subversion-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From i...@apache.org
Subject svn commit: r1647887 - in /subversion/trunk/subversion: include/mod_dav_svn.h mod_authz_svn/mod_authz_svn.c mod_dav_svn/mod_dav_svn.c mod_dav_svn/repos.c
Date Thu, 25 Dec 2014 10:01:38 GMT
Author: ivan
Date: Thu Dec 25 10:01:38 2014
New Revision: 1647887

URL: http://svn.apache.org/r1647887
Log:
Fix unbounded memory usage in mod_authz_svn when SVNPathAuthz short_circuit
option is used.

* subversion/include/mod_dav_svn.h
  (dav_svn_split_uri2, dav_svn_get_repos_path2): New.
  (dav_svn_split_uri, dav_svn_get_repos_path): Update docstring.

* subversion/mod_authz_svn/mod_authz_svn.c
  (get_access_conf): Call dav_svn_get_repos_path2() instead of
   dav_svn_get_repos_path() passing SCRATCH_POOL as POOL parameter.

* subversion/mod_dav_svn/mod_dav_svn.c
  (dav_svn_get_repos_path): Rename to ...
  (dav_svn_get_repos_path2): ... this, adding POOL parameter and use it for
   all allocations.
  (dav_svn_get_repos_path): New, wraps dav_svn_get_repos_path2().

* subversion/mod_dav_svn/repos.c
  (dav_svn_split_uri): Rename to ...
  (dav_svn_split_uri2): ... this, adding POOL parameter and use it for
   all allocations.
  (dav_svn_split_uri): New, wraps dav_svn_split_uri2().

Modified:
    subversion/trunk/subversion/include/mod_dav_svn.h
    subversion/trunk/subversion/mod_authz_svn/mod_authz_svn.c
    subversion/trunk/subversion/mod_dav_svn/mod_dav_svn.c
    subversion/trunk/subversion/mod_dav_svn/repos.c

Modified: subversion/trunk/subversion/include/mod_dav_svn.h
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/include/mod_dav_svn.h?rev=1647887&r1=1647886&r2=1647887&view=diff
==============================================================================
--- subversion/trunk/subversion/include/mod_dav_svn.h (original)
+++ subversion/trunk/subversion/include/mod_dav_svn.h Thu Dec 25 10:01:38 2014
@@ -40,7 +40,7 @@ extern "C" {
 /**
    Given an apache request @a r, a @a uri, and a @a root_path to the svn
    location block, process @a uri and return many things, allocated in
-   @a r->pool:
+   @a pool:
 
    - @a cleaned_uri:    The uri with duplicate and trailing slashes removed.
 
@@ -74,7 +74,25 @@ extern "C" {
      - @a relative_path:  /!svn/blah/13/A/B/alpha
      - @a repos_path:     A/B/alpha
      - @a trailing_slash: FALSE
+
+   NOTE: The returned dav_error will be also allocated in @a pool, not
+         in @a r->pool.
+
+   @since New in 1.9
 */
+AP_MODULE_DECLARE(dav_error *) dav_svn_split_uri2(request_rec *r,
+                                                  const char *uri_to_split,
+                                                  const char *root_path,
+                                                  const char **cleaned_uri,
+                                                  int *trailing_slash,
+                                                  const char **repos_basename,
+                                                  const char **relative_path,
+                                                  const char **repos_path,
+                                                  apr_pool_t *pool);
+
+/**
+ * Same as dav_svn_split_uri2() but allocates the result in @a r->pool.
+ */
 AP_MODULE_DECLARE(dav_error *) dav_svn_split_uri(request_rec *r,
                                                  const char *uri,
                                                  const char *root_path,
@@ -87,7 +105,22 @@ AP_MODULE_DECLARE(dav_error *) dav_svn_s
 
 /**
  * Given an apache request @a r and a @a root_path to the svn location
- * block, set @a *repos_path to the path of the repository on disk.  */
+ * block, set @a *repos_path to the path of the repository on disk.
+ * Perform all allocations in @a pool.
+ *
+ * NOTE: The returned dav_error will be also allocated in @a pool, not
+ *       in @a r->pool.
+ *
+ * @since New in 1.9
+ */
+AP_MODULE_DECLARE(dav_error *) dav_svn_get_repos_path2(request_rec *r,
+                                                       const char *root_path,
+                                                       const char **repos_path,
+                                                       apr_pool_t *pool);
+
+/**
+ * Same as dav_svn_get_repos_path2() but allocates the result in@a r->pool.
+ */
 AP_MODULE_DECLARE(dav_error *) dav_svn_get_repos_path(request_rec *r,
                                                       const char *root_path,
                                                       const char **repos_path);

Modified: subversion/trunk/subversion/mod_authz_svn/mod_authz_svn.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/mod_authz_svn/mod_authz_svn.c?rev=1647887&r1=1647886&r2=1647887&view=diff
==============================================================================
--- subversion/trunk/subversion/mod_authz_svn/mod_authz_svn.c (original)
+++ subversion/trunk/subversion/mod_authz_svn/mod_authz_svn.c Thu Dec 25 10:01:38 2014
@@ -361,7 +361,7 @@ get_access_conf(request_rec *r, authz_sv
   svn_error_t *svn_err = SVN_NO_ERROR;
   dav_error *dav_err;
 
