Blame SOURCES/httpd-2.4.34-CVE-2022-30556.patch

879b17
diff --git a/modules/lua/lua_request.c b/modules/lua/lua_request.c
879b17
index 62a70cf..4b1147a 100644
879b17
--- a/modules/lua/lua_request.c
879b17
+++ b/modules/lua/lua_request.c
879b17
@@ -2189,23 +2189,20 @@ static int lua_websocket_greet(lua_State *L)
879b17
     return 0;
879b17
 }
879b17
 
879b17
-static apr_status_t lua_websocket_readbytes(conn_rec* c, char* buffer, 
879b17
-        apr_off_t len) 
879b17
+static apr_status_t lua_websocket_readbytes(conn_rec* c,
879b17
+                                            apr_bucket_brigade *brigade,
879b17
+                                            char* buffer, apr_off_t len)
879b17
 {
879b17
-    apr_bucket_brigade *brigade = apr_brigade_create(c->pool, c->bucket_alloc);
879b17
+    apr_size_t delivered;
879b17
     apr_status_t rv;
879b17
+
879b17
     rv = ap_get_brigade(c->input_filters, brigade, AP_MODE_READBYTES, 
879b17
             APR_BLOCK_READ, len);
879b17
     if (rv == APR_SUCCESS) {
879b17
-        if (!APR_BRIGADE_EMPTY(brigade)) {
879b17
-            apr_bucket* bucket = APR_BRIGADE_FIRST(brigade);
879b17
-            const char* data = NULL;
879b17
-            apr_size_t data_length = 0;
879b17
-            rv = apr_bucket_read(bucket, &data, &data_length, APR_BLOCK_READ);
879b17
-            if (rv == APR_SUCCESS) {
879b17
-                memcpy(buffer, data, len);
879b17
-            }
879b17
-            apr_bucket_delete(bucket);
879b17
+        delivered = len;
879b17
+        rv = apr_brigade_flatten(brigade, buffer, &delivered);
879b17
+        if ((rv == APR_SUCCESS) && (delivered < len)) {
879b17
+            rv = APR_INCOMPLETE;
879b17
         }
879b17
     }
879b17
     apr_brigade_cleanup(brigade);
879b17
@@ -2235,35 +2232,28 @@ static int lua_websocket_peek(lua_State *L)
879b17
 
879b17
 static int lua_websocket_read(lua_State *L) 
879b17
 {
879b17
-    apr_socket_t *sock;
879b17
     apr_status_t rv;
879b17
     int do_read = 1;
879b17
     int n = 0;
879b17
-    apr_size_t len = 1;
879b17
     apr_size_t plen = 0;
879b17
     unsigned short payload_short = 0;
879b17
     apr_uint64_t payload_long = 0;
879b17
     unsigned char *mask_bytes;
879b17
     char byte;
879b17
-    int plaintext;
879b17
-    
879b17
-    
879b17
+    apr_bucket_brigade *brigade;
879b17
+    conn_rec* c;
879b17
+
879b17
     request_rec *r = ap_lua_check_request_rec(L, 1);
879b17
-    plaintext = ap_lua_ssl_is_https(r->connection) ? 0 : 1;
879b17
+    c = r->connection;
879b17
 
879b17
-    
879b17
     mask_bytes = apr_pcalloc(r->pool, 4);
879b17
-    sock = ap_get_conn_socket(r->connection);
879b17
+
879b17
+    brigade = apr_brigade_create(r->pool, c->bucket_alloc);
879b17
 
879b17
     while (do_read) {
879b17
         do_read = 0;
879b17
         /* Get opcode and FIN bit */
879b17
-        if (plaintext) {
879b17
-            rv = apr_socket_recv(sock, &byte, &len;;
879b17
-        }
879b17
-        else {
879b17
-            rv = lua_websocket_readbytes(r->connection, &byte, 1);
879b17
-        }
879b17
+        rv = lua_websocket_readbytes(c, brigade, &byte, 1);
879b17
         if (rv == APR_SUCCESS) {
879b17
             unsigned char ubyte, fin, opcode, mask, payload;
879b17
             ubyte = (unsigned char)byte;
879b17
@@ -2273,12 +2263,7 @@ static int lua_websocket_read(lua_State *L)
879b17
             opcode = ubyte & 0xf;
879b17
 
879b17
             /* Get the payload length and mask bit */
879b17
-            if (plaintext) {
879b17
-                rv = apr_socket_recv(sock, &byte, &len;;
879b17
-            }
879b17
-            else {
879b17
-                rv = lua_websocket_readbytes(r->connection, &byte, 1);
879b17
-            }
879b17
+            rv = lua_websocket_readbytes(c, brigade, &byte, 1);
879b17
             if (rv == APR_SUCCESS) {
879b17
                 ubyte = (unsigned char)byte;
879b17
                 /* Mask is the first bit */
879b17
@@ -2289,40 +2274,25 @@ static int lua_websocket_read(lua_State *L)
879b17
 
879b17
                 /* Extended payload? */
879b17
                 if (payload == 126) {
879b17
-                    len = 2;
879b17
-                    if (plaintext) {
879b17
-                        /* XXX: apr_socket_recv does not receive len bits, only up to len bits! */
879b17
-                        rv = apr_socket_recv(sock, (char*) &payload_short, &len;;
879b17
-                    }
879b17
-                    else {
879b17
-                        rv = lua_websocket_readbytes(r->connection, 
879b17
-                                (char*) &payload_short, 2);
879b17
-                    }
879b17
-                    payload_short = ntohs(payload_short);
879b17
+                    rv = lua_websocket_readbytes(c, brigade,
879b17
+                                                 (char*) &payload_short, 2);
879b17
 
