Attachment 924195 Details for Bug 1123504 – httpd-2.2.15-CVE-2014-0226.patch

[patch] httpd-2.2.15-CVE-2014-0226.patch

httpd-2.2.15-CVE-2014-0226.patch (text/plain), 3.02 KB, created by Jan Kaluža on 2014-08-05 12:38:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Kaluža

Created: 2014-08-05 12:38:12 UTC

Size: 3.02 KB

patch

obsolete

>Index: server/scoreboard.c
>===================================================================
>--- a/server/scoreboard.c	(revision 1610514)
>+++ b/server/scoreboard.c	(revision 1610515)
>@@ -510,6 +510,21 @@
>     return &ap_scoreboard_image->servers[x][y];
> }
> 
>+AP_DECLARE(void) ap_copy_scoreboard_worker(worker_score *dest, 
>+                                           int child_num,
>+                                           int thread_num)
>+{
>+    worker_score *ws = ap_get_scoreboard_worker(child_num, thread_num);
>+
>+    memcpy(dest, ws, sizeof *ws);
>+
>+    /* For extra safety, NUL-terminate the strings returned, though it
>+     * should be true those last bytes are always zero anyway. */
>+    dest->client[sizeof(dest->client) - 1] = '\0';
>+    dest->request[sizeof(dest->request) - 1] = '\0';
>+    dest->vhost[sizeof(dest->vhost) - 1] = '\0';
>+}
>+
> AP_DECLARE(process_score *) ap_get_scoreboard_process(int x)
> {
>     if ((x < 0) || (server_limit < x)) {
>Index: modules/generators/mod_status.c
>===================================================================
>--- a/modules/generators/mod_status.c	(revision 1610514)
>+++ b/modules/generators/mod_status.c	(revision 1610515)
>@@ -241,7 +241,7 @@
> #endif
>     int short_report;
>     int no_table_report;
>-    worker_score *ws_record;
>+    worker_score *ws_record = apr_palloc(r->pool, sizeof *ws_record);
>     process_score *ps_record;
>     char *stat_buffer;
>     pid_t *pid_buffer, worker_pid;
>@@ -333,7 +333,7 @@
>         for (j = 0; j < thread_limit; ++j) {
>             int indx = (i * thread_limit) + j;
> 
>-            ws_record = ap_get_scoreboard_worker(i, j);
>+            ap_copy_scoreboard_worker(ws_record, i, j);
>             res = ws_record->status;
>             stat_buffer[indx] = status_flags[res];
> 
>Index: include/scoreboard.h
>===================================================================
>--- a/include/scoreboard.h	(revision 1610514)
>+++ b/include/scoreboard.h	(revision 1610515)
>@@ -189,7 +189,24 @@
>                                                     int status, request_rec *r);
> void ap_time_process_request(ap_sb_handle_t *sbh, int status);
> 
>+/** Return a pointer to the worker_score for a given child, thread pair.
>+ * @param child_num The child number.
>+ * @param thread_num The thread number.
>+ * @return A pointer to the worker_score structure.
>+ * @deprecated This function is deprecated, use ap_copy_scoreboard_worker instead. 
>+ */
> AP_DECLARE(worker_score *) ap_get_scoreboard_worker(int x, int y);
>+
>+/** Copy the contents of a worker's scoreboard entry.  The contents of
>+ * the worker_score structure are copied verbatim into the dest
>+ * structure.
>+ * @param dest Output parameter.
>+ * @param child_num The child number.
>+ * @param thread_num The thread number.
>+ */
>+AP_DECLARE(void) ap_copy_scoreboard_worker(worker_score *dest,
>+                                           int child_num, int thread_num);
>+
> AP_DECLARE(process_score *) ap_get_scoreboard_process(int x);
> AP_DECLARE(global_score *) ap_get_scoreboard_global(void);
> AP_DECLARE(lb_score *) ap_get_scoreboard_lb(int lb_num);

Actions: View | Diff

Attachments on bug 1123504: 924195