Header handling bug in class org.apache.Ajp13

[Jianliang Zhao]

I enabled AJP 1.3 connector on Tomcat 4.0.1 with Netscape Server and found a 
NumberFormatException thrown for a HTTP request with non-standard headers. I checked 
out the code from module jakarta-tomcat-connectors with tag tomcat_401. After some 
debuging, it seems the following code is causing the problem:

method: Ajp13.decodeRequest
Between // are my comments. Would you please make this fix and 
let me know where to get a patched tomcat_ajp.jar file?

// Header names are encoded as either an integer code starting
// with 0xA0, or as a normal string (in which case the first
// two bytes are the length).
int isc = msg.peekInt();

   /***/
   // MY DEBUG STATEMENT
System.out.println("header ID: " + isc); // It happens to be 8 for a 
non-standard header
   /***/

int hId = isc & 0xFF;

MessageBytes vMB=null;
isc &= 0xFF00;
if(0xA000 == isc) {

   /***/
   // MY DEBUG STATEMENT
System.out.println("Integer coding: 0xA");
   /***/

msg.getInt(); // To advance the read position
hName = headerTransArray[hId - 1];
vMB= headers.addValue(hName);
} else {
   /***/
/* This branch is executed for the normal string encoding(non-standard 
header case)*/
/* The header ID is also set for the normal string encoding case */
/* I added the following line to fix the problem */
hId = -1; // Should we set hId to dummy number here?
System.out.println("Normal String: 0xA");
   /***/

// XXX Not very elegant
vMB = msg.addHeader(headers);
if (vMB == null) {
return 500; // wrong packet
}
}

msg.getMessageBytes(vMB);

// set content length, if this is it...
if (hId == SC_REQ_CONTENT_LENGTH) {
 /***/
 /* Originally the following line was executed for normal string 
encoding if hId happens to be 8 */
 /* It throws NumberFormatException */
 /***/

 int contentLength = (vMB == null) ? -1 : vMB.getInt();

Thanks,

Jianliang

--
To unsubscribe, e-mail:   
For additional commands, e-mail: 

RE: Header handling bug in class org.apache.Ajp13

[Kevin Seguin]

the fix for this is already in cvs and will be part of the next 4.0.2 beta
release.

> -Original Message-
> From: Jianliang Zhao [mailto:[EMAIL PROTECTED]]
> Sent: Monday, February 04, 2002 4:26 PM
> To: Tomcat-dev (E-mail)
> Subject: Header handling bug in class org.apache.Ajp13
> 
> 
> I enabled AJP 1.3 connector on Tomcat 4.0.1 with Netscape 
> Server and found a NumberFormatException thrown for a HTTP 
> request with non-standard headers. I checked out the code 
> from module jakarta-tomcat-connectors with tag tomcat_401. 
> After some debuging, it seems the following code is causing 
> the problem:
> 
> method: Ajp13.decodeRequest
> Between // are my comments. Would you 
> please make this fix and let me know where to get a patched 
> tomcat_ajp.jar file?
> 
>   // Header names are encoded as either an integer 
> code starting
>   // with 0xA0, or as a normal string (in which case the first
>   // two bytes are the length).
> int isc = msg.peekInt();
> 
>
> /***/
>// MY DEBUG STATEMENT
>   System.out.println("header ID: " + isc); // It 
> happens to be 8 for a non-standard header
>
> /***/
> 
> int hId = isc & 0xFF;
> 
>   MessageBytes vMB=null;
> isc &= 0xFF00;
> if(0xA000 == isc) {
> 
>
> /***/
>// MY DEBUG STATEMENT
> System.out.println("Integer coding: 0xA");
>
> /***/
> 
> msg.getInt(); // To advance the read position
> hName = headerTransArray[hId - 1];
>   vMB= headers.addValue(hName);
> } else {
>
> /***/
> /* This branch is executed for the normal 
> string encoding(non-standard header case)*/
> /* The header ID is also set for the normal 
> string encoding case */
> /* I added the following line to fix the problem */
> hId = -1; // Should we set hId to dummy number here?
> System.out.println("Normal String: 0xA");
>
> /***/
> 
>   // XXX Not very elegant
>   vMB = msg.addHeader(headers);
>   if (vMB == null) {
> return 500; // wrong packet
> }
> }
> 
> msg.getMessageBytes(vMB);
> 
> // set content length, if this is it...
> if (hId == SC_REQ_CONTENT_LENGTH) {
>  
> /***/
>  /* Originally the following line was 
> executed for normal string encoding if hId happens to be 8 */
>  /* It throws NumberFormatException */
>  
> /***/
> 
>  int contentLength = (vMB == null) ? -1 : 
> vMB.getInt();
> 
> Thanks,
> 
> Jianliang
> 
> --
> To unsubscribe, e-mail:   
<mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>

--
To unsubscribe, e-mail:   <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>