← Back to branch summary

~ubuntu-branches/ubuntu/natty/tomcat6/natty-proposed

« back to all changes in this revision

Viewing changes to java/org/apache/tomcat/util/net/NioEndpoint.java

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2011-09-26 11:27:14 UTC
  • Revision ID: package-import@ubuntu.com-20110926112714-ngfuvuxfnr5oe2x8
Tags: 6.0.28-10ubuntu2.2
https://launchpad.net/bugs/843701
* SECURITY UPDATE: information disclosure via log file
  - debian/patches/0015-CVE-2011-2204.patch: fix logging in
    java/org/apache/catalina/mbeans/MemoryUserDatabaseMBean.java,
    java/org/apache/catalina/users/MemoryUserDatabase.java,
    java/org/apache/catalina/users/MemoryUser.java.
  - CVE-2011-2204
* SECURITY UPDATE: file restriction bypass or denial of service via
  untrusted web application.
  - debian/patches/0016-CVE-2011-2526.patch: check canonical name in
    java/org/apache/catalina/connector/LocalStrings.properties,
    java/org/apache/catalina/connector/Request.java,
    java/org/apache/catalina/servlets/DefaultServlet.java,
    java/org/apache/coyote/http11/Http11AprProcessor.java,
    java/org/apache/coyote/http11/LocalStrings.properties,
    java/org/apache/tomcat/util/net/AprEndpoint.java,
    java/org/apache/tomcat/util/net/NioEndpoint.java.
  - CVE-2011-2526
* SECURITY UPDATE: AJP request spoofing and authentication bypass
  (LP: #843701)
  - debian/patches/0017-CVE-2011-3190.patch: Properly handle request
    bodies in java/org/apache/coyote/ajp/AjpAprProcessor.java,
    java/org/apache/coyote/ajp/AjpProcessor.java.
  - CVE-2011-3190
* SECURITY UPDATE: HTTP DIGEST authentication weaknesses
  - debian/patches/0018-CVE-2011-1184.patch: add new nonce options in
    java/org/apache/catalina/authenticator/DigestAuthenticator.java,
    java/org/apache/catalina/authenticator/LocalStrings.properties,
    java/org/apache/catalina/authenticator/mbeans-descriptors.xml,
    java/org/apache/catalina/realm/RealmBase.java,
    webapps/docs/config/valve.xml.
  - CVE-2011-1184

Show diffs side-by-side

added added

removed removed

Lines of Context:
java/org/apache/tomcat/util/net/NioEndpoint.java
1728
1728
                        sd.pos += written;
1729
1729
                        sd.length -= written;
1730
1730
                        attachment.access();
 
1731
                    } else {
 
1732
                        // Unusual not to be able to transfer any bytes
 
1733
                        // Check the length was set correctly
 
1734
                        if (sd.fchannel.size() <= sd.pos) {
 
1735
                            throw new IOException("Sendfile configured to " +
 
1736
                                    "send more data than was available");
 
1737
                        }
1731
1738
                    }
1732
1739
                }
1733
1740
                if ( sd.length <= 0 && sc.getOutboundRemaining()<=0) {
1752
1759
                            log.debug("Send file connection is being closed");
1753
1760
                        }
1754
1761
                        cancelledKey(sk,SocketStatus.STOP,false);
 
1762
                        return false;
1755
1763
                    }
1756
1764
                } else if ( attachment.interestOps() == 0 && reg ) {
1757
1765
                    if (log.isDebugEnabled()) {