diff options
| author | Joe Orton <jorton@apache.org> | 2014-07-14 19:26:00 +0000 |
|---|---|---|
| committer | Joe Orton <jorton@apache.org> | 2014-07-14 19:26:00 +0000 |
| commit | b2605d20c42fe882a42f55d059286f64927ac30d (patch) | |
| tree | 65c09cc1dc1875766ff9c4257749972813417ee5 /modules/generators | |
| parent | 5b6b58bbf228de54e6222d6bd5eef46f0a16f2f9 (diff) | |
| download | httpd-b2605d20c42fe882a42f55d059286f64927ac30d.tar.gz | |
SECURITY (CVE-2014-0226): Fix a race condition in scoreboard handling,
which could lead to a heap buffer overflow. Thanks to Marek Kroemeke
working with HP's Zero Day Initiative for reporting this.
* include/scoreboard.h: Add ap_copy_scoreboard_worker.
* server/scoreboard.c (ap_copy_scoreboard_worker): New function.
* modules/generators/mod_status.c (status_handler): Use it.
* modules/lua/lua_request.c (lua_ap_scoreboard_worker): Likewise.
Reviewed by: trawick, jorton, covener, jim
Submitted by: jorton, covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610491 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'modules/generators')
| -rw-r--r-- | modules/generators/mod_status.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c index fe832b32d0..6bcf592b57 100644 --- a/modules/generators/mod_status.c +++ b/modules/generators/mod_status.c @@ -194,7 +194,7 @@ static int status_handler(request_rec *r) long req_time; int short_report; int no_table_report; - worker_score *ws_record; + worker_score *ws_record = apr_palloc(r->pool, sizeof *ws_record); process_score *ps_record; char *stat_buffer; pid_t *pid_buffer, worker_pid; @@ -306,7 +306,7 @@ static int status_handler(request_rec *r) for (j = 0; j < thread_limit; ++j) { int indx = (i * thread_limit) + j; - ws_record = ap_get_scoreboard_worker_from_indexes(i, j); + ap_copy_scoreboard_worker(ws_record, i, j); res = ws_record->status; if ((i >= max_servers || j >= threads_per_child) @@ -637,7 +637,7 @@ static int status_handler(request_rec *r) for (i = 0; i < server_limit; ++i) { for (j = 0; j < thread_limit; ++j) { - ws_record = ap_get_scoreboard_worker_from_indexes(i, j); + ap_copy_scoreboard_worker(ws_record, i, j); if (ws_record->access_count == 0 && (ws_record->status == SERVER_READY || |