www-apache-bugdb mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From David Lai <i...@bigbiz.com>
Subject general/1777: pregsub() in util.c fails to append remainder of string; causes ScriptAliasMatch to fail
Date Fri, 06 Feb 1998 13:42:08 GMT

>Number:         1777
>Category:       general
>Synopsis:       pregsub() in util.c fails to append remainder of string; causes ScriptAliasMatch
to fail
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Fri Feb  6 05:50:00 PST 1998
>Last-Modified:
>Originator:     info@bigbiz.com
>Organization:
apache
>Release:        1.3b3
>Environment:
Linux i386 2.0.32, gcc 2.7.2
>Description:
With a rule like:

ScriptAliasMatch ^/(.*)/_vti_bin/ /web/user1/html/$1/_vti_bin/

and a URI input
/king/_vti_bin/shtml.exe

we expect a match and a translation to /web/user1/html/king/_vti_bin/shtml.exe

However the code returns /web/user1/html/king/_vti_bin/
and then server errors with trying to execute dir as a script

The problem is in util.c in pregsub, it fails to account for the
remaining portion of "source" which falls outside of the pattern matched.

>How-To-Repeat:
yes
>Fix:
I patched util.c, pregsub() however I'm now a bit worried some other code
depends on this errant behaviour.  Maybe I should have patched mod_alias instead.
Please send me your opinions... info@bigbiz.com.  Patch below:

dlai@bacon:/d6/apache_1.3b3?diff -C 5 src/main/util.c.orig src/main/util.c
*** src/main/util.c.orig        Fri Feb  6 05:39:15 1998
--- src/main/util.c     Fri Feb  6 05:40:58 1998
***************
*** 263,272 ****
--- 263,274 ----
        else if (no < nmatch && pmatch[no].rm_so < pmatch[no].rm_eo) {
            len += pmatch[no].rm_eo - pmatch[no].rm_so;
        }
  
      }
+     /* add in the remainder of the string (if any) */
+     len += strlen(source) - (pmatch[0].rm_eo);
  
      dest = dst = pcalloc(p, len + 1);
  
      /* Now actually fill in the string */
  
***************
*** 292,302 ****
            if (*(dst - 1) == '\0')     /* strncpy hit NULL. */
                return NULL;
        }
  
      }
!     *dst = '\0';
  
      return dest;
  }
  
  /*
--- 294,307 ----
            if (*(dst - 1) == '\0')     /* strncpy hit NULL. */
                return NULL;
        }
  
      }
!     /* now append the remaining characters */
!     src=source+pmatch[0].rm_eo;
!     while( (*dst++ = *src++));
!     /* *dst = '\0'; */
  
      return dest;
  }
  
  /*
%0
>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, ]
[you need to include <apbugs@Apache.Org> in the Cc line ]
[and leave the subject line UNCHANGED.  This is not done]
[automatically because of the potential for mail loops. ]




Mime
View raw message