From: Jim Jagielski <jim@apache.org>
Date: Mon, 17 Jun 2002 18:14:12 +0000 (+0000)
Subject: Backport of 2.0 chunk handling
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=39d7064c004c2de4850ba0358b4c8def6650d3a0;p=thirdparty%2Fapache%2Fhttpd.git

Backport of 2.0 chunk handling
PR:
Obtained from:
Submitted by:	Justin
Reviewed by:	Aaron, Cliff, Jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95729 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/src/main/http_protocol.c b/src/main/http_protocol.c
index 39cb8ad3936..05b5ba72b09 100644
--- a/src/main/http_protocol.c
+++ b/src/main/http_protocol.c
@@ -2045,21 +2045,34 @@ API_EXPORT(int) ap_should_client_block(request_rec *r)
 API_EXPORT(long) ap_get_chunk_size(char *b)
 {
     long chunksize = 0;
+    long chunkbits = sizeof(long) * 8;
 
-    while (ap_isxdigit(*b)) {
+    /* Skip leading zeros */
+    while (*b == '0') {
+        ++b;
+    }
+
+    while (ap_isxdigit(*b) && (chunkbits > 0)) {
         int xvalue = 0;
 
-	/* This works even on EBCDIC. */
-        if (*b >= '0' && *b <= '9')
+        if (*b >= '0' && *b <= '9') {
             xvalue = *b - '0';
-        else if (*b >= 'A' && *b <= 'F')
+        }
+        else if (*b >= 'A' && *b <= 'F') {
             xvalue = *b - 'A' + 0xa;
-        else if (*b >= 'a' && *b <= 'f')
+        }
+        else if (*b >= 'a' && *b <= 'f') {
             xvalue = *b - 'a' + 0xa;
+        }
 
         chunksize = (chunksize << 4) | xvalue;
+        chunkbits -= 4;
         ++b;
     }
+    if (ap_isxdigit(*b) && (chunkbits <= 0)) {
+        /* overflow */
+        return -1;
+    }
 
     return chunksize;
 }
@@ -2144,6 +2157,10 @@ API_EXPORT(long) ap_get_client_block(request_rec *r, char *buffer, int bufsiz)
             }
             r->remaining = -1;  /* Indicate footers in-progress */
         }
+        else if (len_to_read < 0) {
+            r->connection->keepalive = -1;
+            return -1;
+        }
         else {
             r->remaining = len_to_read;
         }
diff --git a/src/modules/proxy/proxy_util.c b/src/modules/proxy/proxy_util.c
index bc4d22f83b5..56bdfd6a374 100644
--- a/src/modules/proxy/proxy_util.c
+++ b/src/modules/proxy/proxy_util.c
@@ -539,6 +539,12 @@ long int ap_proxy_send_fb(BUFF *f, request_rec *r, cache_req *c, off_t len, int
                             n = -1;
                         }
                     }
+                    else if (remaining < 0) {
+                        n = -1;
+                        ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, r,
+                                      "proxy: remote protocol error, invalid chunk size");
+
+                    }
                 }
             }