Package: lighttpd / 1.4.59-1+deb11u2

CVE-2022-41556.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
commit b18de6f9264f914f7bf493abd3b6059343548e50
Author: Glenn Strauss <gstrauss@gluelogic.com>
Date:   Sun Sep 11 22:31:34 2022 -0400

    [core] handle RDHUP when collecting chunked body
    
    handle RDHUP as soon as RDHUP detected when collecting HTTP/1.1 chunked
    request body (and when not streaming request body to backend)
    
    x-ref:
      https://github.com/lighttpd/lighttpd1.4/pull/115

--- lighttpd.orig/src/gw_backend.c
+++ lighttpd/src/gw_backend.c
@@ -2100,7 +2100,7 @@
             if (-1 == r->reqbody_length && hctx->opts.backend != BACKEND_PROXY){
                 return (r->conf.stream_request_body & FDEVENT_STREAM_REQUEST)
                   ? http_response_reqbody_read_error(r, 411)
-                  : HANDLER_WAIT_FOR_EVENT;
+                  : (rc == HANDLER_GO_ON) ? HANDLER_WAIT_FOR_EVENT : rc;
             }
 
             if (hctx->wb_reqlen < -1 && r->reqbody_length >= 0) {