← Back to branch summary

~ubuntu-branches/ubuntu/lucid/tomcat6/lucid-proposed

« back to all changes in this revision

Viewing changes to java/org/apache/tomcat/util/net/NioEndpoint.java

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2011-09-26 11:53:28 UTC
  • Revision ID: package-import@ubuntu.com-20110926115328-dlt4z7c759lw1yr4
Tags: 6.0.24-2ubuntu1.9
https://launchpad.net/bugs/843701
* SECURITY UPDATE: information disclosure via log file
  - debian/patches/0015-CVE-2011-2204.patch: fix logging in
    java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java,
    java/org/apache/catalina/users/MemoryUserDatabase.java,
    java/org/apache/catalina/users/MemoryUser.java.
  - CVE-2011-2204
* SECURITY UPDATE: file restriction bypass or denial of service via
  untrusted web application.
  - debian/patches/0016-CVE-2011-2526.patch: check canonical name in
    java/org/apache/catalina/connector/LocalStrings.properties,
    java/org/apache/catalina/connector/Request.java,
    java/org/apache/catalina/servlets/DefaultServlet.java,
    java/org/apache/coyote/http11/Http11AprProcessor.java,
    java/org/apache/coyote/http11/LocalStrings.properties,
    java/org/apache/tomcat/util/net/AprEndpoint.java,
    java/org/apache/tomcat/util/net/NioEndpoint.java.
  - CVE-2011-2526
* SECURITY UPDATE: AJP request spoofing and authentication bypass
  (LP: #843701)
  - debian/patches/0017-CVE-2011-3190.patch: Properly handle request
    bodies in java/org/apache/coyote/ajp/AjpAprProcessor.java,
    java/org/apache/coyote/ajp/AjpProcessor.java.
  - CVE-2011-3190
* SECURITY UPDATE: HTTP DIGEST authentication weaknesses
  - debian/patches/0018-CVE-2011-1184.patch: add new nonce options in
    java/org/apache/catalina/authenticator/DigestAuthenticator.java,
    java/org/apache/catalina/authenticator/LocalStrings.properties,
    java/org/apache/catalina/authenticator/mbeans-descriptors.xml,
    java/org/apache/catalina/realm/RealmBase.java,
    webapps/docs/config/valve.xml.
  - CVE-2011-1184

Show diffs side-by-side

added added

removed removed

Lines of Context:
java/org/apache/tomcat/util/net/NioEndpoint.java
1730
1730
                        sd.pos += written;
1731
1731
                        sd.length -= written;
1732
1732
                        attachment.access();
 
1733
                    } else {
 
1734
                        // Unusual not to be able to transfer any bytes
 
1735
                        // Check the length was set correctly
 
1736
                        if (sd.fchannel.size() <= sd.pos) {
 
1737
                            throw new IOException("Sendfile configured to " +
 
1738
                                    "send more data than was available");
 
1739
                        }
1733
1740
                    }
1734
1741
                }
1735
1742
                if ( sd.length <= 0 && sc.getOutboundRemaining()<=0) {
1754
1761
                            log.debug("Send file connection is being closed");
1755
1762
                        }
1756
1763
                        cancelledKey(sk,SocketStatus.STOP,false);
 
1764
                        return false;
1757
1765
                    }
1758
1766
                } else if ( attachment.interestOps() == 0 && reg ) {
1759
1767
                    if (log.isDebugEnabled()) {