Search code examples
apachetomcat8

ajp_msg_append_cvt_string(): BufferOverflowException on apache 2.4


In below code from apache server ajp_msg.c, any idea where the msg->max_size is coming from ?

I am trying to fix error message below :

ajp_msg_append_cvt_string(): BufferOverflowException 4 8186

**
*  Add a String in AJP message, and transform the String in ASCII
*  if convert is set and we're on an EBCDIC machine
*
* @param msg       AJP Message to get value from
* @param value     Pointer to String
* @param convert   When set told to convert String to ASCII
* @return          APR_SUCCESS or error
*/
apr_status_t ajp_msg_append_string_ex(ajp_msg_t *msg, const char *value,
                                      int convert)
{
    apr_size_t len;

    if (value == NULL) {
        return(ajp_msg_append_uint16(msg, 0xFFFF));
    }

    len = strlen(value);
    if ((msg->len + len + 3) > msg->max_size) {
        return ajp_log_overflow(msg, "ajp_msg_append_cvt_string");
    }

    /* ignore error - we checked once */
    ajp_msg_append_uint16(msg, (apr_uint16_t)len);

    /* We checked for space !!  */
    memcpy(msg->buf + msg->len, value, len + 1); /* including \0 */

    if (convert) {
        /* convert from EBCDIC if needed */
        ap_xlate_proto_to_ascii((char *)msg->buf + msg->len, len + 1);
    }

    msg->len += len + 1;

    return APR_SUCCESS;
}

Solution

  • It needed ProxyIOBufferSize in apache config and packetSize in tomcat config on AJP connection. The apache config number must be less than or equal to tomcat packetSize. safest is to make them equal.

    both of them were set to 64 kb i.e. 65,536 max allowed.