Commit 7518b5bd authored by Jim Jagielski's avatar Jim Jagielski
Browse files

Merge r1700851 from trunk: 

mod_negotiation: simplify type-map body tag lookup, and be safe
should it contain a NUL byte.

Submitted by: ylavic
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1703406 13f79535-47bb-0310-9956-ffa450edef68
parent f73f6077

STATUS

+0 −8
Original line number Original line Diff line number Diff line
@@ -109,14 +109,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]

  [ start all new proposals below, under PATCHES PROPOSED. ]





  *) Easy patches - synch with trunk

     mod_negotiation: simplify type-map body tag lookup, and be safe

                      should it contain a NUL byte.

     trunk: http://svn.apache.org/r1700851

     2.4.x: trunk works

     +1: jailletc36, ylavic, jim









PATCHES PROPOSED TO BACKPORT FROM TRUNK:

PATCHES PROPOSED TO BACKPORT FROM TRUNK:

  [ New proposals should be added at the end of the list ]

  [ New proposals should be added at the end of the list ]

modules/mappers/mod_negotiation.c

+6 −12
Original line number Original line Diff line number Diff line
@@ -828,33 +828,27 @@ static apr_off_t get_body(char *buffer, apr_size_t *len, const char *tag, 
                          apr_file_t *map)

                          apr_file_t *map)

{

{

    char *endbody;

    char *endbody;

    int bodylen;

    apr_size_t bodylen;

    int taglen;

    apr_off_t pos;

    apr_off_t pos;





    taglen = strlen(tag);

    *len -= taglen;





    /* We are at the first character following a body:tag\n entry

    /* We are at the first character following a body:tag\n entry

     * Suck in the body, then backspace to the first char after the

     * Suck in the body, then backspace to the first char after the

     * closing tag entry.  If we fail to read, find the tag or back

     * closing tag entry.  If we fail to read, find the tag or back

     * up then we have a hosed file, so give up already

     * up then we have a hosed file, so give up already

     */

     */

    --*len; /* Reserve space for '\0' */

    if (apr_file_read(map, buffer, len) != APR_SUCCESS) {

    if (apr_file_read(map, buffer, len) != APR_SUCCESS) {

        return -1;

        return -1;

    }

    }

    buffer[*len] = '\0';





    /* put a copy of the tag *after* the data read from the file

    endbody = ap_strstr(buffer, tag);

     * so that strstr() will find something with no reliance on

    if (!endbody) {

     * terminating '\0'

     */

    memcpy(buffer + *len, tag, taglen);

    endbody = strstr(buffer, tag);

    if (endbody == buffer + *len) {

        return -1;

        return -1;

    }

    }

    bodylen = endbody - buffer;

    bodylen = endbody - buffer;

    endbody += taglen;

    endbody += strlen(tag);

    /* Skip all the trailing cruft after the end tag to the next line */

    /* Skip all the trailing cruft after the end tag to the next line */

    while (*endbody) {

    while (*endbody) {

        if (*endbody == '\n') {

        if (*endbody == '\n') {