Fix AddOutputFilterByType brown paper bag crash bug

Initialize pointers, fix off-by-one.

PR: 52755

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1293405 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/filters/mod_filter.c b/modules/filters/mod_filter.c
index 32d8bd3388f66afdce33aeee9f89ee373896a942..7dd7db1abb7eee71205788c2128b6af714d9a410 100644 (file)
--- a/modules/filters/mod_filter.c
+++ b/modules/filters/mod_filter.c
@@ -131,6 +131,7 @@ static int filter_init(ap_filter_t *f)
     f->ctx = fctx;
     return OK;
 }
+
 static int filter_lookup(ap_filter_t *f, ap_filter_rec_t *filter)
 {
     ap_filter_provider_t *provider;
@@ -461,9 +462,11 @@ static const char *add_filter(cmd_parms *cmd, void *CFG,
                                NULL);
         }
         provider->expr = node;
+        provider->types = NULL;
     }
     else {
         provider->types = types;
+        provider->expr = NULL;
     }
     provider->frec = provider_frec;
     provider->next = frec->providers;
@@ -594,7 +597,7 @@ static const char *filter_bytype(cmd_parms *cmd, void *CFG,
     name = apr_pstrdup(cmd->temp_pool, argv[0]);
     types = apr_palloc(cmd->pool, argc * sizeof(char *));
     memcpy(types, &argv[1], (argc - 1) * sizeof(char *));
-    types[argc] = NULL;
+    types[argc-1] = NULL;
     for (pname = apr_strtok(name, ";", &strtok_state);
          pname != NULL && rv == NULL;
          pname = apr_strtok(NULL, ";", &strtok_state)) {