---
 apache-tomcat-6.0.18-src/java/org/apache/catalina/connector/LocalStrings.properties |    1 
 apache-tomcat-6.0.18-src/java/org/apache/catalina/connector/Request.java            |   21 ++++++++++
 apache-tomcat-6.0.18-src/java/org/apache/catalina/servlets/DefaultServlet.java      |    1 
 apache-tomcat-6.0.18-src/java/org/apache/coyote/http11/Http11AprProcessor.java      |   13 +++++-
 apache-tomcat-6.0.18-src/java/org/apache/coyote/http11/LocalStrings.properties      |    1 
 apache-tomcat-6.0.18-src/java/org/apache/tomcat/util/net/AprEndpoint.java           |    4 +
 apache-tomcat-6.0.18-src/java/org/apache/tomcat/util/net/NioEndpoint.java           |    8 +++
 7 files changed, 46 insertions(+), 3 deletions(-)

Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/coyote/http11/LocalStrings.properties
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/java/org/apache/coyote/http11/LocalStrings.properties	2008-07-22 02:01:28.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/coyote/http11/LocalStrings.properties	2011-08-15 15:01:14.849734717 +0200
@@ -56,6 +56,7 @@
 http11processor.socket.info=Exception getting socket information
 http11processor.socket.ssl=Exception getting SSL attributes
 http11processor.socket.timeout=Error setting socket timeout
+http11processor.sendfile.error=Error sending data using sendfile. May be caused by invalid request attributes for start/end points
 
 #
 # InternalInputBuffer
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/coyote/http11/Http11AprProcessor.java
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/java/org/apache/coyote/http11/Http11AprProcessor.java	2011-08-15 15:01:14.719730152 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/coyote/http11/Http11AprProcessor.java	2011-08-15 15:01:14.851734788 +0200
@@ -903,7 +903,18 @@
                 sendfileData.socket = socket;
                 sendfileData.keepAlive = keepAlive;
                 if (!endpoint.getSendfile().add(sendfileData)) {
-                    openSocket = true;
+                    if (sendfileData.socket == 0) {
+                        // Didn't send all the data but the socket is no longer
+                        // set. Something went wrong. Close the connection.
+                        // Too late to set status code.
+                        if (log.isDebugEnabled()) {
+                            log.debug(sm.getString(
+                                    "http11processor.sendfile.error"));
+                        }
+                        error = true;
+                    } else {
+                        openSocket = true;
+                    }
                     break;
                 }
             }
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/tomcat/util/net/AprEndpoint.java
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/java/org/apache/tomcat/util/net/AprEndpoint.java	2008-07-22 02:01:29.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/tomcat/util/net/AprEndpoint.java	2011-08-15 15:01:14.851734788 +0200
@@ -1654,7 +1654,9 @@
                                                data.pos, data.end - data.pos, 0);
                     if (nw < 0) {
                         if (!(-nw == Status.EAGAIN)) {
-                            Socket.destroy(data.socket);
+                            Pool.destroy(data.fdpool);
+                            // No need to close socket, this will be done by
+                            // calling code since data.socket == 0
                             data.socket = 0;
                             return false;
                         } else {
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/tomcat/util/net/NioEndpoint.java
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/java/org/apache/tomcat/util/net/NioEndpoint.java	2008-07-22 02:01:28.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/tomcat/util/net/NioEndpoint.java	2011-08-15 15:10:50.103912905 +0200
@@ -1604,6 +1604,13 @@
                 if ( written > 0 ) {
                     sd.pos += written;
                     sd.length -= written;
+                } else {
+                    // Unusual not to be able to transfer any bytes
+                    // Check the length was set correctly
+                    if (sd.fchannel.size() <= sd.pos) {
+                        throw new IOException("Sendfile configured to " +
+                                "send more data than was available");
+                    }
                 }
                 if ( sd.length <= 0 ) {
                     attachment.setSendfileData(null);
@@ -1611,6 +1618,7 @@
                         if (reg) reg(sk,attachment,SelectionKey.OP_READ);
                     } else {
                         cancelledKey(sk,SocketStatus.STOP,false);
+                        return false;
                     }
                 } else if ( attachment.interestOps() == 0 && reg ) {
                     reg(sk,attachment,SelectionKey.OP_WRITE);
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/servlets/DefaultServlet.java
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/java/org/apache/catalina/servlets/DefaultServlet.java	2008-07-22 02:01:29.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/servlets/DefaultServlet.java	2011-08-15 15:01:14.853734858 +0200
@@ -1498,7 +1498,6 @@
                 request.setAttribute("org.apache.tomcat.sendfile.start", new Long(range.start));
                 request.setAttribute("org.apache.tomcat.sendfile.end", new Long(range.end + 1));
             }
-            request.setAttribute("org.apache.tomcat.sendfile.token", this);
             return true;
         } else {
             return false;
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/connector/LocalStrings.properties
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/java/org/apache/catalina/connector/LocalStrings.properties	2008-07-22 02:01:55.000000000 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/connector/LocalStrings.properties	2011-08-15 15:01:14.853734858 +0200
@@ -59,6 +59,7 @@
 coyoteRequest.attributeEvent=Exception thrown by attributes event listener
 coyoteRequest.parseParameters=Exception thrown whilst processing POSTed parameters
 coyoteRequest.postTooLarge=Parameters were not parsed because the size of the posted data was too big. Use the maxPostSize attribute of the connector to resolve this if the application should accept large POSTs.
+coyoteRequest.sendfileNotCanonical=Unable to determine canonical name of file [{0}] specified for use with sendfile
 
 requestFacade.nullRequest=The request object has been recycled and is no longer associated with this facade
 
Index: tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/connector/Request.java
===================================================================
--- tomcat6-6.0.18.orig/apache-tomcat-6.0.18-src/java/org/apache/catalina/connector/Request.java	2011-08-15 15:01:14.658728009 +0200
+++ tomcat6-6.0.18/apache-tomcat-6.0.18-src/java/org/apache/catalina/connector/Request.java	2011-08-15 15:01:14.854734893 +0200
@@ -19,6 +19,7 @@
 package org.apache.catalina.connector;
 
 
+import java.io.File;
 import java.io.InputStream;
 import java.io.IOException;
 import java.io.BufferedReader;
@@ -1409,6 +1410,26 @@
             return;
         }
 
+        // Do the security check before any updates are made
+        if (Globals.IS_SECURITY_ENABLED &&
+                name.equals("org.apache.tomcat.sendfile.filename")) {
+            // Use the canonical file name to avoid any possible symlink and
+            // relative path issues
+            String canonicalPath;
+            try {
+                canonicalPath = new File(value.toString()).getCanonicalPath();
+            } catch (IOException e) {
+                throw new SecurityException(sm.getString(
+                        "coyoteRequest.sendfileNotCanonical", value), e);
+            }
+            // Sendfile is performed in Tomcat's security context so need to
+            // check if the web app is permitted to access the file while still
+            // in the web app's security context
+            System.getSecurityManager().checkRead(canonicalPath);
+            // Update the value so the canonical path is used
+            value = canonicalPath;
+        }
+
         oldValue = attributes.put(name, value);
         if (oldValue != null) {
             replaced = true;
