Index: CHANGES =================================================================== --- CHANGES (revision 1175992) +++ CHANGES (working copy) @@ -1,8 +1,9 @@  -*- coding: utf-8 -*- Changes with Apache 2.2.22 + *) Fix a regression introduced by the CVE-2011-3192 byterange fix in 2.2.20: + A range of '0-' returns a 206. [Jim Jagielski] - Changes with Apache 2.2.21 *) SECURITY: CVE-2011-3348 (cve.mitre.org) Index: modules/http/byterange_filter.c =================================================================== --- modules/http/byterange_filter.c (revision 1175992) +++ modules/http/byterange_filter.c (working copy) @@ -500,6 +500,20 @@ } else { /* "5-" */ end = clength - 1; + /* + * special case: 0- + * ignore all other ranges provided + * return as a single range: 0- + */ + if (start == 0) { + apr_array_clear(*indexes); + idx = (indexes_t *)apr_array_push(*indexes); + idx->start = start; + idx->end = end; + sum_lengths = clength; + num_ranges = 1; + break; + } } } @@ -526,7 +540,7 @@ /* If all ranges are unsatisfiable, we should return 416 */ return -1; } - if (sum_lengths >= clength) { + if (sum_lengths > clength) { ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Sum of ranges not smaller than file, ignoring."); return 0;