Changeset 1986

Timestamp:

09/06/2007 09:18:43 PM (11 months ago)

Author:

jan

Message:

fixed FastCGI header overrun in mod_fastcgi (reported by
mattias@secweb.se)

Files:

• trunk/NEWS (modified) (1 diff)
• trunk/src/mod_proxy_backend_fastcgi.c (modified) (1 diff)

trunk/NEWS

@@ -22 +22 @@
-  * fixed mysql server reconnects (#518)
-  * fixed prctl() usage (#1310, #1333)
+  * fixed FastCGI header overrun in mod_fastcgi (reported by mattias@secweb.se)
-
-- 1.4.14 - ???

trunk/src/mod_proxy_backend_fastcgi.c

@@ -314 +314 @@
-        len += key_len > 127 ? 4 : 1;
-        len += val_len > 127 ? 4 : 1;
+
+        /**
+         * ensure we don't create a longer packet than fastcgi can handle
+         */
+        if (env->used + len >= FCGI_MAX_LENGTH) {
+                return -1;
+        }
-
-        buffer_prepare_append(env, len);