diff options
| author | Stefan Fritsch <sf@apache.org> | 2011-10-03 22:37:49 +0200 |
|---|---|---|
| committer | Stefan Fritsch <sf@apache.org> | 2011-10-03 22:37:49 +0200 |
| commit | a4092c7a7d532c41f8c9bf084f58bf5af8894550 (patch) | |
| tree | 54c32b068f82ed2d0da42187eee5d37a54b01509 /server | |
| parent | TODO note regarding the LimitInternalRecursion error message. (diff) | |
| download | apache2-a4092c7a7d532c41f8c9bf084f58bf5af8894550.tar.xz apache2-a4092c7a7d532c41f8c9bf084f58bf5af8894550.zip | |
Enforce LimitRequestFieldSize after multiple headers with the same
name have been merged.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1178566 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'server')
| -rw-r--r-- | server/protocol.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/server/protocol.c b/server/protocol.c index f29c915bab..896a8fd603 100644 --- a/server/protocol.c +++ b/server/protocol.c @@ -685,6 +685,23 @@ static int read_request_line(request_rec *r, apr_bucket_brigade *bb) return 1; } +static int table_do_fn_check_lengths(void *r_, const char *key, + const char *value) +{ + request_rec *r = r_; + if (value == NULL || r->server->limit_req_fieldsize >= strlen(value) ) + return 1; + + r->status = HTTP_BAD_REQUEST; + apr_table_setn(r->notes, "error-notes", + apr_pstrcat(r->pool, "Size of a request header field " + "after merging exceeds server limit.<br />" + "\n<pre>\n", + ap_escape_html(r->pool, key), + "</pre>\n", NULL)); + return 0; +} + AP_DECLARE(void) ap_get_mime_headers_core(request_rec *r, apr_bucket_brigade *bb) { char *last_field = NULL; @@ -850,6 +867,9 @@ AP_DECLARE(void) ap_get_mime_headers_core(request_rec *r, apr_bucket_brigade *bb * field-name, following RFC 2616, 4.2. */ apr_table_compress(r->headers_in, APR_OVERLAP_TABLES_MERGE); + + /* enforce LimitRequestFieldSize for merged headers */ + apr_table_do(table_do_fn_check_lengths, r, r->headers_in, NULL); } AP_DECLARE(void) ap_get_mime_headers(request_rec *r) |