mod_proxy_html: Fix variable interpolation and memory allocation failure in ProxyHTML...

Proposed by: Ewald Dieterich <ewald mailbox.org>
Reviewed by: ylavic

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1830746 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index f55f0feea63d800f1ca3e33b25101dbc03084277..c9fc19f8946bc5c052ead54407a229c98a5670cd 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  *) mod_proxy_html: Fix variable interpolation and memory allocation failure
+     in ProxyHTMLURLMap.  [Ewald Dieterich <ewald mailbox.org>]
+
   *) core: In ONE_PROCESS/debug mode, cleanup everything when exiting.
      [Yann Ylavic]
 

diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c
index 9f5e10857e6e3a535e13b4fd3d6f3159abbbc035..6a1ac07b180c030718d597a7d858768569818fa7 100644 (file)
--- a/modules/filters/mod_proxy_html.c
+++ b/modules/filters/mod_proxy_html.c
@@ -752,6 +752,12 @@ static const char *interpolate_vars(request_rec *r, const char *str)
             break;
 
         delim = ap_strchr_c(start, '|');
+
+        /* Restrict delim to ${...} */
+        if (delim && delim >= end) {
+            delim = NULL;
+        }
+
         before = apr_pstrndup(r->pool, str, start-str);
         after = end+1;
         if (delim) {