Apply by doing: cd /usr/src patch -p0 < 005_httpd.patch And then rebuild and install httpd: cd usr.sbin/httpd make -f Makefile.bsd-wrapper obj make -f Makefile.bsd-wrapper cleandir make -f Makefile.bsd-wrapper make -f Makefile.bsd-wrapper install Index: usr.sbin/httpd/src/main/http_protocol.c =================================================================== RCS file: /cvs/src/usr.sbin/httpd/src/main/http_protocol.c,v retrieving revision 1.10 retrieving revision 1.10.2.1 diff -u -r1.10 -r1.10.2.1 --- usr.sbin/httpd/src/main/http_protocol.c 2002/03/29 02:08:06 1.10 +++ usr.sbin/httpd/src/main/http_protocol.c 2002/06/17 20:34:46 1.10.2.1 @@ -2028,21 +2028,34 @@ static long get_chunk_size(char *b) { long chunksize = 0; + long chunkbits = sizeof(long) * 8; - while (ap_isxdigit(*b)) { + /* Skip leading zeros */ + while (*b == '0') { + ++b; + } + + while (ap_isxdigit(*b) && (chunkbits > 0)) { int xvalue = 0; - /* This works even on EBCDIC. */ - if (*b >= '0' && *b <= '9') + if (*b >= '0' && *b <= '9') { xvalue = *b - '0'; - else if (*b >= 'A' && *b <= 'F') + } + else if (*b >= 'A' && *b <= 'F') { xvalue = *b - 'A' + 0xa; - else if (*b >= 'a' && *b <= 'f') + } + else if (*b >= 'a' && *b <= 'f') { xvalue = *b - 'a' + 0xa; + } chunksize = (chunksize << 4) | xvalue; + chunkbits -= 4; ++b; } + if (ap_isxdigit(*b) && (chunkbits <= 0)) { + /* overflow */ + return -1; + } return chunksize; } @@ -2126,6 +2139,10 @@ return 0; } r->remaining = -1; /* Indicate footers in-progress */ + } + else if (len_to_read < 0) { + r->connection->keepalive = -1; + return -1; } else { r->remaining = len_to_read;