Blame SOURCES/httpd-2.4.6-CVE-2014-0118.patch

331623
diff --git a/modules/filters/mod_deflate.c b/modules/filters/mod_deflate.c
331623
index 79f6f8d..6c415c8 100644
331623
--- a/modules/filters/mod_deflate.c
331623
+++ b/modules/filters/mod_deflate.c
331623
@@ -37,6 +37,7 @@
331623
 #include "httpd.h"
331623
 #include "http_config.h"
331623
 #include "http_log.h"
331623
+#include "http_core.h"
331623
 #include "apr_lib.h"
331623
 #include "apr_strings.h"
331623
 #include "apr_general.h"
331623
@@ -52,6 +53,9 @@
331623
 static const char deflateFilterName[] = "DEFLATE";
331623
 module AP_MODULE_DECLARE_DATA deflate_module;
331623
 
331623
+#define AP_INFLATE_RATIO_LIMIT 200
331623
+#define AP_INFLATE_RATIO_BURST 3
331623
+
331623
 typedef struct deflate_filter_config_t
331623
 {
331623
     int windowSize;
331623
@@ -63,6 +67,12 @@ typedef struct deflate_filter_config_t
331623
     char *note_output_name;
331623
 } deflate_filter_config;
331623
 
331623
+typedef struct deflate_dirconf_t {
331623
+    apr_off_t inflate_limit;
331623
+    int ratio_limit,
331623
+        ratio_burst;
331623
+} deflate_dirconf_t;
331623
+
331623
 /* RFC 1952 Section 2.3 defines the gzip header:
331623
  *
331623
  * +---+---+---+---+---+---+---+---+---+---+
331623
@@ -204,6 +214,14 @@ static void *create_deflate_server_config(apr_pool_t *p, server_rec *s)
331623
     return c;
331623
 }
331623
 
331623
+static void *create_deflate_dirconf(apr_pool_t *p, char *dummy)
331623
+{
331623
+    deflate_dirconf_t *dc = apr_pcalloc(p, sizeof(*dc));
331623
+    dc->ratio_limit = AP_INFLATE_RATIO_LIMIT;
331623
+    dc->ratio_burst = AP_INFLATE_RATIO_BURST;
331623
+    return dc;
331623
+}
331623
+
331623
 static const char *deflate_set_window_size(cmd_parms *cmd, void *dummy,
331623
                                            const char *arg)
331623
 {
331623
@@ -295,6 +313,55 @@ static const char *deflate_set_compressionlevel(cmd_parms *cmd, void *dummy,
331623
     return NULL;
331623
 }
331623
 
331623
+
331623
+static const char *deflate_set_inflate_limit(cmd_parms *cmd, void *dirconf,
331623
+                                      const char *arg)
331623
+{
331623
+    deflate_dirconf_t *dc = (deflate_dirconf_t*) dirconf;
331623
+    char *errp;
331623
+
331623
+    if (APR_SUCCESS != apr_strtoff(&dc->inflate_limit, arg, &errp, 10)) {
331623
+        return "DeflateInflateLimitRequestBody is not parsable.";
331623
+    }
331623
+    if (*errp || dc->inflate_limit < 0) {
331623
+        return "DeflateInflateLimitRequestBody requires a non-negative integer.";
331623
+    }
331623
+
331623
+    return NULL;
331623
+}
331623
+
331623
+static const char *deflate_set_inflate_ratio_limit(cmd_parms *cmd,
331623
+                                                   void *dirconf,
331623
+                                                   const char *arg)
331623
+{
331623
+    deflate_dirconf_t *dc = (deflate_dirconf_t*) dirconf;
331623
+    int i;
331623
+
331623
+    i = atoi(arg);
331623
+    if (i <= 0)
331623
+        return "DeflateInflateRatioLimit must be positive";
331623
+
331623
+    dc->ratio_limit = i;
331623
+
331623
+    return NULL;
331623
+}
331623
+
331623
+static const char *deflate_set_inflate_ratio_burst(cmd_parms *cmd,
331623
+                                                   void *dirconf,
331623
+                                                   const char *arg)
331623
+{
331623
+    deflate_dirconf_t *dc = (deflate_dirconf_t*) dirconf;
331623
+    int i;
331623
+
331623
+    i = atoi(arg);
331623
+    if (i <= 0)
331623
+        return "DeflateInflateRatioBurst must be positive";
331623
+
331623
+    dc->ratio_burst = i;
331623
+
331623
+    return NULL;
331623
+}
331623
+
331623
 typedef struct deflate_ctx_t
331623
 {
331623
     z_stream stream;
331623
@@ -304,6 +371,8 @@ typedef struct deflate_ctx_t
331623
     int (*libz_end_func)(z_streamp);
331623
     unsigned char *validation_buffer;
331623
     apr_size_t validation_buffer_length;
331623
+    int ratio_hits;
331623
+    apr_off_t inflate_total;
331623
     unsigned int inflate_init:1;
331623
     unsigned int filter_init:1;
331623
     unsigned int done:1;
331623
@@ -422,6 +491,22 @@ static void deflate_check_etag(request_rec *r, const char *transform)
331623
     }
331623
 }
331623
 
