Repository navigation
core, proxy_fcgi: Honor responsefieldsize for FCGI response headers - #522
Open
arturobernalg wants to merge 1 commit into
Open
arturobernalg wants to merge 1 commit into
arturobernalg wants to merge 1 commit into
Conversation
notroj
reviewed
Mar 11, 2025
| return 0; | ||
| } | ||
|
|
||
| /** |
Collaborator
There was a problem hiding this comment.
This part should be added to the varbuf API in server/util.c or else the existing ap_varbuf_* should be used, IMO.
Member
Author
There was a problem hiding this comment.
sound reasonable move it to server/util.c
| ob = apr_brigade_create(r->pool, c->bucket_alloc); | ||
|
|
||
| /* Create our dynamic header buffer for large headers */ | ||
| ap_varbuf *header_vb = NULL; |
Collaborator
There was a problem hiding this comment.
Declaration should be at the top of the function, this is causing the CI failures.
arturobernalg
force-pushed
the
64919-mod_proxy_fcgi-long-header
branch
2 times, most recently
from
March 11, 2025 15:24
d209278 to
0eec747
Compare
|
Hey @notroj & @arturobernalg! Wondering if there is more work needed here or if there's additional steps to take. Happy to help out if so! :) |
bukka
reviewed
Dec 3, 2025
| * headers, so this part of the data will need | ||
| * to persist. */ | ||
| apr_bucket_setaside(b, setaside_pool); | ||
| } |
There was a problem hiding this comment.
this needs probably change indent for the above code...
A header line of a FastCGI response was limited to 8192 bytes, the size of the buffer ap_scan_script_header_err_brigade_ex() reads the lines into, and a longer one failed with "Premature end of script headers". Add ap_scan_script_header_err_brigade_limit() to read the lines into a buffer of a given size. The existing brigade functions use it with MAX_STRING_LEN, so they do not change. mod_proxy_fcgi passes it the responsefieldsize of the worker, as mod_proxy_http does, which is 8192 by default. It limits the size of a header line the scanner accepts. PR: 64919
arturobernalg
force-pushed
the
64919-mod_proxy_fcgi-long-header
branch
from
October 15, 2026 11:21
0eec747 to
8956a77
Compare
arturobernalg
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A response header line of 8190 bytes or more (name, colon and value) from a FastCGI backend fails with a 500 and "Premature end of script headers" (AH01070, AH01075). The line is read by ap_scan_script_header_err_core_ex() into a fixed buffer of MAX_STRING_LEN (8192) bytes.
Add ap_scan_script_header_err_brigade_limit(), which takes the size of the line buffer, and let mod_proxy_fcgi pass the worker's responsefieldsize, as mod_proxy_http does. The default stays 8192, so there is no change unless the option is set. A header line can be at most responsefieldsize - 3 bytes.
This limits only the size of a header line accepted by the scanner. It does not bound the memory used while the header block is received; that is pre-existing and not changed here.
Adds test/modules/proxy/test_07_fcgi.py, a changes entry, and a note in the responsefieldsize documentation.
PR: 64919