bug fixed #61471 in apache2handler

1 files changed, 17 insertions, 1 deletions

diff --git a/sapi/apache2handler/sapi_apache2.c b/sapi/apache2handler/sapi_apache2.c
index 456b9719fa..718e01f7ad 100644
--- a/sapi/apache2handler/sapi_apache2.c
+++ b/sapi/apache2handler/sapi_apache2.c
@@ -184,6 +184,7 @@ php_apache_sapi_read_post(char *buf, size_t count_bytes)
 	php_struct *ctx = SG(server_context);
 	request_rec *r;
 	apr_bucket_brigade *brigade;
+	apr_status_t ret;
 
 	r = ctx->r;
 	brigade = ctx->brigade;
@@ -195,7 +196,7 @@ php_apache_sapi_read_post(char *buf, size_t count_bytes)
 	 * need to make sure that if data is available we fill the buffer completely.
 	 */
 
-	while (ap_get_brigade(r->input_filters, brigade, AP_MODE_READBYTES, APR_BLOCK_READ, len) == APR_SUCCESS) {
+	while ((ret=ap_get_brigade(r->input_filters, brigade, AP_MODE_READBYTES, APR_BLOCK_READ, len)) == APR_SUCCESS) {
 		apr_brigade_flatten(brigade, buf, &len);
 		apr_brigade_cleanup(brigade);
 		tlen += len;
@@ -206,6 +207,14 @@ php_apache_sapi_read_post(char *buf, size_t count_bytes)
 		len = count_bytes - tlen;
 	}
 
+	if (ret != APR_SUCCESS) {
+		if (APR_STATUS_IS_TIMEUP(ret)) {
+			SG(sapi_headers).http_response_code = ap_map_http_request_error(ret, HTTP_REQUEST_TIME_OUT);
+		} else {
+			SG(sapi_headers).http_response_code = ap_map_http_request_error(ret, HTTP_BAD_REQUEST);
+		}
+	}
+
 	return tlen;
 }
 
@@ -656,6 +665,13 @@ zend_first_try {
 		brigade = ctx->brigade;
 	}
 
+	if (SG(request_info).content_length > SG(read_post_bytes)) {
+		ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "attemp to read POST data error: %d", SG(sapi_headers).http_response_code);
+		apr_brigade_cleanup(brigade);
+		PHPAP_INI_OFF;
+		return SG(sapi_headers).http_response_code;
+	}
+
 	if (AP2(last_modified)) {
 		ap_update_mtime(r, r->finfo.mtime);
 		ap_set_last_modified(r);