-  dav_err = dav_svn_get_repos_path(r, conf->base_path, &repos_path);
+  dav_err = dav_svn_get_repos_path2(r, conf->base_path, &repos_path, scratch_pool);
   if (dav_err)
     {
       ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "%s", dav_err->desc);

Modified: subversion/trunk/subversion/mod_dav_svn/mod_dav_svn.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/mod_dav_svn/mod_dav_svn.c?rev=1647887&r1=1647886&r2=1647887&view=diff
==============================================================================
--- subversion/trunk/subversion/mod_dav_svn/mod_dav_svn.c (original)
+++ subversion/trunk/subversion/mod_dav_svn/mod_dav_svn.c Thu Dec 25 10:01:38 2014
@@ -662,9 +662,10 @@ dav_svn__get_fs_parent_path(request_rec
 
 
 AP_MODULE_DECLARE(dav_error *)
-dav_svn_get_repos_path(request_rec *r,
-                       const char *root_path,
-                       const char **repos_path)
+dav_svn_get_repos_path2(request_rec *r,
+                        const char *root_path,
+                        const char **repos_path,
+                        apr_pool_t *pool)
 {
 
   const char *fs_path;
@@ -692,19 +693,26 @@ dav_svn_get_repos_path(request_rec *r,
 
   /* Split the svn URI to get the name of the repository below
      the parent path. */
-  derr = dav_svn_split_uri(r, r->uri, root_path,
-                           &ignored_cleaned_uri, &ignored_had_slash,
-                           &repos_name,
-                           &ignored_relative, &ignored_path_in_repos);
+  derr = dav_svn_split_uri2(r, r->uri, root_path,
+                            &ignored_cleaned_uri, &ignored_had_slash,
+                            &repos_name,
+                            &ignored_relative, &ignored_path_in_repos, pool);
   if (derr)
     return derr;
 
   /* Construct the full path from the parent path base directory
      and the repository name. */
-  *repos_path = svn_dirent_join(fs_parent_path, repos_name, r->pool);
+  *repos_path = svn_dirent_join(fs_parent_path, repos_name, pool);
   return NULL;
 }
 
+AP_MODULE_DECLARE(dav_error *)
+dav_svn_get_repos_path(request_rec *r,
+                       const char *root_path,
+                       const char **repos_path)
+{
+  return dav_svn_get_repos_path2(r, root_path, repos_path, r->pool);
+}
 
 const char *
 dav_svn__get_repo_name(request_rec *r)

Modified: subversion/trunk/subversion/mod_dav_svn/repos.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/mod_dav_svn/repos.c?rev=1647887&r1=1647886&r2=1647887&view=diff
==============================================================================
--- subversion/trunk/subversion/mod_dav_svn/repos.c (original)
+++ subversion/trunk/subversion/mod_dav_svn/repos.c Thu Dec 25 10:01:38 2014
@@ -1209,14 +1209,15 @@ static void log_warning(void *baton, svn
 
 
 AP_MODULE_DECLARE(dav_error *)
-dav_svn_split_uri(request_rec *r,
-                  const char *uri_to_split,
-                  const char *root_path,
-                  const char **cleaned_uri,
-                  int *trailing_slash,
-                  const char **repos_basename,
-                  const char **relative_path,
-                  const char **repos_path)
+dav_svn_split_uri2(request_rec *r,
+                   const char *uri_to_split,
+                   const char *root_path,
+                   const char **cleaned_uri,
+                   int *trailing_slash,
+                   const char **repos_basename,
+                   const char **relative_path,
+                   const char **repos_path,
+                   apr_pool_t *pool)
 {
   apr_size_t len1;
   int had_slash;
@@ -1232,7 +1233,7 @@ dav_svn_split_uri(request_rec *r,
   if ((fs_path == NULL) && (fs_parent_path == NULL))
     {
       /* ### are SVN_ERR_APMOD codes within the right numeric space? */
-      return dav_svn__new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR,
+      return dav_svn__new_error(pool, HTTP_INTERNAL_SERVER_ERROR,
                                 SVN_ERR_APMOD_MISSING_PATH_TO_FS,
                                 "The server is misconfigured: "
                                 "either an SVNPath or SVNParentPath "
@@ -1241,7 +1242,7 @@ dav_svn_split_uri(request_rec *r,
     }
 
   /* make a copy so that we can do some work on it */
-  uri = apr_pstrdup(r->pool, uri_to_split);
+  uri = apr_pstrdup(pool, uri_to_split);
 
   /* remove duplicate slashes, and make sure URI has no trailing '/' */
   ap_no2slash(uri);
@@ -1256,7 +1257,7 @@ dav_svn_split_uri(request_rec *r,
     *trailing_slash = FALSE;
 
   /* return the first item.  */
-  *cleaned_uri = apr_pstrdup(r->pool, uri);
+  *cleaned_uri = apr_pstrdup(pool, uri);
 
