Header handling bug in class org.apache.Ajp13

[Jianliang Zhao <jz...@zaplet.com>]

I enabled AJP 1.3 connector on Tomcat 4.0.1 with Netscape Server and found a NumberFormatException thrown for a HTTP request with non-standard headers. I checked out the code from module jakarta-tomcat-connectors with tag tomcat_401. After some debuging, it seems the following code is causing the problem:

method: Ajp13.decodeRequest
Between /************************/ are my comments. Would you please make this fix and let me know where to get a patched tomcat_ajp.jar file?

	    // Header names are encoded as either an integer code starting
	    // with 0xA0, or as a normal string (in which case the first
	    // two bytes are the length).
            int isc = msg.peekInt();

               /*******************************************************/
               // MY DEBUG STATEMENT
	    System.out.println("header ID: " + isc); // It happens to be 8 for a non-standard header
               /*******************************************************/

            int hId = isc & 0xFF;

	    MessageBytes vMB=null;
            isc &= 0xFF00;
            if(0xA000 == isc) {

               /*******************************************************/
               // MY DEBUG STATEMENT
                System.out.println("Integer coding: 0xA0000");
               /*******************************************************/

                msg.getInt(); // To advance the read position
                hName = headerTransArray[hId - 1];
		vMB= headers.addValue(hName);
            } else {
               /*******************************************************/
                /* This branch is executed for the normal string encoding(non-standard header case)*/
                /* The header ID is also set for the normal string encoding case */
                /* I added the following line to fix the problem */
                hId = -1; // Should we set hId to dummy number here?
                System.out.println("Normal String: 0xA0000");
               /*******************************************************/

		// XXX Not very elegant
		vMB = msg.addHeader(headers);
		if (vMB == null) {
                    return 500; // wrong packet
                }
            }

            msg.getMessageBytes(vMB);

            // set content length, if this is it...
            if (hId == SC_REQ_CONTENT_LENGTH) {
                 /*******************************************************/
                 /* Originally the following line was executed for normal string encoding if hId happens to be 8 */
                 /* It throws NumberFormatException */
                 /*******************************************************/

                 int contentLength = (vMB == null) ? -1 : vMB.getInt();

Thanks,

Jianliang

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>