Ensure that ap_http_filter can not be coersced into reading more than we

think is currently available.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@91462 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
index a64ae49223052276d9822afe1aacd381744bcc8e..cf1ab764b6d4d27b9f71999dfc79c61d3e87fb39 100644 (file)
--- a/modules/http/http_protocol.c
+++ b/modules/http/http_protocol.c
@@ -576,6 +576,12 @@ apr_status_t ap_http_filter(ap_filter_t *f, apr_bucket_brigade *b, ap_input_mode
         }
     }
 
+    /* Ensure that the caller can not go over our boundary point. */
+    if ((ctx->state == BODY_LENGTH || ctx->state == BODY_CHUNK) && 
+        ctx->remaining < *readbytes) {
+        *readbytes = ctx->remaining;
+    }
+
     rv = ap_get_brigade(f->next, b, mode, readbytes);
 
     if (rv != APR_SUCCESS)