components/apache2/patches/CVE-2014-0231.patch
branchs11u2-sru
changeset 3523 89f2ea67cddd
parent 3519 ea7de23f60d4
child 3525 d066af8ff6d0
equal deleted inserted replaced
3519:ea7de23f60d4 3523:89f2ea67cddd
     1 Patch origin: upstream
       
     2 Patch status: will be part of next version
       
     3 
       
     4 http://svn.apache.org/viewvc?view=revision&revision=1611185
       
     5 
       
     6 --- modules/generators/mod_cgid.c	2014/07/16 20:53:11	1611184
       
     7 +++ modules/generators/mod_cgid.c	2014/07/16 20:56:51	1611185
       
     8 @@ -93,6 +93,10 @@
       
     9  static pid_t parent_pid;
       
    10  static ap_unix_identity_t empty_ugid = { (uid_t)-1, (gid_t)-1, -1 };
       
    11  
       
    12 +typedef struct { 
       
    13 +    apr_interval_time_t timeout;
       
    14 +} cgid_dirconf;
       
    15 +
       
    16  /* The APR other-child API doesn't tell us how the daemon exited
       
    17   * (SIGSEGV vs. exit(1)).  The other-child maintenance function
       
    18   * needs to decide whether to restart the daemon after a failure
       
    19 @@ -934,7 +938,14 @@
       
    20      return overrides->logname ? overrides : base;
       
    21  }
       
    22  
       
    23 +static void *create_cgid_dirconf(apr_pool_t *p, char *dummy)
       
    24 +{
       
    25 +    cgid_dirconf *c = (cgid_dirconf *) apr_pcalloc(p, sizeof(cgid_dirconf));
       
    26 +    return c;
       
    27 +}
       
    28 +
       
    29  static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg)
       
    30 +
       
    31  {
       
    32      server_rec *s = cmd->server;
       
    33      cgid_server_conf *conf = ap_get_module_config(s->module_config,
       
    34 @@ -987,7 +998,16 @@
       
    35  
       
    36      return NULL;
       
    37  }
       
    38 +static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg)
       
    39 +{
       
    40 +    cgid_dirconf *dc = dummy;
       
    41  
       
    42 +    if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) { 
       
    43 +        return "CGIDScriptTimeout has wrong format";
       
    44 +    }
       
    45 + 
       
    46 +    return NULL;
       
    47 +}
       
    48  static const command_rec cgid_cmds[] =
       
    49  {
       
    50      AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF,
       
    51 @@ -999,6 +1019,10 @@
       
    52      AP_INIT_TAKE1("ScriptSock", set_script_socket, NULL, RSRC_CONF,
       
    53                    "the name of the socket to use for communication with "
       
    54                    "the cgi daemon."),
       
    55 +    AP_INIT_TAKE1("CGIDScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF,
       
    56 +                  "The amount of time to wait between successful reads from "
       
    57 +                  "the CGI script, in seconds."),
       
    58 +                  
       
    59      {NULL}
       
    60  };
       
    61  
       
    62 @@ -1335,11 +1359,15 @@
       
    63      apr_file_t *tempsock;
       
    64      struct cleanup_script_info *info;
       
    65      apr_status_t rv;
       
    66 +    cgid_dirconf *dc;
       
    67  
       
    68      if (strcmp(r->handler,CGI_MAGIC_TYPE) && strcmp(r->handler,"cgi-script"))
       
    69          return DECLINED;
       
    70  
       
    71      conf = ap_get_module_config(r->server->module_config, &cgid_module);
       
    72 +    dc = ap_get_module_config(r->per_dir_config, &cgid_module);
       
    73 +
       
    74 +    
       
    75      is_included = !strcmp(r->protocol, "INCLUDED");
       
    76  
       
    77      if ((argv0 = strrchr(r->filename, '/')) != NULL)
       
    78 @@ -1412,6 +1440,12 @@
       
    79       */
       
    80  
       
    81      apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
       
    82 +    if (dc->timeout > 0) { 
       
    83 +        apr_file_pipe_timeout_set(tempsock, dc->timeout);
       
    84 +    }
       
    85 +    else { 
       
    86 +        apr_file_pipe_timeout_set(tempsock, r->server->timeout);
       
    87 +    }
       
    88      apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
       
    89  
       
    90      if ((argv0 = strrchr(r->filename, '/')) != NULL)
       
    91 @@ -1487,6 +1521,10 @@
       
    92              if (rv != APR_SUCCESS) {
       
    93                  /* silly script stopped reading, soak up remaining message */
       
    94                  child_stopped_reading = 1;
       
    95 +                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, 
       
    96 +                              "Error writing request body to script %s", 
       
    97 +                              r->filename);
       
    98 +
       
    99              }
       
   100          }
       
   101          apr_brigade_cleanup(bb);
       
   102 @@ -1577,7 +1615,13 @@
       
   103              return HTTP_MOVED_TEMPORARILY;
       
   104          }
       
   105  
       
   106 -        ap_pass_brigade(r->output_filters, bb);
       
   107 +        rv = ap_pass_brigade(r->output_filters, bb);
       
   108 +        if (rv != APR_SUCCESS) { 
       
   109 +            /* APLOG_ERR because the core output filter message is at error,
       
   110 +             * but doesn't know it's passing CGI output 
       
   111 +             */
       
   112 +            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, "Failed to flush CGI output to client");
       
   113 +        }
       
   114      }
       
   115  
       
   116      if (nph) {
       
   117 @@ -1707,6 +1751,8 @@
       
   118      request_rec *r = f->r;
       
   119      cgid_server_conf *conf = ap_get_module_config(r->server->module_config,
       
   120                                                    &cgid_module);
       
   121 +    cgid_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgid_module);
       
   122 +
       
   123      struct cleanup_script_info *info;
       
   124  
       
   125      add_ssi_vars(r);
       
   126 @@ -1736,6 +1782,13 @@
       
   127       * get rid of the cleanup we registered when we created the socket.
       
   128       */
       
   129      apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
       
   130 +    if (dc->timeout > 0) {
       
   131 +        apr_file_pipe_timeout_set(tempsock, dc->timeout);
       
   132 +    }
       
   133 +    else {
       
   134 +        apr_file_pipe_timeout_set(tempsock, r->server->timeout);
       
   135 +    }
       
   136 +
       
   137      apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
       
   138  
       
   139      APR_BRIGADE_INSERT_TAIL(bb, apr_bucket_pipe_create(tempsock,
       
   140 @@ -1841,7 +1894,7 @@
       
   141  
       
   142  module AP_MODULE_DECLARE_DATA cgid_module = {
       
   143      STANDARD20_MODULE_STUFF,
       
   144 -    NULL, /* dir config creater */
       
   145 +    create_cgid_dirconf, /* dir config creater */
       
   146      NULL, /* dir merger --- default is to override */
       
   147      create_cgid_config, /* server config */
       
   148      merge_cgid_config, /* merge server config */