diff options
author | Cliff Woolley <jwoolley@apache.org> | 2002-06-18 01:30:34 +0000 |
---|---|---|
committer | Cliff Woolley <jwoolley@apache.org> | 2002-06-18 01:30:34 +0000 |
commit | 8386cb3bdd039d31d66d6f50daec5244bcf91677 (patch) | |
tree | 7b7d66ddfd8bfe6a5c606210fdbf2fc57901c2f0 | |
parent | 20dabc51edcead9608cfb0e3c6426e40ac6a66fa (diff) | |
download | httpd-APACHE_2_0_39_BRANCH.tar.gz |
alright, so I messed up the last branch attempt. :( anyway, let's tryAPACHE_2_0_39_BRANCH
that again, this time with rev's 1.438 and 1.439 from the main branch.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/APACHE_2_0_39_BRANCH@95750 13f79535-47bb-0310-9956-ffa450edef68
-rw-r--r-- | modules/http/http_protocol.c | 46 |
1 files changed, 41 insertions, 5 deletions
diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c index 7cdc2b8e6e..4bbcf1562e 100644 --- a/modules/http/http_protocol.c +++ b/modules/http/http_protocol.c @@ -794,14 +794,39 @@ apr_status_t ap_http_filter(ap_filter_t *f, apr_bucket_brigade *b, } else if (lenp) { const char *pos = lenp; + int conversion_error = 0; + /* This ensures that the number can not be negative. */ while (apr_isdigit(*pos) || apr_isspace(*pos)) { ++pos; } if (*pos == '\0') { + char *endstr; + + errno = 0; ctx->state = BODY_LENGTH; - ctx->remaining = atol(lenp); + ctx->remaining = strtol(lenp, &endstr, 10); + + if (errno || (endstr && *endstr)) { + conversion_error = 1; + } + } + + if (*pos != '\0' || conversion_error) { + apr_bucket_brigade *bb; + + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, f->r, + "Invalid Content-Length"); + + bb = apr_brigade_create(f->r->pool, f->c->bucket_alloc); + e = ap_bucket_error_create(HTTP_REQUEST_ENTITY_TOO_LARGE, NULL, + f->r->pool, f->c->bucket_alloc); + APR_BRIGADE_INSERT_TAIL(bb, e); + e = apr_bucket_eos_create(f->c->bucket_alloc); + APR_BRIGADE_INSERT_TAIL(bb, e); + ctx->eos_sent = 1; + return ap_pass_brigade(f->r->output_filters, bb); } /* If we have a limit in effect and we know the C-L ahead of @@ -1683,17 +1708,28 @@ AP_DECLARE(int) ap_setup_client_block(request_rec *r, int read_policy) } else if (lenp) { const char *pos = lenp; + int conversion_error = 0; while (apr_isdigit(*pos) || apr_isspace(*pos)) { ++pos; } - if (*pos != '\0') { + + if (*pos == '\0') { + char *endstr; + + errno = 0; + r->remaining = strtol(lenp, &endstr, 10); + + if (errno || (endstr && *endstr)) { + conversion_error = 1; + } + } + + if (*pos != '\0' || conversion_error) { ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, - "Invalid Content-Length %s", lenp); + "Invalid Content-Length"); return HTTP_BAD_REQUEST; } - - r->remaining = atol(lenp); } if ((r->read_body == REQUEST_NO_BODY) |