Apply by doing:
cd /usr/src
patch -p0 < 005_httpd.patch
And then rebuild and install httpd:
cd usr.sbin/httpd
make -f Makefile.bsd-wrapper obj
make -f Makefile.bsd-wrapper cleandir
make -f Makefile.bsd-wrapper
make -f Makefile.bsd-wrapper install
Index: usr.sbin/httpd/src/main/http_protocol.c
===================================================================
RCS file: /cvs/src/usr.sbin/httpd/src/main/http_protocol.c,v
retrieving revision 1.10
retrieving revision 1.10.2.1
diff -u -r1.10 -r1.10.2.1
--- usr.sbin/httpd/src/main/http_protocol.c 2002/03/29 02:08:06 1.10
+++ usr.sbin/httpd/src/main/http_protocol.c 2002/06/17 20:34:46 1.10.2.1
@@ -2028,21 +2028,34 @@
static long get_chunk_size(char *b)
{
long chunksize = 0;
+ long chunkbits = sizeof(long) * 8;
- while (ap_isxdigit(*b)) {
+ /* Skip leading zeros */
+ while (*b == '0') {
+ ++b;
+ }
+
+ while (ap_isxdigit(*b) && (chunkbits > 0)) {
int xvalue = 0;
- /* This works even on EBCDIC. */
- if (*b >= '0' && *b <= '9')
+ if (*b >= '0' && *b <= '9') {
xvalue = *b - '0';
- else if (*b >= 'A' && *b <= 'F')
+ }
+ else if (*b >= 'A' && *b <= 'F') {
xvalue = *b - 'A' + 0xa;
- else if (*b >= 'a' && *b <= 'f')
+ }
+ else if (*b >= 'a' && *b <= 'f') {
xvalue = *b - 'a' + 0xa;
+ }
chunksize = (chunksize << 4) | xvalue;
+ chunkbits -= 4;
++b;
}
+ if (ap_isxdigit(*b) && (chunkbits <= 0)) {
+ /* overflow */
+ return -1;
+ }
return chunksize;
}
@@ -2126,6 +2139,10 @@
return 0;
}
r->remaining = -1; /* Indicate footers in-progress */
+ }
+ else if (len_to_read < 0) {
+ r->connection->keepalive = -1;
+ return -1;
}
else {
r->remaining = len_to_read;