svn commit: r1934678 - in httpd/httpd/trunk: changes-entries modules/http2

Author: icing
Date: Wed May 27 09:37:31 2026
New Revision: 1934678

Log:
*) mod_http2: update to version 2.0.41
     Fix cookie header accounting against LimitRequestFields.

Added:
   httpd/httpd/trunk/changes-entries/h2_v2.0.41.txt
Modified:
   httpd/httpd/trunk/modules/http2/h2_util.c
   httpd/httpd/trunk/modules/http2/h2_version.h

Added: httpd/httpd/trunk/changes-entries/h2_v2.0.41.txt
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ httpd/httpd/trunk/changes-entries/h2_v2.0.41.txt	Wed May 27 09:37:31 2026	(r1934678)
@@ -0,0 +1,3 @@
+  *) mod_http2: update to version 2.0.41
+     Fix cookie header accounting against LimitRequestFields.
+     [Stefan Eissing]

Modified: httpd/httpd/trunk/modules/http2/h2_util.c
==============================================================================
--- httpd/httpd/trunk/modules/http2/h2_util.c	Wed May 27 08:04:41 2026	(r1934677)
+++ httpd/httpd/trunk/modules/http2/h2_util.c	Wed May 27 09:37:31 2026	(r1934678)
@@ -1708,6 +1708,8 @@ static apr_status_t req_add_header(apr_t
              && !ap_cstr_casecmpn("cookie", (const char *)nv->name, nv->namelen)) {
         existing = apr_table_get(headers, "cookie");
         if (existing) {
+            if (!nv->valuelen)
+                return APR_SUCCESS;
             /* Cookie header come separately in HTTP/2, but need
              * to be merged by "; " (instead of default ", ")
              */
@@ -1719,6 +1721,8 @@ static apr_status_t req_add_header(apr_t
             apr_table_setn(headers, "Cookie",
                            apr_psprintf(pool, "%s; %.*s", existing,
                                         (int)nv->valuelen, nv->value));
+            /* Treat the merge as an "add" to not escape LimitRequestFields */
+            *pwas_added = 1;
             return APR_SUCCESS;
         }
     }

Modified: httpd/httpd/trunk/modules/http2/h2_version.h
==============================================================================
--- httpd/httpd/trunk/modules/http2/h2_version.h	Wed May 27 08:04:41 2026	(r1934677)
+++ httpd/httpd/trunk/modules/http2/h2_version.h	Wed May 27 09:37:31 2026	(r1934678)
@@ -27,7 +27,7 @@
  * @macro
  * Version number of the http2 module as c string
  */
-#define MOD_HTTP2_VERSION "2.0.40"
+#define MOD_HTTP2_VERSION "2.0.41"
 
 /**
  * @macro
@@ -35,7 +35,7 @@
  * release. This is a 24 bit number with 8 bits for major number, 8 bits
  * for minor and 8 bits for patch. Version 1.2.3 becomes 0x010203.
  */
-#define MOD_HTTP2_VERSION_NUM 0x020028
+#define MOD_HTTP2_VERSION_NUM 0x020029
 
 
 #endif /* mod_h2_h2_version_h */