--- a/modules/http/http_filters.c 2013/10/08 14:17:33 1530279 +++ b/modules/http/http_filters.c 2013/10/08 14:18:44 1530280 @@ -825,7 +825,7 @@ * handler. * Zap r->status_line if bad. */ -static void validate_status_line(request_rec *r) +static apr_status_t validate_status_line(request_rec *r) { char *end; @@ -836,15 +836,19 @@ || (end - 3) != r->status_line || (len >= 4 && ! apr_isspace(r->status_line[3]))) { r->status_line = NULL; + return APR_EGENERAL; } /* Since we passed the above check, we know that length three * is equivalent to only a 3 digit numeric http status. * RFC2616 mandates a trailing space, let's add it. */ - else if (len == 3) { + if (len == 3) { r->status_line = apr_pstrcat(r->pool, r->status_line, " ", NULL); + return APR_EGENERAL; } + return APR_SUCCESS; } + return APR_EGENERAL; } /* @@ -856,15 +860,25 @@ static void basic_http_header_check(request_rec *r, const char **protocol) { + apr_status_t rv; + if (r->assbackwards) { /* no such thing as a response protocol */ return; } - validate_status_line(r); + rv = validate_status_line(r); if (!r->status_line) { r->status_line = ap_get_status_line(r->status); + } else if (rv != APR_SUCCESS) { + /* Status line is OK but our own reason phrase + * would be preferred if defined + */ + const char *tmp = ap_get_status_line(r->status); + if (!strncmp(tmp, r->status_line, 3)) { + r->status_line = tmp; + } } /* Note that we must downgrade before checking for force responses. */