Blame SOURCES/httpd-2.4.34-CVE-2022-29404.patch

879b17
diff --git a/docs/manual/mod/core.html.en b/docs/manual/mod/core.html.en
879b17
index 2463a02..dc1eca5 100644
879b17
--- a/docs/manual/mod/core.html.en
879b17
+++ b/docs/manual/mod/core.html.en
879b17
@@ -2746,16 +2746,16 @@ subrequests
879b17
 Description:Restricts the total size of the HTTP request body sent
879b17
 from the client
879b17
 Syntax:LimitRequestBody bytes
879b17
-Default:LimitRequestBody 0
879b17
+Default:LimitRequestBody 1073741824
879b17
 Context:server config, virtual host, directory, .htaccess
879b17
 Override:All
879b17
 Status:Core
879b17
 Module:core
879b17
+Compatibility:In Apache HTTP Server 2.4.53 and earlier, the default value
879b17
+    was 0 (unlimited)
879b17
 
879b17
-    

This directive specifies the number of bytes from 0

879b17
-    (meaning unlimited) to 2147483647 (2GB) that are allowed in a
879b17
-    request body. See the note below for the limited applicability
879b17
-    to proxy requests.

879b17
+    

This directive specifies the number of bytes

879b17
+    that are allowed in a request body. A value of 0 means unlimited.

879b17
 
879b17
     

The LimitRequestBody directive allows

879b17
     the user to set a limit on the allowed size of an HTTP request
879b17
@@ -2781,12 +2781,6 @@ from the client
879b17
 
879b17
     
LimitRequestBody 102400
879b17
 
879b17
-
879b17
-    

For a full description of how this directive is interpreted by

879b17
-    proxy requests, see the mod_proxy documentation.

879b17
-    
879b17
-
879b17
-
879b17
 
879b17
 
top
879b17
 
879b17
diff --git a/docs/manual/mod/mod_proxy.html.en b/docs/manual/mod/mod_proxy.html.en
879b17
index 2cc6ace..c9e4634 100644
879b17
--- a/docs/manual/mod/mod_proxy.html.en
879b17
+++ b/docs/manual/mod/mod_proxy.html.en
879b17
@@ -459,9 +459,6 @@ ProxyPass "/examples" "http://backend.example.com/examples" timeout=10
879b17
     Content-Length header, but the server is configured to filter incoming
879b17
     request bodies.

879b17
 
879b17
-    

LimitRequestBody only applies to

879b17
-    request bodies that the server will spool to disk

879b17
-
879b17
     
top
879b17
 
879b17
 

Reverse Proxy Request Headers

879b17
diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
879b17
index 1ebb9cc..0174fee 100644
879b17
--- a/modules/http/http_filters.c
879b17
+++ b/modules/http/http_filters.c
879b17
@@ -1696,6 +1696,7 @@ AP_DECLARE(int) ap_setup_client_block(request_rec *r, int read_policy)
879b17
 {
879b17
     const char *tenc = apr_table_get(r->headers_in, "Transfer-Encoding");
879b17
     const char *lenp = apr_table_get(r->headers_in, "Content-Length");
879b17
+    apr_off_t limit_req_body = ap_get_limit_req_body(r);
879b17
 
879b17
     r->read_body = read_policy;
879b17
     r->read_chunked = 0;
879b17
@@ -1734,6 +1735,11 @@ AP_DECLARE(int) ap_setup_client_block(request_rec *r, int read_policy)
879b17
         return HTTP_REQUEST_ENTITY_TOO_LARGE;
879b17
     }
879b17
 
879b17
+    if (limit_req_body > 0 && (r->remaining > limit_req_body)) {
879b17
+        /* will be logged when the body is discarded */
879b17
+        return HTTP_REQUEST_ENTITY_TOO_LARGE;
879b17
+    }
879b17
+
879b17
 #ifdef AP_DEBUG
879b17
     {
879b17
         /* Make sure ap_getline() didn't leave any droppings. */
879b17
diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
879b17
index 01dc509..a33b57b 100644
879b17
--- a/modules/proxy/mod_proxy_http.c
879b17
+++ b/modules/proxy/mod_proxy_http.c
879b17
@@ -515,12 +515,9 @@ static int spool_reqbody_cl(apr_pool_t *p,
879b17
     apr_bucket *e;
879b17
     apr_off_t bytes, bytes_spooled = 0, fsize = 0;
879b17
     apr_file_t *tmpfile = NULL;
879b17
-    apr_off_t limit;
879b17
 
879b17
     body_brigade = apr_brigade_create(p, bucket_alloc);
879b17
 
879b17
-    limit = ap_get_limit_req_body(r);
879b17
-
879b17
     while (!APR_BUCKET_IS_EOS(APR_BRIGADE_FIRST(input_brigade)))
879b17
     {
879b17
         /* If this brigade contains EOS, either stop or remove it. */
879b17
@@ -535,17 +532,6 @@ static int spool_reqbody_cl(apr_pool_t *p,
879b17
         apr_brigade_length(input_brigade, 1, &bytes);
879b17
 
879b17
         if (bytes_spooled + bytes > MAX_MEM_SPOOL) {
879b17
-            /*
879b17
-             * LimitRequestBody does not affect Proxy requests (Should it?).
879b17
-             * Let it take effect if we decide to store the body in a
879b17
-             * temporary file on disk.
879b17
-             */
879b17
-            if (limit && (bytes_spooled + bytes > limit)) {
879b17
-                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01088)
879b17
-                              "Request body is larger than the configured "
879b17
-                              "limit of %" APR_OFF_T_FMT, limit);
879b17
-                return HTTP_REQUEST_ENTITY_TOO_LARGE;
879b17
-            }
879b17
             /* can't spool any more in memory; write latest brigade to disk */
879b17
             if (tmpfile == NULL) {
879b17
                 const char *temp_dir;
879b17
diff --git a/server/core.c b/server/core.c
879b17
index de2b0d2..3223e04 100644
879b17
--- a/server/core.c
879b17
+++ b/server/core.c
879b17
@@ -65,7 +65,7 @@
879b17
 
879b17
 /* LimitRequestBody handling */
879b17
 #define AP_LIMIT_REQ_BODY_UNSET         ((apr_off_t) -1)
879b17
-#define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 0)
879b17
+#define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 1<<30) /* 1GB */
879b17
 
879b17
 /* LimitXMLRequestBody handling */
879b17
 #define AP_LIMIT_UNSET                  ((long) -1)