httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From s.@apache.org
Subject svn commit: r1198926 - /httpd/httpd/trunk/modules/filters/mod_substitute.c
Date Mon, 07 Nov 2011 20:53:12 GMT
Author: sf
Date: Mon Nov  7 20:53:12 2011
New Revision: 1198926

URL: http://svn.apache.org/viewvc?rev=1198926&view=rev
Log:
Also do length check if the last line is not LF terminated

Modified:
    httpd/httpd/trunk/modules/filters/mod_substitute.c

Modified: httpd/httpd/trunk/modules/filters/mod_substitute.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/filters/mod_substitute.c?rev=1198926&r1=1198925&r2=1198926&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/filters/mod_substitute.c (original)
+++ httpd/httpd/trunk/modules/filters/mod_substitute.c Mon Nov  7 20:53:12 2011
@@ -184,6 +184,9 @@ static apr_status_t do_pattmatch(ap_filt
                         buff += len;
                     }
                     if (have_match && script->flatten && !force_quick)
{
+                        /* XXX: we should check for AP_MAX_BUCKETS here and
+                         * XXX: call ap_pass_brigade accordingly
+                         */
                         char *copy = ap_varbuf_pdup(pool, &vb, NULL, 0,
                                                     buff, bytes, &len);
                         tmp_b = apr_bucket_pool_create(copy, len, pool,
@@ -346,6 +349,10 @@ static apr_status_t substitute_filter(ap
                                           &fbytes, ctx->tpool);
                 if (rv != APR_SUCCESS)
                     goto err;
+                if (fbytes > AP_SUBST_MAX_LINE_LENGTH) {
+                    rv = APR_ENOMEM;
+                    goto err;
+                }
                 tmp_b = apr_bucket_transient_create(bflat, fbytes,
                                                 f->r->connection->bucket_alloc);
                 rv = do_pattmatch(f, tmp_b, ctx->pattbb, ctx->tpool);



Mime
View raw message