* modules/ssl/ssl_engine_io.c (ssl_io_filter_disable): Don't leak an

SSL structure for each plain-HTTP-on-SSL-port request.

PR: 27106
Reviewed by: Jeff Trawick, Justin Erenkrantz

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/APACHE_2_0_BRANCH@102880 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index f0b0b20edbd2497c5a41d573c38249d1fcdeac45..4edb18d01735d679e1dd3f176dfcba66927bc911 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,9 @@
 Changes with Apache 2.0.49
 
+  *) SECURITY: CAN-2004-0113 (cve.mitre.org)
+     mod_ssl: Fix a memory leak in plain-HTTP-on-SSL-port handling.
+     PR 27106.  [Joe Orton]
+
   *) mod_ssl: Fix bug in passphrase handling which could cause spurious
      failures in SSL functions later.  PR 21160.  [Joe Orton]
 

diff --git a/STATUS b/STATUS
index 3dce5a0fde6f0afa55adf0e98f85f787d7b796ef..84b8066f4f053884c5ef9f0e5adace788e910ed6 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -1,5 +1,5 @@
 APACHE 2.0 STATUS:                                              -*-text-*-
-Last modified at [$Date: 2004/03/06 18:35:44 $]
+Last modified at [$Date: 2004/03/07 22:03:15 $]
 
 Release:
 
@@ -103,12 +103,6 @@ PATCHES TO BACKPORT FROM 2.1
       +1: madhum, jerenkrantz, jorton
       (jorton: needs libhttpd.dsp change for Win32 too)
 
-    * mod_ssl: Fix nasty memory leak for each plain-HTTP-on-SSL-port request.
-      PR: 27106
-      http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.117&r2=1.118
-      http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_io.c?r1=1.120&r2=1.121      
-      +1: jorton, trawick, jerenkrantz
-
     * mod_setenvif: remove support for remote_user variable which never
       worked at all. PR 25725 (2.0 + 1.3)
         modules/metadata/mod_setenvif.c: r1.50

diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c
index b26cd6e69e63c5c0cbd794fa84161bf020fa746f..d48f581f9fc2245c0608b985edc1ddfb1f0df21c 100644 (file)
--- a/modules/ssl/ssl_engine_io.c
+++ b/modules/ssl/ssl_engine_io.c
@@ -821,9 +821,11 @@ static apr_status_t ssl_filter_write(ap_filter_t *f,
                                sizeof(HTTP_ON_HTTPS_PORT) - 1, \
                                alloc)
 
-static void ssl_io_filter_disable(ap_filter_t *f)
+static void ssl_io_filter_disable(SSLConnRec *sslconn, ap_filter_t *f)
 {
     bio_filter_in_ctx_t *inctx = f->ctx;
+    SSL_free(inctx->ssl);
+    sslconn->ssl = NULL;
     inctx->ssl = NULL;
     inctx->filter_ctx->pssl = NULL;
 }
@@ -845,7 +847,7 @@ static apr_status_t ssl_io_filter_error(ap_filter_t *f,
             ssl_log_ssl_error(APLOG_MARK, APLOG_INFO, f->c->base_server);
 
             sslconn->non_ssl_request = 1;
-            ssl_io_filter_disable(f);
+            ssl_io_filter_disable(sslconn, f);
 
             /* fake the request line */
             bucket = HTTP_ON_HTTPS_PORT_BUCKET(f->c->bucket_alloc);