Commit 3ecb8262 authored by Mark J. Cox's avatar Mark J. Cox
Browse files

SECURITY: CVE-2006-3747 (cve.mitre.org) 

mod_rewrite: Fix an off-by-one security problem in the ldap scheme
handling.  For some RewriteRules this could lead to a pointer being
written out of bounds.  Reported by Mark Dowd of McAfee.

Ack: trawick, lars, jorton, wrowe, benl



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@426141 13f79535-47bb-0310-9956-ffa450edef68
parent 2e5d6785

CHANGES

+6 −0
Changes for CHANGES: 6 added lines, 0 removed lines.
Original line number Diff line number Diff line 
                                                        -*- coding: utf-8 -*-

Changes with Apache 2.2.3









  *) SECURITY: CVE-2006-3747 (cve.mitre.org)









     mod_rewrite: Fix an off-by-one security problem in the ldap scheme









     handling.  For some RewriteRules this could lead to a pointer being









     written out of bounds.  Reported by Mark Dowd of McAfee.









     [Mark Cox]









  









  *) mod_authn_alias: Add a check to make sure that the base provider and the









     alias names are different and also that the alias has not been registered









     before. PR 40051. [Brad Nicholes]


































modules/mappers/mod_rewrite.c



+1
−1



























Changes for modules/mappers/mod_rewrite.c: 1 added line, 1 removed line.



Original line number
Diff line number
Diff line







@@ -667,7 +667,7 @@ static char *escape_absolute_uri(apr_pool_t *p, char *uri, unsigned scheme)







            int c = 0;



















            token[0] = cp = apr_pstrdup(p, cp);









            while (*cp && c < 5) {









            while (*cp && c < 4) {









                if (*cp == '?') {









                    token[++c] = cp + 1;









                    *cp = '\0';