331623
+/* Check whether the (inflate) ratio exceeds the configured limit/burst. */
331623
+static int check_ratio(request_rec *r, deflate_ctx *ctx,
331623
+                       const deflate_dirconf_t *dc)
331623
+{
331623
+    if (ctx->stream.total_in) {
331623
+        int ratio = ctx->stream.total_out / ctx->stream.total_in;
331623
+        if (ratio < dc->ratio_limit) {
331623
+            ctx->ratio_hits = 0;
331623
+        }
331623
+        else if (++ctx->ratio_hits > dc->ratio_burst) {
331623
+            return 0;
331623
+        }
331623
+    }
331623
+    return 1;
331623
+}
331623
+
331623
 static int have_ssl_compression(request_rec *r)
331623
 {
331623
     const char *comp;
331623
@@ -897,6 +982,8 @@ static apr_status_t deflate_in_filter(ap_filter_t *f,
331623
     int zRC;
331623
     apr_status_t rv;
331623
     deflate_filter_config *c;
331623
+    deflate_dirconf_t *dc;
331623
+    apr_off_t inflate_limit;
331623
 
331623
     /* just get out of the way of things we don't want. */
331623
     if (mode != AP_MODE_READBYTES) {
331623
@@ -904,6 +991,7 @@ static apr_status_t deflate_in_filter(ap_filter_t *f,
331623
     }
331623
 
331623
     c = ap_get_module_config(r->server->module_config, &deflate_module);
331623
+    dc = ap_get_module_config(r->per_dir_config, &deflate_module);
331623
 
331623
     if (!ctx) {
331623
         char deflate_hdr[10];
331623
@@ -994,6 +1082,12 @@ static apr_status_t deflate_in_filter(ap_filter_t *f,
331623
         apr_brigade_cleanup(ctx->bb);
331623
     }
331623
 
331623
+    inflate_limit = dc->inflate_limit; 
331623
+    if (inflate_limit == 0) { 
331623
+        /* The core is checking the deflated body, we'll check the inflated */
331623
+        inflate_limit = ap_get_limit_req_body(f->r);
331623
+    }
331623
+
331623
     if (APR_BRIGADE_EMPTY(ctx->proc_bb)) {
331623
         rv = ap_get_brigade(f->next, ctx->bb, mode, block, readbytes);
331623
 
331623
@@ -1038,6 +1132,17 @@ static apr_status_t deflate_in_filter(ap_filter_t *f,
331623
 
331623
                 ctx->stream.next_out = ctx->buffer;
331623
                 len = c->bufferSize - ctx->stream.avail_out;
331623
+ 
331623
+                ctx->inflate_total += len;
331623
+                if (inflate_limit && ctx->inflate_total > inflate_limit) { 
331623
+                    inflateEnd(&ctx->stream);
331623
+                    ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(02647)
331623
+                            "Inflated content length of %" APR_OFF_T_FMT
331623
+                            " is larger than the configured limit"
331623
+                            " of %" APR_OFF_T_FMT, 
331623
+                            ctx->inflate_total, inflate_limit);
331623
+                    return APR_ENOSPC;
331623
+                }
331623
 
331623
                 ctx->crc = crc32(ctx->crc, (const Bytef *)ctx->buffer, len);
331623
                 tmp_heap = apr_bucket_heap_create((char *)ctx->buffer, len,
331623
@@ -1073,6 +1178,26 @@ static apr_status_t deflate_in_filter(ap_filter_t *f,
331623
                     ctx->stream.next_out = ctx->buffer;
331623
                     len = c->bufferSize - ctx->stream.avail_out;
331623
 
