Blame SOURCES/httpd-2.4.37-CVE-2022-28614.patch
|
|
0ac66a |
diff --git a/include/http_protocol.h b/include/http_protocol.h
|
|
|
0ac66a |
index e1572dc..8ed77ac 100644
|
|
|
0ac66a |
--- a/include/http_protocol.h
|
|
|
0ac66a |
+++ b/include/http_protocol.h
|
|
|
0ac66a |
@@ -439,7 +439,27 @@ AP_DECLARE(int) ap_rwrite(const void *buf, int nbyte, request_rec *r);
|
|
|
0ac66a |
*/
|
|
|
0ac66a |
static APR_INLINE int ap_rputs(const char *str, request_rec *r)
|
|
|
0ac66a |
{
|
|
|
0ac66a |
- return ap_rwrite(str, (int)strlen(str), r);
|
|
|
0ac66a |
+ apr_size_t len;
|
|
|
0ac66a |
+
|
|
|
0ac66a |
+ len = strlen(str);
|
|
|
0ac66a |
+
|
|
|
0ac66a |
+ for (;;) {
|
|
|
0ac66a |
+ if (len <= INT_MAX) {
|
|
|
0ac66a |
+ return ap_rwrite(str, (int)len, r);
|
|
|
0ac66a |
+ }
|
|
|
0ac66a |
+ else {
|
|
|
0ac66a |
+ int rc;
|
|
|
0ac66a |
+
|
|
|
0ac66a |
+ rc = ap_rwrite(str, INT_MAX, r);
|
|
|
0ac66a |
+ if (rc < 0) {
|
|
|
0ac66a |
+ return rc;
|
|
|
0ac66a |
+ }
|
|
|
0ac66a |
+ else {
|
|
|
0ac66a |
+ str += INT_MAX;
|
|
|
0ac66a |
+ len -= INT_MAX;
|
|
|
0ac66a |
+ }
|
|
|
0ac66a |
+ }
|
|
|
0ac66a |
+ }
|
|
|
0ac66a |
}
|
|
|
0ac66a |
|
|
|
0ac66a |
/**
|
|
|
0ac66a |
diff --git a/server/protocol.c b/server/protocol.c
|
|
|
0ac66a |
index a554970..ea461a2 100644
|
|
|
0ac66a |
--- a/server/protocol.c
|
|
|
0ac66a |
+++ b/server/protocol.c
|
|
|
0ac66a |
@@ -2107,6 +2107,9 @@ AP_DECLARE(int) ap_rputc(int c, request_rec *r)
|
|
|
0ac66a |
|
|
|
0ac66a |
AP_DECLARE(int) ap_rwrite(const void *buf, int nbyte, request_rec *r)
|
|
|
0ac66a |
{
|
|
|
0ac66a |
+ if (nbyte < 0)
|
|
|
0ac66a |
+ return -1;
|
|
|
0ac66a |
+
|
|
|
0ac66a |
if (r->connection->aborted)
|
|
|
0ac66a |
return -1;
|
|
|
0ac66a |
|