Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: <55E14871.3000209@wanadoo.fr>
References: <20140715122701.0365D23888D7@eris.apache.org>
	<55E14871.3000209@wanadoo.fr>
Date: Sat, 29 Aug 2015 10:01:40 -0400
Message-ID: 
 <CALK=YjN6XAPnrRAFHWXnayO=vkE0=2SGue5KOpKs44kUtcc6zA@mail.gmail.com>
Subject: Re: svn commit: r1610674 - in /httpd/httpd/trunk: include/ap_mmn.h
 include/httpd.h modules/proxy/mod_proxy_http.c modules/proxy/proxy_util.c
 server/util.c
From: Eric Covener <covener@gmail.com>
To: Apache HTTP Server Development List <dev@httpd.apache.org>
Content-Type: text/plain; charset=UTF-8

On Sat, Aug 29, 2015 at 1:51 AM, Christophe JAILLET
<christophe.jaillet@wanadoo.fr> wrote:
> If i understand correctly, if we find an invalid char and 'skip_invalid', we
> first look for the next comma and start searching for new token from there.
> If no comma is found before the trailing NULL, then nothing more can be
> found and we end the processing.
>
> So shouldn't this be:
>     cur = temp + 1;
> (i.e. go to the character *following* the comma)
>
> Not tested, but I think that if the invalid character is the one just before
> the comma, then we loop forever.

I think the bottom of the loop has cur++ and there is no break in this
path, so the next iteration will start on the separator and treat it
as an empty token?

> Also if the:
>    temp = ap_strchr_c(cur, '\0');
> above is supposed to reach the end of the string and stop processing, we
> have the same problem and can loop forever if the last non-NULL char is the
> invalid char.

Same as above I think?

>
> In this case, adding:
>    string_end = (c == '\0');
> as in the normal case, would be fine.

All of the above might be more clear if confirmed.