Received: (qmail 11274 invoked by uid 501); 17 Oct 2001 09:52:28 -0000
Message-Id: <20011017095228.11273.qmail@apache.org>
Date: 17 Oct 2001 09:52:28 -0000
From: Ronald Bernhardt <Ronald.Bernhardt@de.bosch.com>
Reply-To: Ronald.Bernhardt@de.bosch.com
To: submit@bugz.apache.org
Subject: Apache crashes when using isapi WriteClient
X-Send-Pr-Version: 3.110

>Number:         8562
>Category:       mod_isapi
>Synopsis:       Apache crashes when using isapi WriteClient
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    apache
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Wed Oct 17 03:00:01 PDT 2001
>Closed-Date:    Mon Dec 03 11:58:06 PST 2001
>Last-Modified:  Mon Dec 03 11:58:06 PST 2001
>Originator:     Ronald.Bernhardt@de.bosch.com
>Release:        2.016 (beta)
>Organization:
>Environment:
Windows 2000, sp2; VC++ 6.0
>Description:
Apache crashes when an isapi exention dll uses WriteClient. This is because of a forgotten dereferencing of pointer variable carrying the length of the data stream to be written.
>How-To-Repeat:
Use WriteClient in an Isapi-Extension dll e.g. IIS-Sample "Simple" included in Plattform SDK Samples (Plattform SDK\samples\web\iis\isapi\extension\simple). 
>Fix:
in

WriteClient (HCONN ConnID, LPVOID Buffer, LPDWORD lpwdwBytes,
                         DWORD dwReserved)
{
...
    b = apr_bucket_transient_create(Buffer, (apr_size_t)lpwdwBytes);

dereferencing of pointer was forgotten, so should be

    b = apr_bucket_transient_create(Buffer, (apr_size_t)(*lpwdwBytes));


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open-feedback
State-Changed-By: slive
State-Changed-When: Wed Nov 14 12:54:43 PST 2001
State-Changed-Why:
[This is a standard response.]
This Apache problem report has not been updated recently.
Please reply to this message if you have any additional
information about this issue, or if you have answers to
any questions that have been posed to you.  If there are
no outstanding questions, please consider this a request
to try to reproduce the problem with the latest software
release, if one has been made since last contact.  If we
don't hear from you, this report will be closed.
If you have information to add, BE SURE to reply to this
message and include the apbugs@Apache.Org address so it
will be attached to the problem report!
State-Changed-From-To: feedback-closed
State-Changed-By: wrowe
State-Changed-When: Mon Dec  3 11:58:06 PST 2001
State-Changed-Why:
Resolved by 2.0.28 - the cast was hiding this bug.

Thanks for the report [made me note that lpwdw* is a danged
awful prefix, corrected to lpwd :-] and your interest in
the Apache 2.0 Beta process!
>Unformatted:
 [In order for any reply to be added to the PR database, you need]
 [to include <apbugs@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]