]> granicus.if.org Git - apache/commit
Fix closing the back end connection in case of error.
authorRainer Jung <rjung@apache.org>
Fri, 17 Aug 2012 14:54:18 +0000 (14:54 +0000)
committerRainer Jung <rjung@apache.org>
Fri, 17 Aug 2012 14:54:18 +0000 (14:54 +0000)
commit91639c2229beb4152f2bff6602aa1e46e97865ed
treebac738bf85a3d7495e799f2b7318dae1ffb2bfda
parent95aac9f440dddb75caddf1d0ad97e5c06cf182b8
Fix closing the back end connection in case of error.
The field "closed" was changed from an int to a bit
field of size one in 2.4.x.
For historical reasons a close instruction was coded
as an increment on the field, which in 2.4.x flips
the field each time. There were mutliple could paths
that would flip it several times for a single error,
so effectively the connection was no longer closed
in these cases.

Especially in the case of an aborted client connection
this lead to a non consumed back end buffer and thus to
response mixup between users.

PR 53727

CVE-2012-3052

Backport of r1373955 from trunk.

Submitted by: rjung
Reviewed by: jim, trawick

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1374297 13f79535-47bb-0310-9956-ffa450edef68
STATUS
modules/proxy/mod_proxy_ajp.c
modules/proxy/mod_proxy_http.c