altarch-user / rpms / httpd

Forked from rpms/httpd 2 years ago
Clone

Blame SOURCES/httpd-2.4.6-CVE-2014-0226.patch

008793
Index: server/scoreboard.c
008793
===================================================================
008793
--- a/server/scoreboard.c	(revision 1610498)
008793
+++ b/server/scoreboard.c	(revision 1610499)
008793
@@ -579,6 +579,21 @@
008793
                                                  sbh->thread_num);
008793
 }
008793
 
008793
+AP_DECLARE(void) ap_copy_scoreboard_worker(worker_score *dest, 
008793
+                                           int child_num,
008793
+                                           int thread_num)
008793
+{
008793
+    worker_score *ws = ap_get_scoreboard_worker_from_indexes(child_num, thread_num);
008793
+
008793
+    memcpy(dest, ws, sizeof *ws);
008793
+
008793
+    /* For extra safety, NUL-terminate the strings returned, though it
008793
+     * should be true those last bytes are always zero anyway. */
008793
+    dest->client[sizeof(dest->client) - 1] = '\0';
008793
+    dest->request[sizeof(dest->request) - 1] = '\0';
008793
+    dest->vhost[sizeof(dest->vhost) - 1] = '\0';
008793
+}
008793
+
008793
 AP_DECLARE(process_score *) ap_get_scoreboard_process(int x)
008793
 {
008793
     if ((x < 0) || (x >= server_limit)) {
008793
Index: modules/generators/mod_status.c
008793
===================================================================
008793
--- a/modules/generators/mod_status.c	(revision 1610498)
008793
+++ b/modules/generators/mod_status.c	(revision 1610499)
008793
@@ -194,7 +194,7 @@
008793
     long req_time;
008793
     int short_report;
008793
     int no_table_report;
008793
-    worker_score *ws_record;
008793
+    worker_score *ws_record = apr_palloc(r->pool, sizeof *ws_record);
008793
     process_score *ps_record;
008793
     char *stat_buffer;
008793
     pid_t *pid_buffer, worker_pid;
008793
@@ -306,7 +306,7 @@
008793
         for (j = 0; j < thread_limit; ++j) {
008793
             int indx = (i * thread_limit) + j;
008793
 
008793
-            ws_record = ap_get_scoreboard_worker_from_indexes(i, j);
008793
+            ap_copy_scoreboard_worker(ws_record, i, j);
008793
             res = ws_record->status;
008793
 
008793
             if ((i >= max_servers || j >= threads_per_child)
008793
@@ -637,7 +637,7 @@
008793
 
008793
         for (i = 0; i < server_limit; ++i) {
008793
             for (j = 0; j < thread_limit; ++j) {
008793
-                ws_record = ap_get_scoreboard_worker_from_indexes(i, j);
008793
+                ap_copy_scoreboard_worker(ws_record, i, j);
008793
 
008793
                 if (ws_record->access_count == 0 &&
008793
                     (ws_record->status == SERVER_READY ||
008793
Index: modules/lua/lua_request.c
008793
===================================================================
008793
--- a/modules/lua/lua_request.c	(revision 1610498)
008793
+++ b/modules/lua/lua_request.c	(revision 1610499)
008793
@@ -1245,16 +1245,22 @@
008793
  */
008793
 static int lua_ap_scoreboard_worker(lua_State *L)
008793
 {
008793
-    int i,
008793
-        j;
008793
-    worker_score   *ws_record;
008793
+    int i, j;
008793
+    worker_score *ws_record = NULL;
008793
+    request_rec *r = NULL;
008793
 
008793
     luaL_checktype(L, 1, LUA_TUSERDATA);
008793
     luaL_checktype(L, 2, LUA_TNUMBER);
008793
     luaL_checktype(L, 3, LUA_TNUMBER);
008793
+
008793
+    r = ap_lua_check_request_rec(L, 1);
008793
+    if (!r) return 0;
008793
+
008793
     i = lua_tointeger(L, 2);
008793
     j = lua_tointeger(L, 3);
008793
-    ws_record = ap_get_scoreboard_worker_from_indexes(i, j);
008793
+    ws_record = apr_palloc(r->pool, sizeof *ws_record);
008793
+
008793
+    ap_copy_scoreboard_worker(ws_record, i, j);
008793
     if (ws_record) {
008793
         lua_newtable(L);
008793
 
008793
Index: include/scoreboard.h
008793
===================================================================
008793
--- a/include/scoreboard.h	(revision 1610498)
008793
+++ b/include/scoreboard.h	(revision 1610499)
008793
@@ -183,8 +183,25 @@
008793
 AP_DECLARE(void) ap_time_process_request(ap_sb_handle_t *sbh, int status);
008793
 
008793
 AP_DECLARE(worker_score *) ap_get_scoreboard_worker(ap_sb_handle_t *sbh);
008793
+
008793
+/** Return a pointer to the worker_score for a given child, thread pair.
008793
+ * @param child_num The child number.
008793
+ * @param thread_num The thread number.
008793
+ * @return A pointer to the worker_score structure.
008793
+ * @deprecated This function is deprecated, use ap_copy_scoreboard_worker instead. */
008793
 AP_DECLARE(worker_score *) ap_get_scoreboard_worker_from_indexes(int child_num,
008793
                                                                 int thread_num);
008793
+
008793
+/** Copy the contents of a worker scoreboard entry.  The contents of
008793
+ * the worker_score structure are copied verbatim into the dest
008793
+ * structure.
008793
+ * @param dest Output parameter.
008793
+ * @param child_num The child number.
008793
+ * @param thread_num The thread number.
008793
+ */
008793
+AP_DECLARE(void) ap_copy_scoreboard_worker(worker_score *dest,
008793
+                                           int child_num, int thread_num);
008793
+
008793
 AP_DECLARE(process_score *) ap_get_scoreboard_process(int x);
008793
 AP_DECLARE(global_score *) ap_get_scoreboard_global(void);
008793
 
008793