Commit f27ff223 authored by Mark J. Cox's avatar Mark J. Cox
Browse files

SECURITY: CVE-2006-3747 (cve.mitre.org) 

mod_rewrite: Fix an off-by-one security problem in the ldap scheme
handling.  For some RewriteRules this could lead to a pointer being
written out of bounds.  Reported by Mark Dowd of McAfee.

Reviewed by: trawick, lars, jorton, wrowe, benl



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@426144 13f79535-47bb-0310-9956-ffa450edef68
parent 8aecc56f

CHANGES

+6 −0
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.0.59













  *) SECURITY: CVE-2006-3747 (cve.mitre.org)













     mod_rewrite: Fix an off-by-one security problem in the ldap scheme













     handling.  For some RewriteRules this could lead to a pointer being













     written out of bounds.  Reported by Mark Dowd of McAfee.













     [Mark Cox]



























Changes with Apache 2.0.58





























  *) Legal: Restored original years in copyright notices.

































modules/mappers/mod_rewrite.c



+1
−1






























Original line number
Diff line number
Diff line








@@ -2906,7 +2906,7 @@ static char *escape_absolute_uri(apr_pool_t *p, char *uri, unsigned scheme)













            int c = 0;































            token[0] = cp = apr_pstrdup(p, cp);













            while (*cp && c < 5) {













            while (*cp && c < 4) {















                if (*cp == '?') {















                    token[++c] = cp + 1;















                    *cp = '\0';