Skip to content

core: Refresh cached file info from the open fd in default_handler. - #865

Open
arturobernalg wants to merge 1 commit into
apache:trunkfrom
arturobernalg:fix/httpd-54962-stale-file-stat
Open

arturobernalg wants to merge 1 commit into
apache:trunkfrom
arturobernalg:fix/httpd-54962-stale-file-stat

Conversation

@arturobernalg

Copy link
Copy Markdown
Member

r->finfo was left as populated by the directory walk's stat() on the pathname, even after the file is opened. A rename(2) racing with that open() leaves the fd pointing at a different file than the one that was stat()'d, so Last-Modified, ETag, Content-Length and the byte range actually sent end up describing the old file while the content comes from the new one.

Refresh r->finfo from the already-open file descriptor right after open(), before any of that is computed.

PR 54962.


  • This PR does not report or address a security vulnerabilityhttps://bz.apache.org/bugzilla/show_bug.cgi?id=54962
    A rename() of the requested file racing with the handler's open() leaves the fd pointing at a different file than the one the directory walk stat()'d, so Last-Modified, ETag, Content-Length and the Range handling all end up describing the old file while the body comes from the new one. Refreshes r->finfo from the already-open fd before any of that is computed.
    (see SECURITY.md and
    https://www.apache.org/security/#reporting-a-vulnerability).
  • Code follows the httpd style guide.
  • New log messages (level debug or higher) use an empty APLOGNO() tag;
    numbers are assigned by a committer at merge time (see docs/log-message-tags/README).
  • If the change is user-visible, a changes-entries/*.txt file is included,
    following the template in README.CHANGES (not needed otherwise).
  • Test cases based on pyhttpd are included where appropriate, in the
    test/modules/xxx directory matching the modules/xxx module source,
    or test/modules/core for core server changes. On Unix, verify these
    pass locally with e.g. make check-pytest PYTEST_DIRS=test/modules/xxx.

r->finfo was left as populated by the directory walk's stat() on the
pathname, even after the file is opened. A rename(2) racing with that
open() leaves the fd pointing at a different file than the one that
was stat()'d, so Last-Modified, ETag, Content-Length and the byte
range actually sent end up describing the old file while the content
comes from the new one.

Refresh r->finfo from the already-open file descriptor right after
open(), before any of that is computed.

PR 54962.
@arturobernalg
arturobernalg force-pushed the fix/httpd-54962-stale-file-stat branch from 49a1d0e to d362e9e Compare October 21, 2026 05:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant