Return-Path: 
 <dev-return-49875-apmail-httpd-dev-archive=httpd.apache.org@httpd.apache.org>
Delivered-To: apmail-httpd-dev-archive@www.apache.org
Received: (qmail 634 invoked from network); 15 Oct 2005 19:19:06 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (209.237.227.199)
  by minotaur.apache.org with SMTP; 15 Oct 2005 19:19:06 -0000
Received: (qmail 73566 invoked by uid 500); 15 Oct 2005 19:19:03 -0000
Delivered-To: apmail-httpd-dev-archive@httpd.apache.org
Received: (qmail 73105 invoked by uid 500); 15 Oct 2005 19:19:01 -0000
Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
list-help: <mailto:dev-help@httpd.apache.org>
list-unsubscribe: <mailto:dev-unsubscribe@httpd.apache.org>
List-Post: <mailto:dev@httpd.apache.org>
List-Id: <dev.httpd.apache.org>
Delivered-To: mailing list dev@httpd.apache.org
Received: (qmail 73094 invoked by uid 99); 15 Oct 2005 19:19:01 -0000
Received: from asf.osuosl.org (HELO asf.osuosl.org) (140.211.166.49)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 15 Oct 2005 12:19:01 -0700
X-ASF-Spam-Status: No, hits=-0.0 required=10.0
	tests=SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (asf.osuosl.org: domain of chip@force-elite.com designates
 216.255.199.145 as permitted sender)
Received: from [216.255.199.145] (HELO utopia.in.force-elite.com)
 (216.255.199.145)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 15 Oct 2005 12:19:02 -0700
X-AuthUser: chip@force-elite.com
Received: from [127.0.0.1] (127.0.0.1:35299)
	by localhost with [XMail 1.17 (Linux/Ix86) ESMTP Server]
	id <SDB9DA> for <dev@httpd.apache.org> from <chip@force-elite.com>;
	Sat, 15 Oct 2005 12:18:40 -0700
Message-ID: <4351560E.2000000@force-elite.com>
Date: Sat, 15 Oct 2005 12:18:38 -0700
From: Paul Querna <chip@force-elite.com>
User-Agent: Thunderbird 1.6a1 (Macintosh/20051011)
MIME-Version: 1.0
To: Justin Erenkrantz <justin@erenkrantz.com>,  dev@httpd.apache.org
Subject: Re: svn commit: r321449 - in /httpd/mod_mbox/trunk/module-2.0:
 mod_mbox_file.c
 mod_mbox_index.c
References: <20051015185431.87565.qmail@minotaur.apache.org>
 <200510152100.48203@news.perlig.de> <4351539F.6070304@force-elite.com>
 <20051015191241.GJ8466@scotch.ics.uci.edu>
In-Reply-To: <20051015191241.GJ8466@scotch.ics.uci.edu>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org
X-Spam-Rating: minotaur.apache.org 1.6.2 0/1000/N

Justin Erenkrantz wrote:
> On Sat, Oct 15, 2005 at 12:08:15PM -0700, Paul Querna wrote:
>> Except when we get a HEAD request, r->path_info is filled with bogus 
>> data, which causes mod_mbox to crash way deep inside itself.
> 
> Why isn't r->path_info filled out correctly?
> 
> If the request's path_info itself is bogus, that should be rejected
> outright by mod_mbox regardless of the method.  -- justin
(gdb) where
#0  get_base_uri (r=0x60000000001eb598) at mod_mbox.c:197
#1  0x2000000001007a10 in get_base_path (r=0x60000000001eb598)
     at mod_mbox.c:178
#2  0x200000000100cfa0 in mbox_static_message (r=0x60000000001eb420,
     f=0x600000000020ac60) at mod_mbox_out.c:1103
#3  0x2000000001008ca0 in mbox_file_handler (r=0x60000000001eb420)
     at mod_mbox_file.c:231
#4  0x4000000000035f90 in ap_run_handler (r=0x60000000001eb420) at 
config.c:153
....

(gdb) f 0
#0  get_base_uri (r=0x60000000001eb598) at mod_mbox.c:197

(gdb) l
192     {
193         char *baseURI, *temp;
194
195         baseURI = apr_pstrdup(r->pool, r->uri);
196         temp = strstr(baseURI, r->path_info);
197         if (temp) {
198             *temp = '\0';
199         }
200         return baseURI;
201     }
(gdb) p r->path_info
$5 = 0x6000000000000019 <Address 0x6000000000000019 out of bounds> 

(gdb) p r->header_only
$6 = 1


Feel free to look at it on ajax:
gdb /usr/local/apache2-install/www.apache.org/current/bin/httpd 
core.13385

-Paul