SECURITY (CVE-2014-0226): Fix a memory consumption denial of

service in the WinNT MPM used in all Windows installations.
Workaround: AcceptFilter <protocol> {none|connect}

Submitted by: trawick
Reviewed by: jorton, covener, jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610652 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/server/mpm/winnt/child.c b/server/mpm/winnt/child.c
index a769a9e659a39ebcf8559d8906d9b46b51588383..34aa1080db39bb78b2b709d5235d0aae2ffe7acb 100644 (file)
--- a/server/mpm/winnt/child.c
+++ b/server/mpm/winnt/child.c
@@ -601,8 +601,12 @@ reinit: /* target of data or connect upon too many AcceptEx failures */
                 b->length = BytesRead;
                 context->overlapped.Pointer = b;
             }
-            else
+            else {
+                if (accf == 2) {
+                    apr_bucket_free(buf);
+                }
                 context->overlapped.Pointer = NULL;
+            }
         }
         else /* (accf = 0)  e.g. 'none' */
         {