Lighttpd

https://redmine.lighttpd.net/issues/3166

Fixed in lighttpd 1.4.66, which was released 7 Aug 2022, over a year ago.

Maybe try to keep your software up to date? The current lighttpd release is lighttpd 1.4.71, released 27 May 2023.

If your upstream distro does not provide the latest lighttpd release within a few months after release, tell your upstream distro that they are negligent in picking up patches.

Thank you for your reply gstrauss.

I can't update lighttpd easily because I have a embebed OS.

The patch that you coment in your post...

--- a/src/h2.c
+++ b/src/h2.c
@@ -2636,8 +2636,8 @@ h2_send_cqdata (request_st * const r, connection * const con, chunkqueue * const
     if (h2r->h2_swin < 0) return 0;
     if ((int32_t)dlen > r->h2_swin)   dlen = (uint32_t)r->h2_swin;
     if ((int32_t)dlen > h2r->h2_swin) dlen = (uint32_t)h2r->h2_swin;
-    const uint32_t cqlen = (uint32_t)chunkqueue_length(cq);
-    if (dlen > cqlen) dlen = cqlen;
+    const off_t cqlen = chunkqueue_length(cq);
+    if ((int32_t)dlen > cqlen) dlen = (uint32_t)cqlen;
     /*(note: must temporarily disable next line when running h2spec since
      * some h2spec tests expect 1-byte DATA frame, not a deferred response)*/
     else if (dlen < 2048 && cqlen >= 2048) return 0;

Can I apply in my version?
If yes in what file have I change this?

Thank You.

Can I apply in my version?
If yes in what file have I change this?

If you're asking these questions, you are unqualified to make these changes and should ask for local help, or your company should hire someone with these skills.
For example, you asked

If yes in what file have I change this?

and the the patch you posted contains:

--- a/src/h2.c
+++ b/src/h2.c

If you still do not know which file, or how to use patch or git-format-patch, then you should not be attempting this, as you are not paying for support, yet you have no idea what you are doing and are expecting someone to walk you through this in baby-steps.

---

I wrote:

If your upstream distro does not provide the latest lighttpd release within a few months after release, tell your upstream distro that they are negligent in picking up patches.

This still applies, and this message board is not going to spoon feed you. The solution was already given: upgrade your software. You say that you can't upgrade your software, but also say that you can patch and recompile an older version of the software? That's ridiculous. You have not even looked at the differences between lighttpd 1.4.65 and lighttpd 1.4.66. Tell your manager that they don't know what they're doing, either. If you don't know how to read a patch, but can somehow patch and recompile an older version of lighttpd, the answer is to "patch" with a newer version of lighttpd, and to build that.

lighttpd 1.4.71 is the best available released version of lighttpd, and lighttpd 1.4.72 is expected to be released in the second half of September. If your embedded system runs lighttpd 1.4.65, it should run lighttpd 1.4.71 -- and soon, lighttpd 1.4.72 -- without any additional problems, and with the bug you posted fixed (over a year ago).

I'm sorry for not being a Lighttpd expert.

I thought that the function of the forum was to learn, not to be insulted.

Thank you for your litte help.

Help? Yes. Guidance? Yes. Hints? Yes.
Baby-steps for your company? Nope.

lighttpd source code and build instructions

What Company talking about?

This is a own personal proyect.

Thank again.

You wrote:

I can't update lighttpd easily because I have a embebed OS.

I responded with cognitive dissonance that you suggest that you can "patch" the old version, but not upgrade. There was no response from you to that. If you're not working for a company that does not allow you to upgrade for some policy reason, then you should probably try updating the software. Spending your time rediscovering bugs in software (lighttpd and others) that have been fixed months or years ago is a waste of time for you and for everyone else.

You asked about a problem and were told that it is a bug that was fixed and released over a year ago. The best solution is to upgrade to the latest stable release. You seem to be under the impression that your alternative approach, which you do not appears to have the skills to do yourself, is something that others will walk you through, when you have already been told that the best solution is to upgrade to the latest stable release.

I didn't suggest that I can "patch" any time. Re-Read mi post. I ask if I could apply the patch because I didn't know that to apply a patch in lighttpd I have to re-compile.

If you solved all problems update and upgrade everything well for you. Many times, update or upgrade is not possible. Looking for Embebed OS in the internet and you maybe can understand.

Don't worry that I will never wasted to someone in this forum never more.

Thanks again for your reply.

Can I apply in my version?
If yes in what file have I change this?

[...]

I didn't know that to apply a patch in lighttpd I have to re-compile.

I guess that starts to explain many of your misconceptions.

Yet, you continue to post as if you have any idea how to begin to approach fixing this.

Many times, update or upgrade is not possible.

I am fairly experienced with embedded systems. On some embedded systems, the only way to get software built for the system is to compile from source code. On many others, the OS is a distro that has a package manager. Package managers vary, but unless a proprietary embedded OS, many open-source OS distros (e.g. based on Linux) have open-source mechanisms to patch, cross-compile, and build packages for the embedded system that can then be transferred to and installed on the embedded system.

You seem to have little, if any, knowledge of any of this, and are seemingly annoyed that I accurately assessed your level of expertise when I suggested much of this is well beyond your skill level.

The advice I gave in my first post above is hopefully within your skill set:

Maybe try to keep your software up to date? The current lighttpd release is lighttpd 1.4.71, released 27 May 2023.
If your upstream distro does not provide the latest lighttpd release within a few months after release, tell your upstream distro that they are negligent in picking up patches.