You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2026/04/26 15:55:26 UTC
svn commit: r1933346 - in httpd/httpd/branches/2.4.x: . modules/proxy
Author: covener
Date: Sun Apr 26 15:55:26 2026
New Revision: 1933346
Log:
Merge r1933344 from trunk:
fix ajp_parse_data message len check
+lognos
Modified:
httpd/httpd/branches/2.4.x/ (props changed)
httpd/httpd/branches/2.4.x/modules/proxy/ajp_header.c
Modified: httpd/httpd/branches/2.4.x/modules/proxy/ajp_header.c
==============================================================================
--- httpd/httpd/branches/2.4.x/modules/proxy/ajp_header.c Sun Apr 26 15:54:12 2026 (r1933345)
+++ httpd/httpd/branches/2.4.x/modules/proxy/ajp_header.c Sun Apr 26 15:55:26 2026 (r1933346)
@@ -835,6 +835,11 @@ apr_status_t ajp_parse_data(request_rec
* 1 : The last byte of this message always seems to be
* 0x00 and is not part of the chunk.
*/
+ if (msg->len < AJP_HEADER_LEN + AJP_HEADER_SZ_LEN + 1 + 1) {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10546)
+ "ajp_parse_data: Message too small");
+ return AJP_EBAD_HEADER;
+ }
expected_len = msg->len - (AJP_HEADER_LEN + AJP_HEADER_SZ_LEN + 1 + 1);
if (*len != expected_len) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00998)