File apache-tomcat-CVE-2011-2526.patch of Package tomcat6.import5619
Index: apache-tomcat-6.0.32-src/java/org/apache/coyote/http11/LocalStrings.properties
===================================================================
--- apache-tomcat-6.0.32-src.orig/java/org/apache/coyote/http11/LocalStrings.properties 2011-02-02 20:07:32.000000000 +0100
+++ apache-tomcat-6.0.32-src/java/org/apache/coyote/http11/LocalStrings.properties 2011-07-25 14:31:03.470335065 +0200
@@ -56,6 +56,7 @@
http11processor.socket.info=Exception getting socket information
http11processor.socket.ssl=Exception getting SSL attributes
http11processor.socket.timeout=Error setting socket timeout
+http11processor.sendfile.error=Error sending data using sendfile. May be caused by invalid request attributes for start/end points
#
# InternalInputBuffer
Index: apache-tomcat-6.0.32-src/java/org/apache/coyote/http11/Http11AprProcessor.java
===================================================================
--- apache-tomcat-6.0.32-src.orig/java/org/apache/coyote/http11/Http11AprProcessor.java 2011-02-02 20:07:32.000000000 +0100
+++ apache-tomcat-6.0.32-src/java/org/apache/coyote/http11/Http11AprProcessor.java 2011-07-25 14:31:03.471335100 +0200
@@ -910,7 +910,18 @@
sendfileData.socket = socket;
sendfileData.keepAlive = keepAlive;
if (!endpoint.getSendfile().add(sendfileData)) {
- openSocket = true;
+ if (sendfileData.socket == 0) {
+ // Didn't send all the data but the socket is no longer
+ // set. Something went wrong. Close the connection.
+ // Too late to set status code.
+ if (log.isDebugEnabled()) {
+ log.debug(sm.getString(
+ "http11processor.sendfile.error"));
+ }
+ error = true;
+ } else {
+ openSocket = true;
+ }
break;
}
}
Index: apache-tomcat-6.0.32-src/java/org/apache/tomcat/util/net/AprEndpoint.java
===================================================================
--- apache-tomcat-6.0.32-src.orig/java/org/apache/tomcat/util/net/AprEndpoint.java 2011-02-02 20:07:33.000000000 +0100
+++ apache-tomcat-6.0.32-src/java/org/apache/tomcat/util/net/AprEndpoint.java 2011-07-25 14:31:36.972496803 +0200
@@ -1812,7 +1812,9 @@
data.pos, data.end - data.pos, 0);
if (nw < 0) {
if (!(-nw == Status.EAGAIN)) {
- destroySocket(data.socket);
+ Pool.destroy(data.fdpool);
+ // No need to close socket, this will be done by
+ // calling code since data.socket == 0
data.socket = 0;
return false;
} else {
Index: apache-tomcat-6.0.32-src/java/org/apache/tomcat/util/net/NioEndpoint.java
===================================================================
--- apache-tomcat-6.0.32-src.orig/java/org/apache/tomcat/util/net/NioEndpoint.java 2011-02-02 20:07:33.000000000 +0100
+++ apache-tomcat-6.0.32-src/java/org/apache/tomcat/util/net/NioEndpoint.java 2011-07-25 14:31:03.474335203 +0200
@@ -1734,6 +1734,13 @@
sd.pos += written;
sd.length -= written;
attachment.access();
+ } else {
+ // Unusual not to be able to transfer any bytes
+ // Check the length was set correctly
+ if (sd.fchannel.size() <= sd.pos) {
+ throw new IOException("Sendfile configured to " +
+ "send more data than was available");
+ }
}
}
if ( sd.length <= 0 && sc.getOutboundRemaining()<=0) {
@@ -1758,6 +1765,7 @@
log.debug("Send file connection is being closed");
}
cancelledKey(sk,SocketStatus.STOP,false);
+ return false;
}
} else if ( attachment.interestOps() == 0 && reg ) {
if (log.isDebugEnabled()) {
Index: apache-tomcat-6.0.32-src/java/org/apache/catalina/servlets/DefaultServlet.java
===================================================================
--- apache-tomcat-6.0.32-src.orig/java/org/apache/catalina/servlets/DefaultServlet.java 2011-02-02 20:07:32.000000000 +0100
+++ apache-tomcat-6.0.32-src/java/org/apache/catalina/servlets/DefaultServlet.java 2011-07-25 14:31:03.475335237 +0200
@@ -1619,7 +1619,6 @@
request.setAttribute("org.apache.tomcat.sendfile.start", new Long(range.start));
request.setAttribute("org.apache.tomcat.sendfile.end", new Long(range.end + 1));
}
- request.setAttribute("org.apache.tomcat.sendfile.token", this);
return true;
} else {
return false;
Index: apache-tomcat-6.0.32-src/java/org/apache/catalina/connector/LocalStrings.properties
===================================================================
--- apache-tomcat-6.0.32-src.orig/java/org/apache/catalina/connector/LocalStrings.properties 2011-02-02 20:07:31.000000000 +0100
+++ apache-tomcat-6.0.32-src/java/org/apache/catalina/connector/LocalStrings.properties 2011-07-25 14:32:01.120334174 +0200
@@ -62,6 +62,7 @@
coyoteRequest.postTooLarge=Parameters were not parsed because the size of the posted data was too big. Use the maxPostSize attribute of the connector to resolve this if the application should accept large POSTs.
coyoteRequest.chunkedPostTooLarge=Parameters were not parsed because the size of the posted data was too big. Because this request was a chunked request, it could not be processed further. Use the maxPostSize attribute of the connector to resolve this if the application should accept large POSTs.
coyoteRequest.sessionEndAccessFail=Exception triggered ending access to session while recycling request
+coyoteRequest.sendfileNotCanonical=Unable to determine canonical name of file [{0}] specified for use with sendfile
requestFacade.nullRequest=The request object has been recycled and is no longer associated with this facade
Index: apache-tomcat-6.0.32-src/java/org/apache/catalina/connector/Request.java
===================================================================
--- apache-tomcat-6.0.32-src.orig/java/org/apache/catalina/connector/Request.java 2011-02-02 20:07:31.000000000 +0100
+++ apache-tomcat-6.0.32-src/java/org/apache/catalina/connector/Request.java 2011-07-25 14:31:03.477335307 +0200
@@ -19,6 +19,7 @@
package org.apache.catalina.connector;
+import java.io.File;
import java.io.InputStream;
import java.io.IOException;
import java.io.BufferedReader;
@@ -1455,6 +1456,26 @@
return;
}
+ // Do the security check before any updates are made
+ if (Globals.IS_SECURITY_ENABLED &&
+ name.equals("org.apache.tomcat.sendfile.filename")) {
+ // Use the canonical file name to avoid any possible symlink and
+ // relative path issues
+ String canonicalPath;
+ try {
+ canonicalPath = new File(value.toString()).getCanonicalPath();
+ } catch (IOException e) {
+ throw new SecurityException(sm.getString(
+ "coyoteRequest.sendfileNotCanonical", value), e);
+ }
+ // Sendfile is performed in Tomcat's security context so need to
+ // check if the web app is permitted to access the file while still
+ // in the web app's security context
+ System.getSecurityManager().checkRead(canonicalPath);
+ // Update the value so the canonical path is used
+ value = canonicalPath;
+ }
+
oldValue = attributes.put(name, value);
if (oldValue != null) {
replaced = true;
