Merge r1830746 from trunk:

mod_proxy_html: Fix variable interpolation and memory allocation failure in ProxyHTMLURLMap.

Proposed by: Ewald Dieterich <ewald mailbox.org>
Reviewed by: ylavic

Submitted by: ylavic
Reviewed by: ylavic, jailletc36, jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1833840 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index ccb2838d634290e7a5c35b80b91f5e7cfcff8774..3e00881fdebbcb9e6fb2ec0c750ef2cfa1eb60ec 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.4.34
 
+  *) mod_proxy_html: Fix variable interpolation and memory allocation failure
+     in ProxyHTMLURLMap.  [Ewald Dieterich <ewald mailbox.org>]
+
   *) mod_remoteip: Fix RemoteIP{Trusted,Internal}ProxyList loading broken by 2.4.30.
      PR 62220.  [Chritophe Jaillet, Yann Ylavic]
 

diff --git a/STATUS b/STATUS
index 46927f3119698527376693f5c86ddad038eb3e56..52d2f2838952865a26341b9cff284b904d08a94d 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -141,13 +141,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-  *) mod_proxy_html: Fix variable interpolation and memory allocation failure
-     in ProxyHTMLURLMap. PR 62344.
-     trunk patch: http://svn.apache.org/r1830746
-     2.4.x patch: svn merge -c 1830746 ^/httpd/httpd/trunk .
-                  (trunk works modulo CHANGES))
-     +1: ylavic, jailletc36, jim
-
   *) http: Fix small memory leak per request when handling persistent connections
      trunk patch: http://svn.apache.org/r1833014
      2.4.x patch: trunk works (modulo CHANGES)

diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c
index 78ebdab34ecddd5ec9162829cb02d7de6ef3332a..7658fa3c613f704cc7e54182db96f51c060f344b 100644 (file)
--- a/modules/filters/mod_proxy_html.c
+++ b/modules/filters/mod_proxy_html.c
@@ -724,6 +724,12 @@ static const char *interpolate_vars(request_rec *r, const char *str)
             break;
 
         delim = ap_strchr_c(start, '|');
+
+        /* Restrict delim to ${...} */
+        if (delim && delim >= end) {
+            delim = NULL;
+        }
+
         before = apr_pstrndup(r->pool, str, start-str);
         after = end+1;
         if (delim) {