Backport of 2.0.x PID table problem fix

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@556298 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index faaf72d4ff069dd2905c80dcc98d9db4ad5cb73c..9197d3137e0e27febf9ba0b3bd2fef151fad2b80 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,11 @@ Changes with Apache 2.0.60
      server-status page and ExtendedStatus enabled, for browsers which
      perform charset "detection".  Reported by Stefan Esser.  [Joe Orton]
 
+  *) SECURITY: CVE-2007-3304 (cve.mitre.org)
+     scoreboard pid protection fixes -- the only fix for 2.0.x is
+     to ensure a valid positive pid is passed to apr_proc_wait(); 
+     the MPMs do not kill children directly as in 2.2.x.
+
   *) mod_so: Solve dev's confusion by reporting expected/seen module
      magic signatures when failing with a 'garbled' message, and solve
      user's confusion by pointing out 'perhaps compiled for a different

diff --git a/STATUS b/STATUS
index 9f4a6d49b6e9984222c85a243d9100dc7af66c09..cb2bc8e13788ca8e76d8610c3938e8129be94e4f 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -123,16 +123,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
         http://people.apache.org/~mjc/cve-2007-1863-2.0.patch
       +1: mjc, rpluem, jorton
 
-    * SECURITY: CVE-2007-3304
-      scoreboard pid protection fixes -- the only fix for 2.0.x is
-      to ensure a valid positive pid is passed to apr_proc_wait(); 
-      the MPMs do not kill children directly as in 2.2.x.
-      trunk commit:
-        http://svn.apache.org/viewvc?view=rev&rev=551843
-      patch for 2.0.x:
-        http://people.apache.org/~jorton/httpd-2.0.x-CVE-2007-3304.patch
-      +1: jorton, jim, rpluem
-
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ please place SVN revisions from trunk here, so it is easy to
     identify exactly what the proposed changes are!  Add all new

diff --git a/server/mpm_common.c b/server/mpm_common.c
index b21dc8ad274b54275cfd1955da87d673a279c68b..3a961ff0cd9c8db13c02cdf6ebd08c369c1db6d6 100644 (file)
--- a/server/mpm_common.c
+++ b/server/mpm_common.c
@@ -110,6 +110,11 @@ static int reclaim_one_pid(pid_t pid, action_t action)
     apr_proc_t proc;
     apr_status_t waitret;
 
+    /* Ensure pid sanity. */
+    if (pid < 1) {
+        return 1;
+    }        
+
     proc.pid = pid;
     waitret = apr_proc_wait(&proc, NULL, NULL, APR_NOWAIT);
     if (waitret != APR_CHILD_NOTDONE) {