to hang as they wait for an entity body that never comes.
>How-To-Repeat:
The trace shown above works repeatably for 1.3.19+ servers when
nonexistant byte ranges are requested
>Fix:
This seems to fix it:

--- http_core.c.orig    Tue Oct 16 00:54:57 2001
+++ http_core.c Tue Oct 16 01:17:06 2001
@@ -3695,6 +3695,9 @@
 
        rangestatus = ap_set_byterange(r);
 
+       if (r->header_only)
+           ap_set_content_length(r, 0);
+
        ap_send_http_header(r);
 
        if (!r->header_only) {
@@ -3741,6 +3744,10 @@
        }
 
        rangestatus = ap_set_byterange(r);
+
+       if (r->header_only)
+           ap_set_content_length(r, 0);
+
        ap_send_http_header(r);
 
        if (!r->header_only) {
>Release-Note:
>Audit-Trail:
>Unformatted:
 [In order for any reply to be added to the PR database, you need]
 [to include <ap...@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]