[Pkg-apache-commits] r1341 - /trunk/apache2/patches/083_CVE-2011-3192.dpatch

[sf at alioth.debian.org]

Author: sf
Date: Mon Aug 29 15:07:25 2011
New Revision: 1341

URL: http://svn.debian.org/wsvn/pkg-apache/?sc=1&rev=1341
Log:
update CVE-2011-3192 patch

Modified:
    trunk/apache2/patches/083_CVE-2011-3192.dpatch

Modified: trunk/apache2/patches/083_CVE-2011-3192.dpatch
URL: http://svn.debian.org/wsvn/pkg-apache/trunk/apache2/patches/083_CVE-2011-3192.dpatch?rev=1341&op=diff
==============================================================================
--- trunk/apache2/patches/083_CVE-2011-3192.dpatch (original)
+++ trunk/apache2/patches/083_CVE-2011-3192.dpatch Mon Aug 29 15:07:25 2011
@@ -9,7 +9,7 @@
 @DPATCH@
 diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' trunk~/modules/http/byterange_filter.c trunk/modules/http/byterange_filter.c
 --- trunk~/modules/http/byterange_filter.c	2010-02-26 10:32:15.000000000 +0100
-+++ trunk/modules/http/byterange_filter.c	2011-08-28 22:27:27.452862404 +0200
++++ trunk/modules/http/byterange_filter.c	2011-08-29 17:06:23.756431405 +0200
 @@ -55,65 +55,8 @@
  #include <unistd.h>
  #endif
@@ -78,7 +78,7 @@
  
  /*
   * Here we try to be compatible with clients that want multipart/x-byteranges
-@@ -131,28 +74,204 @@
+@@ -131,28 +74,205 @@
  }
  
  #define BYTERANGE_FMT "%" APR_OFF_T_FMT "-%" APR_OFF_T_FMT "/%" APR_OFF_T_FMT
@@ -279,6 +279,7 @@
 +    char *bound_head = NULL;
 +    apr_array_header_t *indexes;
 +    indexes_t *idx;
++    int original_status;
 +    int i;
  
 -    /* Iterate through the brigade until reaching EOS or a bucket with
@@ -290,7 +291,7 @@
      for (e = APR_BRIGADE_FIRST(bb);
           (e != APR_BRIGADE_SENTINEL(bb) && !APR_BUCKET_IS_EOS(e)
            && e->length != (apr_size_t)-1);
-@@ -160,16 +279,18 @@
+@@ -160,90 +280,80 @@
          clength += e->length;
      }
  
@@ -308,11 +309,13 @@
      }
  
 -    num_ranges = ap_set_byterange(r);
++    original_status = r->status;
 +    num_ranges = ap_set_byterange(r, clength, &indexes);
  
      /* We have nothing to do, get out of the way. */
      if (num_ranges == 0) {
-@@ -177,73 +298,59 @@
++        r->status = original_status;
+         ap_remove_output_filter(f);
          return ap_pass_brigade(f->next, bb);
      }
  
@@ -414,7 +417,7 @@
              apr_table_setn(r->headers_out, "Content-Range",
                             apr_psprintf(r->pool, "bytes " BYTERANGE_FMT,
                                          range_start, range_end, clength));
-@@ -251,7 +358,7 @@
+@@ -251,7 +361,7 @@
          else {
              char *ts;
  
@@ -423,7 +426,7 @@
                                         r->pool, c->bucket_alloc);
              APR_BRIGADE_INSERT_TAIL(bsend, e);
  
-@@ -263,23 +370,13 @@
+@@ -263,23 +373,19 @@
              APR_BRIGADE_INSERT_TAIL(bsend, e);
          }
  
@@ -446,7 +449,13 @@
 -        } while (ec != e2);
 +        APR_BRIGADE_CONCAT(bsend, tmpbb);
 +        if (i && i % 32 == 0) {
-+            /* Every now and then, pass what we have down the filter chain */
++            /*
++             * Every now and then, pass what we have down the filter chain.
++             * In this case, the content-length filter cannot calculate and
++             * set the content length and we must remove any Content-Length
++             * header already present.
++             */
++            apr_table_unset(r->headers_out, "Content-Length");
 +            if ((rv = ap_pass_brigade(f->next, bsend)) != APR_SUCCESS)
 +                return rv;
 +            apr_brigade_cleanup(bsend);
@@ -454,7 +463,7 @@
      }
  
      if (found == 0) {
-@@ -294,11 +391,11 @@
+@@ -294,11 +400,11 @@
          return ap_pass_brigade(f->next, bsend);
      }
  
@@ -468,7 +477,7 @@
          ap_xlate_proto_to_ascii(end, strlen(end));
          e = apr_bucket_pool_create(end, strlen(end), r->pool, c->bucket_alloc);
          APR_BRIGADE_INSERT_TAIL(bsend, e);
-@@ -309,24 +406,32 @@
+@@ -309,24 +415,32 @@
  
      /* we're done with the original content - all of our data is in bsend. */
      apr_brigade_cleanup(bb);
@@ -504,7 +513,7 @@
       * backwards-compatibility with second-draft Luotonen/Franks
       * byte-ranges (e.g. Netscape Navigator 2-3).
       *
-@@ -356,7 +461,8 @@
+@@ -356,7 +470,8 @@
         return 0;
      }
  
@@ -514,7 +523,7 @@
       * Note that this check will return false (as required) if either
       * of the two etags are weak.
       */
-@@ -373,17 +479,77 @@
+@@ -373,17 +488,77 @@
          }
      }