SECURITY [CAN-2003-0253]: Fixed a bug in prefork MPM causing

temporary denial of service when accept() on a rarely accessed port
returns certain errors.  Reported by Saheed Akhtar
<S.Akhtar@talis.com>.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/APACHE_2_0_BRANCH@100505 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 65620a774c52eeb04419bdc3006959c11722d2fc..b550a88c7020b02e983d346be5de4852e5910517 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,10 @@
 Changes with Apache 2.0.47
 
+  *) SECURITY [CAN-2003-0253]: Fixed a bug in prefork MPM causing
+     temporary denial of service when accept() on a rarely accessed port
+     returns certain errors.  Reported by Saheed Akhtar
+     <S.Akhtar@talis.com>.  [Jeff Trawick]
+
   *) SECURITY [CAN-2003-0254]: Fixed a bug in ftp proxy causing denial
      of service when target host is IPv6 but proxy server can't create
      IPv6 socket.  Fixed by the reporter.  [Yoshioka Tsuneo

diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c
index 64aea2036745239c9dcccfbe0745955aab088aa6..1b92f8471eb2e671ee147439ffcebf992d109b03 100644 (file)
--- a/server/mpm/prefork/prefork.c
+++ b/server/mpm/prefork/prefork.c
@@ -672,19 +672,17 @@ static void child_main(int child_num_arg)
        /* if we accept() something we don't want to die, so we have to
         * defer the exit
         */
-       for (;;) {
-            status = listensocks[offset].accept_func(&csd, 
-                                       &listensocks[offset], ptrans);
+        status = listensocks[offset].accept_func(&csd, 
+                                                 &listensocks[offset], ptrans);
+        SAFE_ACCEPT(accept_mutex_off());       /* unlock after "accept" */
 
-            if (status == APR_SUCCESS) {
-                break;
-            }
-            if (status == APR_EGENERAL) {
-                /* resource shortage or should-not-occur occured */
-                clean_child_exit(1);
-            }
+        if (status == APR_EGENERAL) {
+            /* resource shortage or should-not-occur occured */
+            clean_child_exit(1);
+        }
+        else if (status != APR_SUCCESS) {
+            continue;
         }
-       SAFE_ACCEPT(accept_mutex_off());        /* unlock after "accept" */
 
        /*
         * We now have a connection, so set it up with the appropriate