]> granicus.if.org Git - apache/commit
SECURITY: CVE-2017-9789: Read after free in mod_http2.
authorJim Jagielski <jim@apache.org>
Tue, 4 Jul 2017 12:34:15 +0000 (12:34 +0000)
committerJim Jagielski <jim@apache.org>
Tue, 4 Jul 2017 12:34:15 +0000 (12:34 +0000)
commita9067ba9f7ea0de1adddad3e7a01c8c8a91b70f1
treeec275c7de78d80e8f45a0cce0c8955009782f66b
parentc14c10a4f0acb55b4c381a487117a484f2d7129e
SECURITY: CVE-2017-9789: Read after free in mod_http2.

When under stress, closing many connections, the HTTP/2
handling code would sometimes access memory after it has
been freed, resulting in potentially erratic behaviour.

Merge r1800689 from trunk:

Disable and give warning when mpm_prefork is encountered.
The server will continue to work, but HTTP/2 will no longer be negotiated.

Submitted by: icing
Reviewed by: icing, ylavic, jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1800774 13f79535-47bb-0310-9956-ffa450edef68
12 files changed:
CHANGES
STATUS
modules/http2/h2_conn.c
modules/http2/h2_conn.h
modules/http2/h2_mplx.c
modules/http2/h2_mplx.h
modules/http2/h2_session.c
modules/http2/h2_stream.c
modules/http2/h2_switch.c
modules/http2/h2_util.c
modules/http2/h2_workers.c
modules/http2/mod_http2.c