   /* The URL space defined by the SVN provider is always a virtual
      space. Construct the path relative to the configured Location
@@ -1297,7 +1298,7 @@ dav_svn_split_uri(request_rec *r,
   if (fs_path != NULL)
     {
       /* the repos_basename is the last component of root_path. */
-      *repos_basename = svn_dirent_basename(root_path, r->pool);
+      *repos_basename = svn_dirent_basename(root_path, pool);
 
       /* 'relative' is already correct for SVNPath; the root_path
          already contains the name of the repository, so relative is
@@ -1315,7 +1316,7 @@ dav_svn_split_uri(request_rec *r,
       if (relative[1] == '\0')
         {
           /* ### are SVN_ERR_APMOD codes within the right numeric space? */
-          return dav_svn__new_error(r->pool, HTTP_FORBIDDEN,
+          return dav_svn__new_error(pool, HTTP_FORBIDDEN,
                                     SVN_ERR_APMOD_MALFORMED_URI,
                                     "The URI does not contain the name "
                                     "of a repository.");
@@ -1332,7 +1333,7 @@ dav_svn_split_uri(request_rec *r,
         }
       else
         {
-          magic_component = apr_pstrndup(r->pool, relative + 1,
+          magic_component = apr_pstrndup(pool, relative + 1,
                                          magic_end - relative - 1);
           relative = magic_end;
         }
@@ -1342,7 +1343,7 @@ dav_svn_split_uri(request_rec *r,
     }
 
   /* We can return 'relative' at this point too. */
-  *relative_path = apr_pstrdup(r->pool, relative);
+  *relative_path = apr_pstrdup(pool, relative);
 
   /* Code to remove the !svn junk from the front of the relative path,
      mainly stolen from parse_uri().  This code assumes that
@@ -1363,7 +1364,7 @@ dav_svn_split_uri(request_rec *r,
         if (ch == '\0')
           {
             /* relative is just "!svn", which is malformed. */
-            return dav_svn__new_error(r->pool, HTTP_NOT_FOUND,
+            return dav_svn__new_error(pool, HTTP_NOT_FOUND,
                                       SVN_ERR_APMOD_MALFORMED_URI,
                                       "Nothing follows the svn special_uri.");
           }
@@ -1390,7 +1391,7 @@ dav_svn_split_uri(request_rec *r,
                           *repos_path = NULL;
                         else
                           return dav_svn__new_error(
-                                     r->pool, HTTP_NOT_FOUND,
+                                     pool, HTTP_NOT_FOUND,
                                      SVN_ERR_APMOD_MALFORMED_URI,
                                      "Missing info after special_uri.");
                       }
@@ -1414,7 +1415,7 @@ dav_svn_split_uri(request_rec *r,
                             /* Did we break from the loop prematurely? */
                             if (j != (defn->numcomponents - 1))
                               return dav_svn__new_error(
-                                         r->pool, HTTP_NOT_FOUND,
+                                         pool, HTTP_NOT_FOUND,
                                          SVN_ERR_APMOD_MALFORMED_URI,
                                          "Not enough components after "
                                          "special_uri.");
@@ -1428,13 +1429,13 @@ dav_svn_split_uri(request_rec *r,
                         else
                           {
                             /* Found a slash after the special components. */
-                            *repos_path = apr_pstrdup(r->pool, start - 1);
+                            *repos_path = apr_pstrdup(pool, start - 1);
                           }
                       }
                     else
                       {
                         return
-                          dav_svn__new_error(r->pool, HTTP_NOT_FOUND,
+                          dav_svn__new_error(pool, HTTP_NOT_FOUND,
                                         SVN_ERR_APMOD_MALFORMED_URI,
                                         "Unknown data after special_uri.");
                       }
@@ -1445,7 +1446,7 @@ dav_svn_split_uri(request_rec *r,
 
             if (defn->name == NULL)
               return
-                dav_svn__new_error(r->pool, HTTP_NOT_FOUND,
+                dav_svn__new_error(pool, HTTP_NOT_FOUND,
                                    SVN_ERR_APMOD_MALFORMED_URI,
                                    "Couldn't match subdir after special_uri.");
           }
@@ -1454,13 +1455,27 @@ dav_svn_split_uri(request_rec *r,
       {
         /* There's no "!svn/" at all, so the relative path is already
            a valid path within the repository.  */
-        *repos_path = apr_pstrdup(r->pool, relative - 1);
+        *repos_path = apr_pstrdup(pool, relative - 1);
       }
   }
 
   return NULL;
 }
 
+AP_MODULE_DECLARE(dav_error *)
+dav_svn_split_uri(request_rec *r,
+                  const char *uri_to_split,
+                  const char *root_path,
+                  const char **cleaned_uri,
+                  int *trailing_slash,
+                  const char **repos_basename,
+                  const char **relative_path,
+                  const char **repos_path)
+{
+  return dav_svn_split_uri2(r, uri_to_split, root_path, cleaned_uri,
+                            trailing_slash, repos_basename, relative_path,
+                            repos_path, r->pool);
+}
 
 /* Context for cleanup handler. */
 struct cleanup_fs_access_baton



Mime
View raw message