Tcl Source Code

If http::geturl is called with -keepalive 1 and a -command that enters the
 event loop (e.g for an authorization dialog), and the HTTP response
 includes a "Content-Length" header, then a (slow) race condition ensues
 between the server's closing of the connection, and the user's response to
 the dialog. If the connection is closed first, the unpatched code fails at
 line 1126 with repeated eof fileevents, because the command http::Eof tries
 repeatedly to run the user's -command, and never returns. This can be
 reported as "too many nested evaluations".

 While it might not be good style to allow the -command script to enter the
 event loop, http(n) does not exclude this possibility.

 There's more than one way to fix the bug. Two possible patches are
 attached. EIther will fix the bug; both fixes can be applied.

 Patches against core-8-5-branch checkin 69687a01db, dated 2012-10-24
 11:28:33.

Thanks for the fix. I've closed the ticket.

Applied variation on Fix 2 (don't use [unset], but rather another flag var in the state).

Fix 2 should probably be applied anyway. That's the thing to apply for 8.5.13 (and I'll get that in in a few minutes).

Fix 1 is more interesting (and doesn't mean that Fix2 shouldn't be used as well) but it requires review by someone who knows more about the http package's functioning in the presence of keepalives.

Please report whether these patches, or some
other resolution of this item is needed before
a Tcl 8.5.13 release.

File Added - 455665: http-fix2-for--69687a01db.patch

File Added - 455664: http-fix1-for--69687a01db.patch