Fix a seg fault. The problem is easy to explain. On a HEAD request, Good

handlers will send their data down the filter stack, but 1.3 handlers will
just return, giving us a Content-Length of 0.  Since we can't send a C-L
of 0 just because it is a HEAD request, we search the headers_out table
for a 0 C-L if it is a HEAD request.  The problem is that some filters
will not allow (includes_filter) a C-L to be computed, so we end up without
a C-L header in headers_out.  Thus, when we do a strcmp against the header
value and "0", we seg fault, because the header value is NULL.

To fix this, we grab the element from the header table, and make sure it
isn't NULL before doing the strcmp.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@87870 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
index e6b4a7af0dbcd1254b556d782b6a8f745386dc79..2317a56b46d6958f0434c4aa5c7d082f6bbf659a 100644 (file)
--- a/modules/http/http_protocol.c
+++ b/modules/http/http_protocol.c
@@ -2448,6 +2448,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, apr_b
     char *date = NULL;
     request_rec *r = f->r;
     char *buff, *buff_start;
+    const char *clheader;
     const char *protocol;
     apr_bucket *e;
     apr_bucket_brigade *b2;
@@ -2560,7 +2561,8 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, apr_b
      * and we will compute a real C-L for the head request. RBB
      */
     if (r->header_only && 
-        !strcmp(apr_table_get(r->headers_out, "Content-Length"), "0")) {
+        (clheader = apr_table_get(r->headers_out, "Content-Length")) &&
+        !strcmp(clheader, "0")) {
         apr_table_unset(r->headers_out, "Content-Length");
     }