Skip to content

Commit 643f0fc

Browse files
committed
*) SECURITY: CVE-2015-0228 (cve.mitre.org)
mod_lua: A maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash. [Edward Lu <Chaosed0 gmail.com>] Discovered by Guido Vranken <guidovranken gmail.com> Submitted by: Edward Lu Committed by: covener git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1657261 13f79535-47bb-0310-9956-ffa450edef68
1 parent c9b63ce commit 643f0fc

File tree

2 files changed

+10
-1
lines changed

2 files changed

+10
-1
lines changed

Diff for: CHANGES

+5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
-*- coding: utf-8 -*-
22
Changes with Apache 2.5.0
33

4+
*) SECURITY: CVE-2015-0228 (cve.mitre.org)
5+
mod_lua: A maliciously crafted websockets PING after a script
6+
calls r:wsupgrade() can cause a child process crash.
7+
[Edward Lu <Chaosed0 gmail.com>]
8+
49
*) mod_lua: After a r:wsupgrade(), mod_lua was not properly
510
responding to a websockets PING but instead invoking the specified
611
script. PR57524. [Edward Lu <Chaosed0 gmail.com>]

Diff for: modules/lua/lua_request.c

+5-1
Original file line numberDiff line numberDiff line change
@@ -2227,6 +2227,7 @@ static int lua_websocket_read(lua_State *L)
22272227
{
22282228
apr_socket_t *sock;
22292229
apr_status_t rv;
2230+
int do_read = 1;
22302231
int n = 0;
22312232
apr_size_t len = 1;
22322233
apr_size_t plen = 0;
@@ -2244,6 +2245,8 @@ static int lua_websocket_read(lua_State *L)
22442245
mask_bytes = apr_pcalloc(r->pool, 4);
22452246
sock = ap_get_conn_socket(r->connection);
22462247

2248+
while (do_read) {
2249+
do_read = 0;
22472250
/* Get opcode and FIN bit */
22482251
if (plaintext) {
22492252
rv = apr_socket_recv(sock, &byte, &len);
@@ -2377,10 +2380,11 @@ static int lua_websocket_read(lua_State *L)
23772380
frame[0] = 0x8A;
23782381
frame[1] = 0;
23792382
apr_socket_send(sock, frame, &plen); /* Pong! */
2380-
lua_websocket_read(L); /* read the next frame instead */
2383+
do_read = 1;
23812384
}
23822385
}
23832386
}
2387+
}
23842388
return 0;
23852389
}
23862390

0 commit comments

Comments
 (0)