lighttpd
/
lighttpd1.4
2
0
Fork 0
Code Issues Releases Wiki Activity
1,890 Commits
9 Branches
85 Tags
14 MiB
Commit Graph

1890 Commits (a9568d0ad6032127893a8391f08eed7aa2cd7d2a)

Author SHA1 Message Date
Stefan Bühler 3605a3bec3 use keep-alive timeout while waiting for HTTP headers; use always the read timeout while waiting for the HTTP body 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2962 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-04-02 10:04:11 +00:00
Stefan Bühler e1b1c52028 - next is 1.4.36 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2961 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-04-02 10:04:09 +00:00
Stefan Bühler d1a2356916 fix SQL injection / host name validation (thx Jann Horn) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2959 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-03-12 12:03:55 +00:00
Stefan Bühler efc41b2bb1 check length of unix domain socket filenames 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2958 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-16 13:08:43 +00:00
Stefan Bühler 7bd0f54ab2 add some asserts to help static analyzers 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2957 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-16 13:08:41 +00:00
Stefan Bühler 326f2fb8a4 [mod_accesslog] don't close fd -1 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2956 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-16 13:08:38 +00:00
Stefan Bühler 8e31e18b8e [mod_webdav] fix logic error in handling file creation error 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2955 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-16 13:08:36 +00:00
Stefan Bühler 57c661c191 fix unchecked return values from stream_open/stat_cache_get_entry 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2954 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-16 13:08:34 +00:00
Stefan Bühler b106513e58 [network] check return value of lseek() 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2953 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-16 13:08:32 +00:00
Stefan Bühler 9f2be4882d force assertion: setting FD_CLOEXEC must work (if available) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2952 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-16 13:08:29 +00:00
Stefan Bühler ef0b353fee [mod_cml_lua] fix null pointer dereference 
a local lua script could trigger it by not sending any files and not
  setting a last-modified header, leading to zero mtime and a buffer
  ptr = NULL which was used in http_response_handle_cachable

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2951 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-16 13:08:27 +00:00
Stefan Bühler 954184e949 [mod_scgi] use goto error for all error cases in mod_scgi_set_defaults 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2950 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-16 13:08:24 +00:00
Stefan Bühler 8f0e19738f fix r2943 (added invalid read after free) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2949 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-16 13:08:22 +00:00
Stefan Bühler 07dd0bd0a5 add force_assert() to enforce assertions as simple assert()s are disabled by -DNDEBUG (fixes #2546) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2948 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-16 13:08:20 +00:00
Stefan Bühler fba7dd6f43 fix resource leaks in error cases on config parsing and other initializations 
None of this matters - lighttpd will terminate anyway. Still helps the
  code to get cleaner, and makes reviewing output of static analyzers
  easier.

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2947 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-14 21:06:19 +00:00
Stefan Bühler bf10267807 [buffer] fix length check in buffer_is_equal_right_len 
buffer_is_equal_right_len didn't check the length of the second
  buffer. as all calls in lighttpd used the length of the second buffer
  as length parameter those calls were not broken.

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2946 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-14 21:06:16 +00:00
Stefan Bühler bcd35cc264 remove logical dead code 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2945 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-14 21:06:14 +00:00
Stefan Bühler 29a1070299 add comments for switch fall throughs 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2944 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-14 21:06:12 +00:00
Stefan Bühler b239e7734a [mod_magnet] fix memory leak 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2943 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-14 21:06:10 +00:00
Stefan Bühler b461e031f5 [mod_fastcgi,mod_scgi] fix resource leaks on spawning backends 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2942 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-14 21:06:07 +00:00
Stefan Bühler d59c910d6a [mod_dirlisting] fix memory leak if pcre fails 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2941 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-14 21:06:05 +00:00
Stefan Bühler 0aaf939e5e [mod_rrdtool] fix invalid read (string not null terminated) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2940 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-14 21:06:03 +00:00
Stefan Bühler fc3a060a04 [mod_fastcgi] fix use after free (only triggered if fastcgi debug is active) 
If a new fastcgi packet is expected, but the currently available
  data doesn't fill the header and debug is active an invalid
  read is triggerd.

