Fix some mod_include bugs which broke the evaluation of some expressions.

There are a few instances of the same basic problem which are not yet
fixed and which I have marked with /* XXX.*FUBAR*/.

PR:      10108

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@93916 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index ec24f8a8dca8e7febc6d0bd6e56772da0f29cc68..1d2e30bfa8573b07b2e160114ce8cad020b4ba56 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
 Changes with Apache 2.0.34-dev
 
+  *) Fix some mod_include problems which broke evaluation of some
+     expressions.  PR 10108  [Jeff Trawick]
+
   *) Fix the calculation of request time in mod_status.  [Stas Bekman]
 
   *) Fix the calculation of thread_num in the worker score structure.

diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
index 48b73de8cbc5603c2aed6f7123545086e9862d87..ab89e5b36efb6c9918b7de2ac0628caec8b8a572 100644 (file)
--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
@@ -1901,12 +1901,15 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
             case token_string:
                 if (current->token.value[0] != '\0') {
                     strncat(current->token.value, " ",
+                         /* XXX sizeof() use is FUBAR */
                          sizeof(current->token.value)
                             - strlen(current->token.value) - 1);
                 }
                 strncat(current->token.value, new->token.value,
+                         /* XXX sizeof() use is FUBAR */
                          sizeof(current->token.value)
                             - strlen(current->token.value) - 1);
+                /* XXX sizeof() use is FUBAR */
                 current->token.value[sizeof(current->token.value) - 1] = '\0';
                 break;
             case token_eq:
@@ -2211,8 +2214,7 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
 #endif
             buffer = ap_ssi_parse_string(r, ctx, current->token.value, NULL, 
                                          MAX_STRING_LEN, 0);
-            apr_cpystrn(current->token.value, buffer, 
-                        sizeof(current->token.value));
+            current->token.value = buffer;
             current->value = (current->token.value[0] != '\0');
             current->done = 1;
             current = current->parent;
@@ -2245,8 +2247,7 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
                 case token_string:
                     buffer = ap_ssi_parse_string(r, ctx, current->left->token.value,
                                                  NULL, MAX_STRING_LEN, 0);
-                    apr_cpystrn(current->left->token.value, buffer,
-                                sizeof(current->left->token.value));
+                    current->left->token.value = buffer;
                     current->left->value = 
                                        (current->left->token.value[0] != '\0');
                     current->left->done = 1;
@@ -2261,8 +2262,7 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
                 case token_string:
                     buffer = ap_ssi_parse_string(r, ctx, current->right->token.value,
                                                  NULL, MAX_STRING_LEN, 0);
-                    apr_cpystrn(current->right->token.value, buffer,
-                                sizeof(current->right->token.value));
+                    current->right->token.value = buffer;
                     current->right->value = 
                                       (current->right->token.value[0] != '\0');
                     current->right->done = 1;
@@ -2312,12 +2312,10 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
             }
             buffer = ap_ssi_parse_string(r, ctx, current->left->token.value,
                                          NULL, MAX_STRING_LEN, 0);
-            apr_cpystrn(current->left->token.value, buffer,
-                        sizeof(current->left->token.value));
+            current->left->token.value = buffer;
             buffer = ap_ssi_parse_string(r, ctx, current->right->token.value,
                                          NULL, MAX_STRING_LEN, 0);
-            apr_cpystrn(current->right->token.value, buffer,
-                        sizeof(current->right->token.value));
+            current->right->token.value = buffer;
             if (current->right->token.type == token_re) {
 #ifdef DEBUG_INCLUDE
                 debug_pos += sprintf (&debug[debug_pos],
@@ -2371,12 +2369,10 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
             }
             buffer = ap_ssi_parse_string(r, ctx, current->left->token.value,
                                          NULL, MAX_STRING_LEN, 0);
-            apr_cpystrn(current->left->token.value, buffer,
-                        sizeof(current->left->token.value));
+            current->left->token.value = buffer;
             buffer = ap_ssi_parse_string(r, ctx, current->right->token.value,
                                          NULL, MAX_STRING_LEN, 0);
-            apr_cpystrn(current->right->token.value, buffer,
-                        sizeof(current->right->token.value));
+            current->right->token.value = buffer;
 #ifdef DEBUG_INCLUDE
             debug_pos += sprintf (&debug[debug_pos],
                                   "     Compare (%s) with (%s)\n",