Merge r1293405:

Fix AddOutputFilterByType brown paper bag crash bug
Initialize pointers, fix off-by-one.
PR: 52755

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1294157 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index acc1ab04beed3825c98bc699202590df7188f625..9c1972dae708c9665523360ce446045f4740deda 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,9 @@
 
 Changes with Apache 2.4.2
 
+  *) mod_filter: Fix segfault with AddOutputFilterByType. PR 52755.
+     [Stefan Fritsch]
+
   * mod_session: Sessions are encoded as application/x-www-form-urlencoded
     strings, however we do not handle the encoding of spaces properly.
     Fixed. [Graham Leggett]

diff --git a/STATUS b/STATUS
index 5f0abbef077d847a63d7c166b1c5ce50762093bd..512428c2f4c3854184e32f0d0be1f1b46d4430d2 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -88,13 +88,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-  * Fix AddOutputFilterByType brown paper bag crash bug
-    Initialize pointers, fix off-by-one.
-    PR: 52755
-    Trunk patches: http://svn.apache.org/viewvc?view=revision&revision=1293405
-    2.4.x patch: Trunk patch works
-    +1: minfrin, sf, trawick
-
   * Enable per-module loglevel for mod_xml2enc and mod_proxy_html
     Trunk patches: http://svn.apache.org/viewvc?view=revision&revision=1293708
     2.4.x patch: Trunk patch works

diff --git a/modules/filters/mod_filter.c b/modules/filters/mod_filter.c
index 32d8bd3388f66afdce33aeee9f89ee373896a942..7dd7db1abb7eee71205788c2128b6af714d9a410 100644 (file)
--- a/modules/filters/mod_filter.c
+++ b/modules/filters/mod_filter.c
@@ -131,6 +131,7 @@ static int filter_init(ap_filter_t *f)
     f->ctx = fctx;
     return OK;
 }
+
 static int filter_lookup(ap_filter_t *f, ap_filter_rec_t *filter)
 {
     ap_filter_provider_t *provider;
@@ -461,9 +462,11 @@ static const char *add_filter(cmd_parms *cmd, void *CFG,
                                NULL);
         }
         provider->expr = node;
+        provider->types = NULL;
     }
     else {
         provider->types = types;
+        provider->expr = NULL;
     }
     provider->frec = provider_frec;
     provider->next = frec->providers;
@@ -594,7 +597,7 @@ static const char *filter_bytype(cmd_parms *cmd, void *CFG,
     name = apr_pstrdup(cmd->temp_pool, argv[0]);
     types = apr_palloc(cmd->pool, argc * sizeof(char *));
     memcpy(types, &argv[1], (argc - 1) * sizeof(char *));
-    types[argc] = NULL;
+    types[argc-1] = NULL;
     for (pname = apr_strtok(name, ";", &strtok_state);
          pname != NULL && rv == NULL;
          pname = apr_strtok(NULL, ";", &strtok_state)) {