Re: stop copying footers to r-headers_in?

2014-04-01 Thread Eric Covener
Resurrecting this thread. Yann, anything holding this one back? On Mon, Oct 28, 2013 at 9:43 AM, Yann Ylavic ylavic@gmail.com wrote: The declaration of ap_get_mime_headers_from() is falsy in the previous patch, you should read instead : +AP_DECLARE(apr_status_t)

CVE-2013-5704, mod_headers and chunked trailer fields

2014-04-01 Thread Joe Orton
For context: http://martin.swende.se/blog/HTTPChunked.html This was discussed a little on the security@ list last year but it's a difficult issue and there was not any consensus beyond the fact that the current behaviour is wrong, and punt to dev@. There is a separate thread about how to fix

Re: stop copying footers to r-headers_in?

2014-04-01 Thread Yann Ylavic
Sorry I stopped this along the way... IIRC, my latest patch (not posted yet) does all the necessary in ap_rgetline_ex() and ap_get_mime_headers_ex() (ie. parameters for the input filter to read from and handling of the blocking mode), parses the trailers in ap_http_filter() where they are read,

Re: stop copying footers to r-headers_in?

2014-04-01 Thread Yann Ylavic
On Tue, Apr 1, 2014 at 8:00 PM, Yann Ylavic ylavic@gmail.com wrote: +static int parse_mime_headers(request_rec *r, + apr_bucket_brigade *bb, + apr_read_type_e block, + ap_filter_t *f, apr_table_t *t, +

Re: stop copying footers to r-headers_in?

2014-04-01 Thread Eric Covener
On Tue, Apr 1, 2014 at 2:00 PM, Yann Ylavic ylavic@gmail.com wrote: Here is the corresponding patch. I don't know if it's your mail client or mine (gmail), your patches always come through as both an attachment and in the body. Usually for anything more than a few lines, attachment-only is

Re: stop copying footers to r-headers_in?

2014-04-01 Thread Mike Rumph
Hello Yann, Comment included below. Thanks, Mike Rumph On 4/1/2014 11:00 AM, Yann Ylavic wrote: Index: modules/examples/mod_example_hooks.c === --- modules/examples/mod_example_hooks.c(revision 1583714) +++

Re: stop copying footers to r-headers_in?

2014-04-01 Thread Yann Ylavic
On Tue, Apr 1, 2014 at 8:36 PM, Eric Covener cove...@gmail.com wrote: On Tue, Apr 1, 2014 at 2:00 PM, Yann Ylavic ylavic@gmail.com wrote: Here is the corresponding patch. I don't know if it's your mail client or mine (gmail), your patches always come through as both an attachment and

Re: stop copying footers to r-headers_in?

2014-04-01 Thread Yann Ylavic
Hi Mike, On Tue, Apr 1, 2014 at 9:21 PM, Mike Rumph mike.ru...@oracle.com wrote: Comment included below. On 4/1/2014 11:00 AM, Yann Ylavic wrote: Index: modules/examples/mod_example_hooks.c === ---

Re: stop copying footers to r-headers_in?

2014-04-01 Thread Yann Ylavic
On Tue, Apr 1, 2014 at 8:00 PM, Yann Ylavic ylavic@gmail.com wrote: Here is the corresponding patch. +static int parse_mime_headers(request_rec *r, + apr_bucket_brigade *bb, + apr_read_type_e block, +

Re: stop copying footers to r-headers_in?

2014-04-01 Thread Yann Ylavic
On Tue, Apr 1, 2014 at 11:35 PM, Yann Ylavic ylavic@gmail.com wrote: On Tue, Apr 1, 2014 at 8:36 PM, Eric Covener cove...@gmail.com wrote: Can you say roughly how much it has changed, I was largely through a review of the previous patch. Actually, aside from funcs/vars/params renaming,