components/apache2/patches/CVE-2014-0226.patch
branchs11-update
changeset 3269 56b0e19454ba
equal deleted inserted replaced
3267:442b27130f7a 3269:56b0e19454ba
       
     1 Patch origin: upstream
       
     2 Patch status: will be part of next version
       
     3 
       
     4 http://svn.apache.org/viewvc?view=revision&revision=1610515
       
     5 
       
     6 --- include/ap_mmn.h	2014/07/14 20:23:27	1610514
       
     7 +++ include/ap_mmn.h	2014/07/14 20:34:32	1610515
       
     8 @@ -151,6 +151,7 @@
       
     9   * 20051115.31 (2.2.23) Add forcerecovery to proxy_balancer_shared struct
       
    10   * 20051115.32 (2.2.24) Add ap_get_exec_line
       
    11   * 20051115.33 (2.2.24) Add ap_pregsub_ex()
       
    12 + * 20051115.34 (2.2.28) Add ap_copy_scoreboard_worker()
       
    13   */
       
    14  
       
    15  #define MODULE_MAGIC_COOKIE 0x41503232UL /* "AP22" */
       
    16 @@ -158,7 +159,7 @@
       
    17  #ifndef MODULE_MAGIC_NUMBER_MAJOR
       
    18  #define MODULE_MAGIC_NUMBER_MAJOR 20051115
       
    19  #endif
       
    20 -#define MODULE_MAGIC_NUMBER_MINOR 33                    /* 0...n */
       
    21 +#define MODULE_MAGIC_NUMBER_MINOR 34                    /* 0...n */
       
    22  
       
    23  /**
       
    24   * Determine if the server's current MODULE_MAGIC_NUMBER is at least a
       
    25 --- include/scoreboard.h	2014/07/14 20:23:27	1610514
       
    26 +++ include/scoreboard.h	2014/07/14 20:34:32	1610515
       
    27 @@ -189,7 +189,24 @@
       
    28                                                      int status, request_rec *r);
       
    29  void ap_time_process_request(ap_sb_handle_t *sbh, int status);
       
    30  
       
    31 +/** Return a pointer to the worker_score for a given child, thread pair.
       
    32 + * @param child_num The child number.
       
    33 + * @param thread_num The thread number.
       
    34 + * @return A pointer to the worker_score structure.
       
    35 + * @deprecated This function is deprecated, use ap_copy_scoreboard_worker instead. 
       
    36 + */
       
    37  AP_DECLARE(worker_score *) ap_get_scoreboard_worker(int x, int y);
       
    38 +
       
    39 +/** Copy the contents of a worker's scoreboard entry.  The contents of
       
    40 + * the worker_score structure are copied verbatim into the dest
       
    41 + * structure.
       
    42 + * @param dest Output parameter.
       
    43 + * @param child_num The child number.
       
    44 + * @param thread_num The thread number.
       
    45 + */
       
    46 +AP_DECLARE(void) ap_copy_scoreboard_worker(worker_score *dest,
       
    47 +                                           int child_num, int thread_num);
       
    48 +
       
    49  AP_DECLARE(process_score *) ap_get_scoreboard_process(int x);
       
    50  AP_DECLARE(global_score *) ap_get_scoreboard_global(void);
       
    51  AP_DECLARE(lb_score *) ap_get_scoreboard_lb(int lb_num);
       
    52 --- modules/generators/mod_status.c	2014/07/14 20:23:27	1610514
       
    53 +++ modules/generators/mod_status.c	2014/07/14 20:34:32	1610515
       
    54 @@ -241,7 +241,7 @@
       
    55  #endif
       
    56      int short_report;
       
    57      int no_table_report;
       
    58 -    worker_score *ws_record;
       
    59 +    worker_score *ws_record = apr_palloc(r->pool, sizeof *ws_record);
       
    60      process_score *ps_record;
       
    61      char *stat_buffer;
       
    62      pid_t *pid_buffer, worker_pid;
       
    63 @@ -333,7 +333,7 @@
       
    64          for (j = 0; j < thread_limit; ++j) {
       
    65              int indx = (i * thread_limit) + j;
       
    66  
       
    67 -            ws_record = ap_get_scoreboard_worker(i, j);
       
    68 +            ap_copy_scoreboard_worker(ws_record, i, j);
       
    69              res = ws_record->status;
       
    70              stat_buffer[indx] = status_flags[res];
       
    71  
       
    72 --- server/scoreboard.c	2014/07/14 20:23:27	1610514
       
    73 +++ server/scoreboard.c	2014/07/14 20:34:32	1610515
       
    74 @@ -510,6 +510,21 @@
       
    75      return &ap_scoreboard_image->servers[x][y];
       
    76  }
       
    77  
       
    78 +AP_DECLARE(void) ap_copy_scoreboard_worker(worker_score *dest, 
       
    79 +                                           int child_num,
       
    80 +                                           int thread_num)
       
    81 +{
       
    82 +    worker_score *ws = ap_get_scoreboard_worker(child_num, thread_num);
       
    83 +
       
    84 +    memcpy(dest, ws, sizeof *ws);
       
    85 +
       
    86 +    /* For extra safety, NUL-terminate the strings returned, though it
       
    87 +     * should be true those last bytes are always zero anyway. */
       
    88 +    dest->client[sizeof(dest->client) - 1] = '\0';
       
    89 +    dest->request[sizeof(dest->request) - 1] = '\0';
       
    90 +    dest->vhost[sizeof(dest->vhost) - 1] = '\0';
       
    91 +}
       
    92 +
       
    93  AP_DECLARE(process_score *) ap_get_scoreboard_process(int x)
       
    94  {
       
    95      if ((x < 0) || (server_limit < x)) {