From: Yann Ylavic <ylavic@apache.org>
Date: Fri, 29 May 2020 17:05:29 +0000 (+0000)
Subject: mod_proxy_http: don't strip EOS when spooling request body to file.
X-Git-Tag: 2.5.0-alpha2-ci-test-only~1408
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=53e2b681365306df932ec1b4ded187dab8e99c10;p=thirdparty%2Fapache%2Fhttpd.git

mod_proxy_http: don't strip EOS when spooling request body to file.

To prevent stream_reqbody() from sending the FILE and EOS bucket in separate
brigades, and thus apr_file_setaside() to trigger if network congestion occurs
with the backend, restore the EOS in spool_reqbody_cl() which was stripped
when spooling the request body to a file.

Until APR r1878279 is released (and installed by users), apr_file_setaside()
on a temporary file (mktemp) will simply drop the file cleanup, leaking the
fd and inode..

This fixes BZ 64452.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1878280 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index 161a9b442be..6def068a9d5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  *) mod_proxy_http: flush spooled request body in one go to avoid
+     leaking (or long lived) temporary file. PR 64452. [Yann Ylavic]
+
   *) mod_proxy_http2: respect ProxyTimeout settings on backend connections
      while waiting on incoming data. [Ruediger Pluem, Stefan Eissing]
 
diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
index f2857439d20..a4be4ee336a 100644
--- a/modules/proxy/mod_proxy_http.c
+++ b/modules/proxy/mod_proxy_http.c
@@ -549,6 +549,14 @@ static int spool_reqbody_cl(proxy_http_req_t *req, apr_off_t *bytes_spooled)
         e = apr_bucket_immortal_create(CRLF_ASCII, 2, bucket_alloc);
         APR_BRIGADE_INSERT_TAIL(input_brigade, e);
     }
+    if (tmpfile) {
+        /* We dropped metadata buckets when spooling to tmpfile,
+         * terminate with EOS for stream_reqbody() to flush the
+         * whole in one go.
+         */
+        e = apr_bucket_eos_create(bucket_alloc);
+        APR_BRIGADE_INSERT_TAIL(input_brigade, e);
+    }
     return OK;
 }