Backport of 2.0 chunk handling

PR:
Obtained from:
Submitted by:	Justin
Reviewed by:	Aaron, Cliff, Jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95729 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/src/main/http_protocol.c b/src/main/http_protocol.c
index 39cb8ad3936947ac82813109ebb0fed388d20e47..05b5ba72b0900c3628d49802018f7138b4a4cc19 100644 (file)
--- a/src/main/http_protocol.c
+++ b/src/main/http_protocol.c
@@ -2045,21 +2045,34 @@ API_EXPORT(int) ap_should_client_block(request_rec *r)
 API_EXPORT(long) ap_get_chunk_size(char *b)
 {
     long chunksize = 0;
+    long chunkbits = sizeof(long) * 8;
 
-    while (ap_isxdigit(*b)) {
+    /* Skip leading zeros */
+    while (*b == '0') {
+        ++b;
+    }
+
+    while (ap_isxdigit(*b) && (chunkbits > 0)) {
         int xvalue = 0;
 
-       /* This works even on EBCDIC. */
-        if (*b >= '0' && *b <= '9')
+        if (*b >= '0' && *b <= '9') {
             xvalue = *b - '0';
-        else if (*b >= 'A' && *b <= 'F')
+        }
+        else if (*b >= 'A' && *b <= 'F') {
             xvalue = *b - 'A' + 0xa;
-        else if (*b >= 'a' && *b <= 'f')
+        }
+        else if (*b >= 'a' && *b <= 'f') {
             xvalue = *b - 'a' + 0xa;
+        }
 
         chunksize = (chunksize << 4) | xvalue;
+        chunkbits -= 4;
         ++b;
     }
+    if (ap_isxdigit(*b) && (chunkbits <= 0)) {
+        /* overflow */
+        return -1;
+    }
 
     return chunksize;
 }
@@ -2144,6 +2157,10 @@ API_EXPORT(long) ap_get_client_block(request_rec *r, char *buffer, int bufsiz)
             }
             r->remaining = -1;  /* Indicate footers in-progress */
         }
+        else if (len_to_read < 0) {
+            r->connection->keepalive = -1;
+            return -1;
+        }
         else {
             r->remaining = len_to_read;
         }

diff --git a/src/modules/proxy/proxy_util.c b/src/modules/proxy/proxy_util.c
index bc4d22f83b51b0c4ebfc9d828054881e34d39eb9..56bdfd6a37454f2c3ff2e4f2883fb96145ad63ce 100644 (file)
--- a/src/modules/proxy/proxy_util.c
+++ b/src/modules/proxy/proxy_util.c
@@ -539,6 +539,12 @@ long int ap_proxy_send_fb(BUFF *f, request_rec *r, cache_req *c, off_t len, int
                             n = -1;
                         }
                     }
+                    else if (remaining < 0) {
+                        n = -1;
+                        ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, r,
+                                      "proxy: remote protocol error, invalid chunk size");
+
+                    }
                 }
             }