Forward port patch for CAN-2003-0253 from 2.0.

SECURITY [CAN-2003-0253]: Fixed a bug in prefork MPM causing
temporary denial of service when accept() on a rarely accessed port
returns certain errors.  Reported by Saheed Akhtar
<S.Akhtar@talis.com>.  [Jeff Trawick]

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100517 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 12fe33322e0b7f25440b5099bb3358735b7dbad0..e372321131f307783cfe95ef7b611dcc7aaa15f8 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -169,6 +169,11 @@ Changes with Apache 2.0.48
 
 Changes with Apache 2.0.47
 
+  *) SECURITY [CAN-2003-0253]: Fixed a bug in prefork MPM causing
+     temporary denial of service when accept() on a rarely accessed port
+     returns certain errors.  Reported by Saheed Akhtar
+     <S.Akhtar@talis.com>.  [Jeff Trawick]
+
   *) SECURITY [CAN-2003-0254]: Fixed a bug in ftp proxy causing denial
      of service when target host is IPv6 but proxy server can't create
      IPv6 socket.  Fixed by the reporter.  [Yoshioka Tsuneo

diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c
index 699366532d1378d772dbfe88968a9eb42c6e17d9..d9dbca81a5af4380955d9bcfc9fa0eabcc449484 100644 (file)
--- a/server/mpm/prefork/prefork.c
+++ b/server/mpm/prefork/prefork.c
@@ -625,22 +625,17 @@ static void child_main(int child_num_arg)
        /* if we accept() something we don't want to die, so we have to
         * defer the exit
         */
-       for (;;) {
-            status = listensocks[offset].accept_func(&csd, 
-                                       &listensocks[offset], ptrans);
+        status = listensocks[offset].accept_func(&csd,
+                                                 &listensocks[offset], ptrans);
+        SAFE_ACCEPT(accept_mutex_off());      /* unlock after "accept" */
 
-            if (status == APR_SUCCESS) {
-                break;
-            }
-            if (status == APR_EGENERAL) {
-                /* resource shortage or should-not-occur occured */
-                clean_child_exit(1);
-            }
-            if (APR_STATUS_IS_EINTR(status) && one_process && shutdown_pending) {
-                return;
-            }
+        if (status == APR_EGENERAL) {
+            /* resource shortage or should-not-occur occured */
+            clean_child_exit(1);
+        }
+        else if (status != APR_SUCCESS) {
+            continue;
         }
-       SAFE_ACCEPT(accept_mutex_off());        /* unlock after "accept" */
 
        /*
         * We now have a connection, so set it up with the appropriate