https://bz.apache.org/bugzilla/show_bug.cgi?id=64919
--- Comment #17 from Furan <[email protected]> --- I applied Ethans patch to 2.4.68 and can confirm it fixes the problem. Test setup was httpd 2.4.68 built from source, talking to PHP-FPM 8.4.15 over a unix socket via SetHandler "proxy:unix:...". Reproducer is just: <?php header('X-Big: ' . str_repeat('a', (int)($_GET['n'] ?? 11000))); echo "ok"; Unpatched, anything above roughly n=8180 returns a 500 with the errors above. With the patch and responsefieldsize=65536 on the worker, I get correct responses up to n=60000. I compared the received header value against the expected string at n=11000, 31000 and 60000 - byte identical each time. With responsefieldsize unset, behaviour is identical to stock (falls back to HUGE_STRING_LEN), so the default path isn't changed. For anyone else debugging this: the failing buffer is the line buffer in ap_scan_script_header_err_core_ex (util_script.c), not the proxy io buffer. ProxyIOBufferSize and iobuffersize= do nothing here, we tried both. The scanner reads header lines through getsfunc into a MAX_STRING_LEN sized buffer, and getsfunc_BRIGADE returns 0 when the buffer fills before it finds a newline, which is where the misleading "Premature end of script headers" message comes from. So thank you Ethan for your work. Really wish this was fixed upstream, I don't really have the runway to rebuild each time a security release comes out. -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