331623
+                    ctx->inflate_total += len;
331623
+                    if (inflate_limit && ctx->inflate_total > inflate_limit) { 
331623
+                        inflateEnd(&ctx->stream);
331623
+                        ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(02648)
331623
+                                "Inflated content length of %" APR_OFF_T_FMT
331623
+                                " is larger than the configured limit"
331623
+                                " of %" APR_OFF_T_FMT, 
331623
+                                ctx->inflate_total, inflate_limit);
331623
+                        return APR_ENOSPC;
331623
+                    }
331623
+
331623
+                    if (!check_ratio(r, ctx, dc)) {
331623
+                        inflateEnd(&ctx->stream);
331623
+                        ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(02649)
331623
+                                "Inflated content ratio is larger than the "
331623
+                                "configured limit %i by %i time(s)",
331623
+                                dc->ratio_limit, dc->ratio_burst);
331623
+                        return APR_EINVAL;
331623
+                    }
331623
+
331623
                     ctx->crc = crc32(ctx->crc, (const Bytef *)ctx->buffer, len);
331623
                     tmp_heap = apr_bucket_heap_create((char *)ctx->buffer, len,
331623
                                                       NULL, f->c->bucket_alloc);
331623
@@ -1193,6 +1318,7 @@ static apr_status_t inflate_out_filter(ap_filter_t *f,
331623
     int zRC;
331623
     apr_status_t rv;
331623
     deflate_filter_config *c;
331623
+    deflate_dirconf_t *dc;
331623
 
331623
     /* Do nothing if asked to filter nothing. */
331623
     if (APR_BRIGADE_EMPTY(bb)) {
331623
@@ -1200,6 +1326,7 @@ static apr_status_t inflate_out_filter(ap_filter_t *f,
331623
     }
331623
 
331623
     c = ap_get_module_config(r->server->module_config, &deflate_module);
331623
+    dc = ap_get_module_config(r->per_dir_config, &deflate_module);
331623
 
331623
     if (!ctx) {
331623
 
331623
@@ -1462,6 +1589,14 @@ static apr_status_t inflate_out_filter(ap_filter_t *f,
331623
         while (ctx->stream.avail_in != 0) {
331623
             if (ctx->stream.avail_out == 0) {
331623
 
331623
+                if (!check_ratio(r, ctx, dc)) {
331623
+                    ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(02650)
331623
+                            "Inflated content ratio is larger than the "
331623
+                            "configured limit %i by %i time(s)",
331623
+                            dc->ratio_limit, dc->ratio_burst);
331623
+                    return APR_EINVAL;
331623
+                }
331623
+
331623
                 ctx->stream.next_out = ctx->buffer;
331623
                 len = c->bufferSize - ctx->stream.avail_out;
331623
 
331623
@@ -1548,12 +1683,20 @@ static const command_rec deflate_filter_cmds[] = {
331623
                   "Set the Deflate Memory Level (1-9)"),
331623
     AP_INIT_TAKE1("DeflateCompressionLevel", deflate_set_compressionlevel, NULL, RSRC_CONF,
331623
                   "Set the Deflate Compression Level (1-9)"),
331623
+    AP_INIT_TAKE1("DeflateInflateLimitRequestBody", deflate_set_inflate_limit, NULL, OR_ALL,
331623
+                  "Set a limit on size of inflated input"),
331623
+    AP_INIT_TAKE1("DeflateInflateRatioLimit", deflate_set_inflate_ratio_limit, NULL, OR_ALL,
331623
+                  "Set the inflate ratio limit above which inflation is "
331623
+                  "aborted (default: " APR_STRINGIFY(AP_INFLATE_RATIO_LIMIT) ")"),
331623
+    AP_INIT_TAKE1("DeflateInflateRatioBurst", deflate_set_inflate_ratio_burst, NULL, OR_ALL,
331623
+                  "Set the maximum number of following inflate ratios above limit "
331623
+                  "(default: " APR_STRINGIFY(AP_INFLATE_RATIO_BURST) ")"),
331623
     {NULL}
331623
 };
331623
 
331623
 AP_DECLARE_MODULE(deflate) = {
331623
     STANDARD20_MODULE_STUFF,
331623
-    NULL,                         /* dir config creater */
331623
+    create_deflate_dirconf,       /* dir config creater */
331623
     NULL,                         /* dir merger --- default is to override */
331623
     create_deflate_server_config, /* server config */
331623
     NULL,                         /* merge server config */