Commit e2a9028d authored by Mark J. Cox's avatar Mark J. Cox
Browse files

SECURITY: CVE-2006-3747 (cve.mitre.org) 

mod_rewrite: Fix an off-by-one security problem in the ldap scheme
handling.  For some RewriteRules this could lead to a pointer being
written out of bounds.  Reported by Mark Dowd of McAfee.

Ack: trawick, lars, jorton, wrowe, benl



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@426138 13f79535-47bb-0310-9956-ffa450edef68
parent 0bb4151d

CHANGES

+6 −0
Original line number Original line Diff line number Diff line
@@ -2,6 +2,12 @@ 
Changes with Apache 2.3.0

Changes with Apache 2.3.0

  [Remove entries to the current 2.0 and 2.2 section below, when backported]

  [Remove entries to the current 2.0 and 2.2 section below, when backported]




















  *) SECURITY: CVE-2006-3747 (cve.mitre.org)














     mod_rewrite: Fix an off-by-one security problem in the ldap scheme














     handling.  For some RewriteRules this could lead to a pointer being














     written out of bounds.  Reported by Mark Dowd of McAfee.














     [Mark Cox]
























  *) mod_cache: While serving a cached entity ensure that filters that have







  *) mod_cache: While serving a cached entity ensure that filters that have











     been applied to this cached entity before saving it to the cache are not







     been applied to this cached entity before saving it to the cache are not











     applied again. PR 40090. [Ruediger Pluem]







     applied again. PR 40090. [Ruediger Pluem]

































modules/mappers/mod_rewrite.c



+1
−1






























Original line number
Original line
Diff line number
Diff line








@@ -670,7 +670,7 @@ static char *escape_absolute_uri(apr_pool_t *p, char *uri, unsigned scheme)









            int c = 0;







            int c = 0;































            token[0] = cp = apr_pstrdup(p, cp);







            token[0] = cp = apr_pstrdup(p, cp);











            while (*cp && c < 5) {







            while (*cp && c < 4) {











                if (*cp == '?') {







                if (*cp == '?') {











                    token[++c] = cp + 1;







                    token[++c] = cp + 1;











                    *cp = '\0';







                    *cp = '\0';