Author: mmillson Date: 2010-08-04 22:37:25 -0400 (Wed, 04 Aug 2010) New Revision: 1518 Modified: branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11AprProcessor.java branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11NioProcessor.java branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11Processor.java branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/filters/BufferedInputFilter.java Log: Fix CVE-2010-2227 / CVE-2010-1157 for [JBPAPP-4798]. Modified: branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11AprProcessor.java =================================================================== --- branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11AprProcessor.java 2010-08-04 21:14:14 UTC (rev 1517) +++ branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11AprProcessor.java 2010-08-05 02:37:25 UTC (rev 1518) @@ -1155,9 +1155,9 @@ if (ssl && (socket != 0)) { // Consume and buffer the request body, so that it does not // interfere with the client's handshake messages - InputFilter[] inputFilters = inputBuffer.getFilters(); - ((BufferedInputFilter) inputFilters[Constants.BUFFERED_FILTER]).setLimit(maxSavePostSize); - inputBuffer.addActiveFilter(inputFilters[Constants.BUFFERED_FILTER]); + BufferedInputFilter buffredInputFilter = new BufferedInputFilter(); + buffredInputFilter.setLimit(maxSavePostSize); + inputBuffer.addActiveFilter(buffredInputFilter); try { // Renegociate certificates SSLSocket.renegotiate(socket); @@ -1699,9 +1699,6 @@ inputBuffer.addFilter(new VoidInputFilter()); outputBuffer.addFilter(new VoidOutputFilter()); - // Create and add buffered input filter - inputBuffer.addFilter(new BufferedInputFilter()); - // Create and add the chunked filters. //inputBuffer.addFilter(new GzipInputFilter()); outputBuffer.addFilter(new GzipOutputFilter()); Modified: branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11NioProcessor.java =================================================================== --- branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11NioProcessor.java 2010-08-04 21:14:14 UTC (rev 1517) +++ branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11NioProcessor.java 2010-08-05 02:37:25 UTC (rev 1518) @@ -1195,11 +1195,9 @@ * Consume and buffer the request body, so that it does not * interfere with the client's handshake messages */ - InputFilter[] inputFilters = inputBuffer.getFilters(); - ((BufferedInputFilter) inputFilters[Constants.BUFFERED_FILTER]) - .setLimit(maxSavePostSize); - inputBuffer.addActiveFilter - (inputFilters[Constants.BUFFERED_FILTER]); + BufferedInputFilter buffredInputFilter = new BufferedInputFilter(); + buffredInputFilter.setLimit(maxSavePostSize); + inputBuffer.addActiveFilter(buffredInputFilter); try { Object sslO = sslSupport.getPeerCertificateChain(true); if( sslO != null) { @@ -1734,9 +1732,6 @@ inputBuffer.addFilter(new VoidInputFilter()); outputBuffer.addFilter(new VoidOutputFilter()); - // Create and add buffered input filter - inputBuffer.addFilter(new BufferedInputFilter()); - // Create and add the chunked filters. //inputBuffer.addFilter(new GzipInputFilter()); outputBuffer.addFilter(new GzipOutputFilter()); Modified: branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11Processor.java =================================================================== --- branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11Processor.java 2010-08-04 21:14:14 UTC (rev 1517) +++ branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/Http11Processor.java 2010-08-05 02:37:25 UTC (rev 1518) @@ -1089,11 +1089,9 @@ * Consume and buffer the request body, so that it does not * interfere with the client's handshake messages */ - InputFilter[] inputFilters = inputBuffer.getFilters(); - ((BufferedInputFilter) inputFilters[Constants.BUFFERED_FILTER]) - .setLimit(maxSavePostSize); - inputBuffer.addActiveFilter - (inputFilters[Constants.BUFFERED_FILTER]); + BufferedInputFilter buffredInputFilter = new BufferedInputFilter(); + buffredInputFilter.setLimit(maxSavePostSize); + inputBuffer.addActiveFilter(buffredInputFilter); try { Object sslO = sslSupport.getPeerCertificateChain(true); if( sslO != null) { @@ -1620,9 +1618,6 @@ inputBuffer.addFilter(new VoidInputFilter()); outputBuffer.addFilter(new VoidOutputFilter()); - // Create and add buffered input filter - inputBuffer.addFilter(new BufferedInputFilter()); - // Create and add the chunked filters. //inputBuffer.addFilter(new GzipInputFilter()); outputBuffer.addFilter(new GzipOutputFilter()); Modified: branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/filters/BufferedInputFilter.java =================================================================== --- branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/filters/BufferedInputFilter.java 2010-08-04 21:14:14 UTC (rev 1517) +++ branches/JBOSSWEB_2_0_0_GA_CP12_JBPAPP-4798/src/share/classes/org/apache/coyote/http11/filters/BufferedInputFilter.java 2010-08-05 02:37:25 UTC (rev 1518) @@ -102,10 +102,13 @@ } public void recycle() { - if (buffered.getBuffer().length > 65536) { - buffered = null; - } else { - buffered.recycle(); + if (buffered != null) { + if (buffered.getBuffer() != null + && buffered.getBuffer().length > 65536) { + buffered = null; + } else { + buffered.recycle(); + } } tempRead.recycle(); hasRead = false;