apr-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From n..@apache.org
Subject svn commit: r577214 - in /apr/apr-util/trunk/dbd: apr_dbd_freetds.c apr_dbd_mysql.c apr_dbd_oracle.c
Date Wed, 19 Sep 2007 09:19:00 GMT
Author: niq
Date: Wed Sep 19 02:18:59 2007
New Revision: 577214

URL: http://svn.apache.org/viewvc?rev=577214&view=rev
Log:
Check we don't dereference memory that doesn't belong to us in
parsing DBDParams.  Not a big issue, because the data can only
come from httpd.conf, not an untrusted source.
Spotted by Rici Lake.

Modified:
    apr/apr-util/trunk/dbd/apr_dbd_freetds.c
    apr/apr-util/trunk/dbd/apr_dbd_mysql.c
    apr/apr-util/trunk/dbd/apr_dbd_oracle.c

Modified: apr/apr-util/trunk/dbd/apr_dbd_freetds.c
URL: http://svn.apache.org/viewvc/apr/apr-util/trunk/dbd/apr_dbd_freetds.c?rev=577214&r1=577213&r2=577214&view=diff
==============================================================================
--- apr/apr-util/trunk/dbd/apr_dbd_freetds.c (original)
+++ apr/apr-util/trunk/dbd/apr_dbd_freetds.c Wed Sep 19 02:18:59 2007
@@ -549,6 +549,10 @@
     }
     /* now set login properties */
     for (ptr = strchr(params, '='); ptr; ptr = strchr(ptr, '=')) {
+        /* don't dereference memory that may not belong to us */
+        if (ptr == params) {
+            continue;
+        }
         for (key = ptr-1; isspace(*key); --key);
         klen = 0;
         while (isalpha(*key)) {

Modified: apr/apr-util/trunk/dbd/apr_dbd_mysql.c
URL: http://svn.apache.org/viewvc/apr/apr-util/trunk/dbd/apr_dbd_mysql.c?rev=577214&r1=577213&r2=577214&view=diff
==============================================================================
--- apr/apr-util/trunk/dbd/apr_dbd_mysql.c (original)
+++ apr/apr-util/trunk/dbd/apr_dbd_mysql.c Wed Sep 19 02:18:59 2007
@@ -1101,6 +1101,10 @@
         return NULL;
     }
     for (ptr = strchr(params, '='); ptr; ptr = strchr(ptr, '=')) {
+        /* don't dereference memory that may not belong to us */
+        if (ptr == params) {
+            continue;
+        }
         for (key = ptr-1; isspace(*key); --key);
         klen = 0;
         while (isalpha(*key)) {

Modified: apr/apr-util/trunk/dbd/apr_dbd_oracle.c
URL: http://svn.apache.org/viewvc/apr/apr-util/trunk/dbd/apr_dbd_oracle.c?rev=577214&r1=577213&r2=577214&view=diff
==============================================================================
--- apr/apr-util/trunk/dbd/apr_dbd_oracle.c (original)
+++ apr/apr-util/trunk/dbd/apr_dbd_oracle.c Wed Sep 19 02:18:59 2007
@@ -466,6 +466,10 @@
 
     /* snitch parsing from the MySQL driver */
     for (ptr = strchr(params, '='); ptr; ptr = strchr(ptr, '=')) {
+        /* don't dereference memory that may not belong to us */
+        if (ptr == params) {
+            continue;
+        }
         for (key = ptr-1; isspace(*key); --key);
         klen = 0;
         while (isalpha(*key)) {



Mime
View raw message