/[Apache-SVN]
ViewVC logotype

Revision 790587


Jump to revision: Previous Next
Author: jorton
Date: Thu Jul 2 13:41:18 2009 UTC (14 years ago)
Changed paths: 2
Log Message:
Security fix for CVE-2009-1890:

* modules/proxy/mod_proxy_http.c (stream_reqbody_cl): Specify the base
  passed to apr_strtoff, and validate the Content-Length in the same
  way the HTTP_IN filter does.  If the number of bytes streamed
  exceeds the expected body length, bail out of the loop.

Thanks to: Toadie <toadie643 gmail.com> for reporting and diagnosis of
	this issue.
Submitted by: niq, jorton


Changed paths

Path Details
Directoryhttpd/httpd/trunk/CHANGES modified , text changed
Directoryhttpd/httpd/trunk/modules/proxy/mod_proxy_http.c modified , text changed

infrastructure at apache.org
ViewVC Help
Powered by ViewVC 1.1.26