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2939 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-14 21:06:00 +00:00
Stefan Bühler b8a1835093 NEWS entry for previous commit 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2938 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-02-14 21:05:58 +00:00
Stefan Bühler a7396296da [network/ssl] fix build error if TLSEXT is disabled 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2937 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-01-20 21:31:26 +00:00
Stefan Bühler 9061670c28 [dist]: fix typo in link title generated by packdist.sh 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2936 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-01-20 14:20:09 +00:00
Stefan Bühler 0d855be97e - next is 1.4.35 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2935 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-01-20 14:20:06 +00:00
Stefan Bühler 3ca6adc233 [docs] add !kPSK to the cipher string recommendation as the comments before already mention 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2933 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-01-20 12:07:36 +00:00
Stefan Bühler d7c90814c3 [tests] add cleanup.sh to cmake test runs, reset SLOWREQUEST in request.t 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2932 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-01-10 12:05:12 +00:00
Stefan Bühler 524e0a30a0 add two asserts to help parfait (#2530) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2931 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-01-10 12:05:09 +00:00
Stefan Bühler 24994e113a [mod_webdav] fix fd leak found with parfait (fixes #2530, thx kukackajiri) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2930 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-01-10 12:05:06 +00:00
Stefan Bühler 657566828e [mod_mysql_vhost] fix memory leak on config init (#2530) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2929 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-01-10 12:05:04 +00:00
Stefan Bühler e346794d59 [auto* build] remove -no-undefined from linker flags, as we actually link modules with undefined symbols (fixes #2533) 
On platforms that support linking modules with undefined symbols we
actually do it; so most of the time -no-undefined should result in an
error.
On platforms that don't support it, it will result in an error sooner or
later anyway (on those it should build a shared libary with the core
code to link the modules against).

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2928 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-01-10 12:05:02 +00:00
Stefan Bühler f0e5c1415d [core] decode URL before rewrite, enabling it to work in $HTTP["url"] conditionals (fixes #2526) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2927 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-01-10 12:04:59 +00:00
Stefan Bühler 17762fad01 maintain physical.basedir (the "acting" doc-root as prefix of physical.path) in more places 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2926 152afb58-edef-0310-8abb-c4023f1b3aa9
 2014-01-10 12:04:57 +00:00
Stefan Bühler c8fbc16985 [ssl] fix regression from CVE-2013-4508 (client-cert sessions were broken) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2925 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-13 17:18:39 +00:00
Stefan Bühler 18869bcfed [mod_ssi] fix "ssi_val_init" prototype 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2924 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-13 17:18:35 +00:00
Stefan Bühler 99cddff73a [core] check success of setuid,setgid,setgroups (CVE-2013-4559) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2923 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-13 11:43:33 +00:00
Stefan Bühler d8b363c1d1 [stat-cache] fix FAM cleanup/fdevent handling 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2922 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-13 11:43:31 +00:00
Stefan Bühler ae1335503a [stat-cache] FAM: fix use after free (CVE-2013-4560) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2921 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-13 11:43:28 +00:00
Stefan Bühler 6f208cfde1 fix/silence bugs reported by ccc-analyzer (clang) 
These should all be non critical:
 * memory leaks on startup in error cases (which lead to
   immediate shutdowns anyway)
 * http_auth/ldap: passing uninitialized "ret" to ldap_err2string
 * sizeof(T) not matching the target pointer in malloc/calloc calls;
   those cases were either:
   * T being the wrong pointer type - shouldn't matter as long as all
     pointers have same size
   * T being larger than the type needed
 * mod_accesslog: direct use after free in cleanup (server shutdown);
   could crash before "clean" shutdown
 * some false positives (mod_compress, mod_expire)
 * assert(srv->config_context->used > 0); - this is always the case,
   as there is always a global config block

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2920 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-13 11:43:26 +00:00
Stefan Bühler 6b7240f2d8 NEWS entry for previous commit 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2919 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-13 11:43:23 +00:00
Stefan Bühler cdcd49b547 [doc] update ssl.cipher-list recommendation 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2918 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-10 16:44:34 +00:00
Stefan Bühler ff86b5cc67 [autobuild] create m4/ before calling autoreconf 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2917 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-10 13:59:43 +00:00
Stefan Bühler 4938c94ada fix typo (fixes #2519) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2916 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-10 13:49:47 +00:00
Stefan Bühler 1985df2a48 add "packdist.sh" script to build (pre-) releases 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2915 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-10 13:41:12 +00:00
Stefan Bühler cb02c73860 [autobuild] use autoreconf instead of calling tools manually; add generated files to .gitignore 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2914 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-10 13:41:09 +00:00
Stefan Bühler 1af871fcef [ssl] fix SNI handling; only use key+cert+verify-client from SNI specific config (fixes #2525, CVE-2013-4508) 
pull all ssl.ca-file values into all SSL_CTXs, but use only the local
ssl.ca-file for verify-client; correct SNI name is no requirement,
so enforcing verification for a subset of SNI names doesn't actually
protect those.

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2913 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-05 15:29:07 +00:00
Stefan Bühler 3ce548c8d0 remove unused members from struct server_socket 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2912 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-11-05 15:29:04 +00:00
Stefan Bühler 268c054c40 [mod_extforward] fix compilation without IPv6, (not) using undefined var (fixes #2515, thx mm) 
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2911 152afb58-edef-0310-8abb-c4023f1b3aa9
 2013-10-13 11:34:55 +00:00