If chunked encoding / content-length are corrupt, we may treat parts

of one request's body as the next one's headers. To be safe, we should
disable keep-alive in this case.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1103223 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
index 9b6334d5592a6ec72c2729a2f8c089c9a4855e71..5e7abefd9532f5d963d9d30a63ca8c981320ae6b 100644 (file)
--- a/modules/http/http_filters.c
+++ b/modules/http/http_filters.c
@@ -78,6 +78,7 @@ typedef struct http_filter_ctx {
     apr_bucket_brigade *bb;
 } http_ctx_t;
 
+/* bail out if some error in the HTTP input filter happens */
 static apr_status_t bail_out_on_error(http_ctx_t *ctx,
                                       ap_filter_t *f,
                                       int http_error)
@@ -93,6 +94,11 @@ static apr_status_t bail_out_on_error(http_ctx_t *ctx,
     e = apr_bucket_eos_create(f->c->bucket_alloc);
     APR_BRIGADE_INSERT_TAIL(bb, e);
     ctx->eos_sent = 1;
+    /* If chunked encoding / content-length are corrupt, we may treat parts
+     * of this request's body as the next one's headers.
+     * To be safe, disable keep-alive.
+     */
+    f->r->connection->keepalive = AP_CONN_CLOSE;
     return ap_pass_brigade(f->r->output_filters, bb);
 }