summaryrefslogtreecommitdiff
path: root/test/interactive-helper/aptwebserver.cc
diff options
context:
space:
mode:
authorMichael Vogt <mvo@ubuntu.com>2015-05-22 15:28:53 +0200
committerMichael Vogt <mvo@ubuntu.com>2015-05-22 15:28:53 +0200
commitceafe8a6edc815df2923ba892894617829e9d3c2 (patch)
tree82f8e819f161b7f79d510d51b51b191f12840c8e /test/interactive-helper/aptwebserver.cc
parent68be2fbb252a71303046e2ca7866cd659a91b585 (diff)
Fix endless loop in apt-get update that can cause disk fillup
The apt http code parses Content-Length and Content-Range. For both requests the variable "Size" is used and the semantic for this Size is the total file size. However Content-Length is not the entire file size for partital file requests. For servers that send the Content-Range header first and then the Content-Length header this can lead to globbing of Size so that its less than the real file size. This may lead to a subsequent passing of a negative number into the CircleBuf which leads to a endless loop that writes data. Thanks to Anton Blanchard for the analysis and initial patch. LP: #1445239
Diffstat (limited to 'test/interactive-helper/aptwebserver.cc')
-rw-r--r--test/interactive-helper/aptwebserver.cc6
1 files changed, 3 insertions, 3 deletions
diff --git a/test/interactive-helper/aptwebserver.cc b/test/interactive-helper/aptwebserver.cc
index cd52da692..9c67b67e4 100644
--- a/test/interactive-helper/aptwebserver.cc
+++ b/test/interactive-helper/aptwebserver.cc
@@ -654,13 +654,13 @@ static void * handleClient(void * voidclient) /*{{{*/
if (filesize > filestart)
{
data.Skip(filestart);
- std::ostringstream contentlength;
- contentlength << "Content-Length: " << (filesize - filestart);
- headers.push_back(contentlength.str());
std::ostringstream contentrange;
contentrange << "Content-Range: bytes " << filestart << "-"
<< filesize - 1 << "/" << filesize;
headers.push_back(contentrange.str());
+ std::ostringstream contentlength;
+ contentlength << "Content-Length: " << (filesize - filestart);
+ headers.push_back(contentlength.str());
sendHead(client, 206, headers);
if (sendContent == true)
sendFile(client, headers, data);