SECURITY: CVE-2010-0425 (cve.mitre.org)

wrowe · wrowe · commit e9602aecc484 · 2010-03-02T04:30:33.000Z
mod_isapi: Do not unload an isapi .dll module until the request processing is completed, avoiding orphaned callback pointers. Submitted by: Brett Gervasoni <brettg senseofsecurity.com>, trawick Reviewed by: trawick, wrowe git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@917870 13f79535-47bb-0310-9956-ffa450edef68
diff --git a/CHANGES b/CHANGES
@@ -1,7 +1,12 @@
-                                                        -*- coding: utf-8 -*-
+                                                         -*- coding: utf-8 -*-
 
 Changes with Apache 2.3.7
 
+  *) SECURITY: CVE-2010-0425 (cve.mitre.org)
+     mod_isapi: Do not unload an isapi .dll module until the request
+     processing is completed, avoiding orphaned callback pointers.
+     [Brett Gervasoni <brettg senseofsecurity.com>, Jeff Trawick]
+
   *) support/rotatelogs: Add -L option to create a link to the current
      log file.  PR 48761 [<lyndon orthanc.ca>, Dan Poirier]
 
diff --git a/modules/arch/win32/mod_isapi.c b/modules/arch/win32/mod_isapi.c
@@ -1503,7 +1503,6 @@ apr_status_t isapi_handler (request_rec *r)
     /* Set up client input */
     res = ap_setup_client_block(r, REQUEST_CHUNKED_ERROR);
     if (res) {
-        isapi_unload(isa, 0);
         return res;
     }
 
@@ -1534,7 +1533,6 @@ apr_status_t isapi_handler (request_rec *r)
         }
 
         if (res < 0) {
-            isapi_unload(isa, 0);
             return HTTP_INTERNAL_SERVER_ERROR;
         }
 

Original file line number	Diff line number	Diff line change
`@@ -1503,7 +1503,6 @@ apr_status_t isapi_handler (request_rec *r)`
`1503`	`1503`	`/* Set up client input */`
`1504`	`1504`	`res = ap_setup_client_block(r, REQUEST_CHUNKED_ERROR);`
`1505`	`1505`	`if (res) {`
`1506`		`- isapi_unload(isa, 0);`
`1507`	`1506`	`return res;`
`1508`	`1507`	`}`
`1509`	`1508`
`@@ -1534,7 +1533,6 @@ apr_status_t isapi_handler (request_rec *r)`
`1534`	`1533`	`}`
`1535`	`1534`
`1536`	`1535`	`if (res < 0) {`
`1537`		`- isapi_unload(isa, 0);`
`1538`	`1536`	`return HTTP_INTERNAL_SERVER_ERROR;`
`1539`	`1537`	`}`
`1540`	`1538`