Attachment 152992 Details for Bug 237079 – the proposed patch

[patch] the proposed patch

cve-2005-2090.patch (text/plain), 3.71 KB, created by Mark J. Cox on 2007-04-19 11:53:21 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mark J. Cox

Created: 2007-04-19 11:53:21 UTC

Size: 3.71 KB

patch

obsolete

>Index: src/java/org/apache/coyote/http11/Constants.java
>===================================================================
>--- src/java/org/apache/coyote/http11/Constants.java	(revision 511333)
>+++ src/java/org/apache/coyote/http11/Constants.java	(working copy)
>@@ -129,6 +129,10 @@
>     public static final String CLOSE = "close";
>     public static final byte[] CLOSE_BYTES =
>         ByteChunk.convertToBytes(CLOSE);
>+    public static final String CONTENTLENGTH = "content-length";
>+    public static final byte[] CONTENTLENGTH_BYTES =
>+        ByteChunk.convertToBytes(CONTENTLENGTH);
>+    public static final int CONTENTLENGTH_SIZE =
>CONTENTLENGTH_BYTES.length;
>     public static final String KEEPALIVE = "keep-alive";
>     public static final byte[] KEEPALIVE_BYTES =
>         ByteChunk.convertToBytes(KEEPALIVE);
>Index: src/java/org/apache/coyote/http11/InternalInputBuffer.java
>===================================================================
>--- src/java/org/apache/coyote/http11/InternalInputBuffer.java
>(revision 511333)
>+++ src/java/org/apache/coyote/http11/InternalInputBuffer.java
>(working copy)
>@@ -77,6 +77,8 @@
>
>         parsingHeader = true;
>         swallowInput = true;
>+
>+        contentLengthHeaderPresent = false;
>
>     }
>
>@@ -107,6 +109,11 @@
>
>
>     /**
>+     * Has a content length header been set?
>+     */
>+    protected boolean contentLengthHeaderPresent;
>+
>+    /**
>      * State.
>      */
>     protected boolean parsingHeader;
>@@ -312,6 +319,7 @@
>         lastActiveFilter = -1;
>         parsingHeader = true;
>         swallowInput = true;
>+        contentLengthHeaderPresent = false;
>
>     }
>
>@@ -353,6 +361,7 @@
>         lastActiveFilter = -1;
>         parsingHeader = true;
>         swallowInput = true;
>+        contentLengthHeaderPresent = false;
>
>     }
>
>@@ -595,6 +604,14 @@
>             if (buf[pos] == Constants.COLON) {
>                 colon = true;
>                 headerValue = headers.addValue(ascbuf, start, pos -
>start);
>+                if (isContentLengthHeader(ascbuf, start, pos - start)) {
>+                    if (contentLengthHeaderPresent) {
>+                        throw new IllegalArgumentException(
>+
>sm.getString("iib.multipleContentLength"));
>+                    } else {
>+                        contentLengthHeaderPresent = true;
>+                    }
>+                }
>             }
>             chr = buf[pos];
>             if ((chr >= Constants.A) && (chr <= Constants.Z)) {
>@@ -698,6 +715,24 @@
>     }
>
>
>+    protected boolean isContentLengthHeader(char[] buf, int start,
>int len) {
>+        // Do a quick length check first
>+        if (len != Constants.CONTENTLENGTH_SIZE) {
>+            return false;
>+        }
>+
>+        // It's the right length, do a charater by character test
>+        // header names are stored in lower case
>+        int pos = 0;
>+        while (pos < Constants.CONTENTLENGTH_SIZE) {
>+            if (buf[start + pos] != Constants.CONTENTLENGTH_BYTES[pos]) {
>+                return false;
>+            }
>+            pos ++;
>+        }
>+        return true;
>+    }
>+
>     // ----------------------------------------------------
>InputBuffer Methods
>
>
>Index: src/java/org/apache/coyote/http11/LocalStrings.properties
>===================================================================
>--- src/java/org/apache/coyote/http11/LocalStrings.properties
>(revision 511333)
>+++ src/java/org/apache/coyote/http11/LocalStrings.properties	(working
>copy)
>@@ -48,5 +48,5 @@
>
> iib.eof.error=Unexpected EOF read on the socket
> iib.failedread=Exception filling buffer with data from underlying
>input stream: not an EAGAIN status, so perhaps disconnected client?
>+iib.multipleContentLength=Multiple content length headers were
>detected in the request
> iib.requestheadertoolarge.error=Request header is too large
>-
>
>
>

Actions: View | Diff

Attachments on bug 237079: 152992