Merge r1624234 from trunk:

SECURITY (CVE-2014-3581): Fix a mod_cache NULL pointer deference
in Content-Type handling.

mod_cache: Avoid a crash when Content-Type has an empty value. PR56924.

Submitted By: Mark Montague <mark catseye.org>
Reviewed By: Jan Kaluza

Submitted by: jkaluza
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1627749 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 9970e0256bfb41e297b6a682fb036ecc94a6d016..57afe6612d8bcfb2c65feff9738168818650dea3 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,10 @@
 
 Changes with Apache 2.4.11
 
+  *) SECURITY: CVE-2014-3581 (cve.mitre.org)
+     mod_cache: Avoid a crash when Content-Type has an empty value.
+     PR 56924.  [Mark Montague <mark catseye.org>, Jan Kaluza]
+
   *) mod_cache: Avoid sending 304 responses during failed revalidations
      PR56881. [Eric Covener]
 

diff --git a/STATUS b/STATUS
index 477c0511ddb8e7b49cf99b2a3dce077dc6810e19..e758c22a12202b68e59ec90a4066ff56c870d01a 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -102,11 +102,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-   * mod_cache: CVE-2014-3581 - Avoid a crash when Content-Type has an empty
-     value. PR56924.
-     trunk patch: http://svn.apache.org/r1624234
-     2.4.x patch: trunk works (modulo CHANGES)
-     +1: jkaluza, jim, ylavic
 
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:

diff --git a/modules/cache/cache_util.c b/modules/cache/cache_util.c
index 6368af09681858a663db46f4d030cdb65816a5a1..b7454ad6a1540b4427f0cd42c7f1800eb3af9a94 100644 (file)
--- a/modules/cache/cache_util.c
+++ b/modules/cache/cache_util.c
@@ -1258,8 +1258,10 @@ apr_table_t *cache_merge_headers_out(request_rec *r)
 
     if (r->content_type
             && !apr_table_get(headers_out, "Content-Type")) {
-        apr_table_setn(headers_out, "Content-Type",
-                       ap_make_content_type(r, r->content_type));
+        const char *ctype = ap_make_content_type(r, r->content_type);
+        if (ctype) {
+            apr_table_setn(headers_out, "Content-Type", ctype);
+        }
     }
 
     if (r->content_encoding