879b17
-                    if (rv == APR_SUCCESS) {
879b17
-                        plen = payload_short;
879b17
-                    }
879b17
-                    else {
879b17
+                    if (rv != APR_SUCCESS) {
879b17
                         return 0;
879b17
                     }
879b17
+
879b17
+                    plen = ntohs(payload_short);
879b17
                 }
879b17
                 /* Super duper extended payload? */
879b17
                 if (payload == 127) {
879b17
-                    len = 8;
879b17
-                    if (plaintext) {
879b17
-                        rv = apr_socket_recv(sock, (char*) &payload_long, &len;;
879b17
-                    }
879b17
-                    else {
879b17
-                        rv = lua_websocket_readbytes(r->connection, 
879b17
-                                (char*) &payload_long, 8);
879b17
-                    }
879b17
-                    if (rv == APR_SUCCESS) {
879b17
-                        plen = ap_ntoh64(&payload_long);
879b17
-                    }
879b17
-                    else {
879b17
+                    rv = lua_websocket_readbytes(c, brigade,
879b17
+                                                 (char*) &payload_long, 8);
879b17
+
879b17
+                    if (rv != APR_SUCCESS) {
879b17
                         return 0;
879b17
                     }
879b17
+
879b17
+                    plen = ap_ntoh64(&payload_long);
879b17
                 }
879b17
                 ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(03210)
879b17
                               "Websocket: Reading %" APR_SIZE_T_FMT " (%s) bytes, masking is %s. %s", 
879b17
@@ -2331,46 +2301,27 @@ static int lua_websocket_read(lua_State *L)
879b17
                               mask ? "on" : "off", 
879b17
                               fin ? "This is a final frame" : "more to follow");
879b17
                 if (mask) {
879b17
-                    len = 4;
879b17
-                    if (plaintext) {
879b17
-                        rv = apr_socket_recv(sock, (char*) mask_bytes, &len;;
879b17
-                    }
879b17
-                    else {
879b17
-                        rv = lua_websocket_readbytes(r->connection, 
879b17
-                                (char*) mask_bytes, 4);
879b17
-                    }
879b17
+                    rv = lua_websocket_readbytes(c, brigade,
879b17
+                                                 (char*) mask_bytes, 4);
879b17
+
879b17
                     if (rv != APR_SUCCESS) {
879b17
                         return 0;
879b17
                     }
879b17
                 }
879b17
                 if (plen < (HUGE_STRING_LEN*1024) && plen > 0) {
879b17
                     apr_size_t remaining = plen;
879b17
-                    apr_size_t received;
879b17
-                    apr_off_t at = 0;
879b17
                     char *buffer = apr_palloc(r->pool, plen+1);
879b17
                     buffer[plen] = 0;
879b17
 
879b17
-                    if (plaintext) {
879b17
-                        while (remaining > 0) {
879b17
-                            received = remaining;
879b17
-                            rv = apr_socket_recv(sock, buffer+at, &received);
879b17
-                            if (received > 0 ) {
879b17
-                                remaining -= received;
879b17
-                                at += received;
879b17
-                            }
879b17
-                        }
879b17
-                        ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, 
879b17
-                                "Websocket: Frame contained %" APR_OFF_T_FMT " bytes, pushed to Lua stack", 
879b17
-                                at);
879b17
-                    }
879b17
-                    else {
879b17
-                        rv = lua_websocket_readbytes(r->connection, buffer, 
879b17
-                                remaining);
879b17
-                        ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, 
879b17
-                                "Websocket: SSL Frame contained %" APR_SIZE_T_FMT " bytes, "\
879b17
-                                "pushed to Lua stack", 
879b17
-                                remaining);
879b17
+                    rv = lua_websocket_readbytes(c, brigade, buffer, remaining);
879b17
+
879b17
+                    if (rv != APR_SUCCESS) {
879b17
+                        return 0;
879b17
                     }
879b17
+
879b17
+                    ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r,
879b17
+                                  "Websocket: Frame contained %" APR_SIZE_T_FMT \
879b17
+                                  " bytes, pushed to Lua stack", remaining);
879b17
                     if (mask) {
879b17
                         for (n = 0; n < plen; n++) {
879b17
                             buffer[n] ^= mask_bytes[n%4];
879b17
@@ -2382,14 +2333,25 @@ static int lua_websocket_read(lua_State *L)
879b17
                     return 2;
879b17
                 }
879b17
 
879b17
-
879b17
                 /* Decide if we need to react to the opcode or not */
879b17
                 if (opcode == 0x09) { /* ping */
879b17
                     char frame[2];
879b17
-                    plen = 2;
879b17
+                    apr_bucket *b;
879b17
+
879b17
                     frame[0] = 0x8A;
879b17
                     frame[1] = 0;
879b17
-                    apr_socket_send(sock, frame, &plen); /* Pong! */
879b17
+
879b17
+                    /* Pong! */
879b17
+                    b = apr_bucket_transient_create(frame, 2, c->bucket_alloc);
879b17
+                    APR_BRIGADE_INSERT_TAIL(brigade, b);
879b17
+
879b17
+                    rv = ap_pass_brigade(c->output_filters, brigade);
879b17
+                    apr_brigade_cleanup(brigade);
879b17
+
879b17
+                    if (rv != APR_SUCCESS) {
879b17
+                        return 0;
879b17
+                    }
879b17
+
879b17
                     do_read = 1;
879b17
                 }
879b17
             }