From: Stefan Fritsch <sf@apache.org>
Date: Mon, 27 Feb 2012 13:53:27 +0000 (+0000)
Subject: Merge r1293405:
X-Git-Tag: 2.4.2~266
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=186ce9cc78d4c59dc2925117c46d7522fff2b68d;p=apache

Merge r1293405:

Fix AddOutputFilterByType brown paper bag crash bug
Initialize pointers, fix off-by-one.
PR: 52755


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1294157 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index acc1ab04be..9c1972dae7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,9 @@
 
 Changes with Apache 2.4.2
 
+  *) mod_filter: Fix segfault with AddOutputFilterByType. PR 52755.
+     [Stefan Fritsch]
+
   * mod_session: Sessions are encoded as application/x-www-form-urlencoded
     strings, however we do not handle the encoding of spaces properly.
     Fixed. [Graham Leggett]
diff --git a/STATUS b/STATUS
index 5f0abbef07..512428c2f4 100644
--- a/STATUS
+++ b/STATUS
@@ -88,13 +88,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-  * Fix AddOutputFilterByType brown paper bag crash bug
-    Initialize pointers, fix off-by-one.
-    PR: 52755
-    Trunk patches: http://svn.apache.org/viewvc?view=revision&revision=1293405
-    2.4.x patch: Trunk patch works
-    +1: minfrin, sf, trawick
-
   * Enable per-module loglevel for mod_xml2enc and mod_proxy_html
     Trunk patches: http://svn.apache.org/viewvc?view=revision&revision=1293708
     2.4.x patch: Trunk patch works
diff --git a/modules/filters/mod_filter.c b/modules/filters/mod_filter.c
index 32d8bd3388..7dd7db1abb 100644
--- a/modules/filters/mod_filter.c
+++ b/modules/filters/mod_filter.c
@@ -131,6 +131,7 @@ static int filter_init(ap_filter_t *f)
     f->ctx = fctx;
     return OK;
 }
+
 static int filter_lookup(ap_filter_t *f, ap_filter_rec_t *filter)
 {
     ap_filter_provider_t *provider;
@@ -461,9 +462,11 @@ static const char *add_filter(cmd_parms *cmd, void *CFG,
                                NULL);
         }
         provider->expr = node;
+        provider->types = NULL;
     }
     else {
         provider->types = types;
+        provider->expr = NULL;
     }
     provider->frec = provider_frec;
     provider->next = frec->providers;
@@ -594,7 +597,7 @@ static const char *filter_bytype(cmd_parms *cmd, void *CFG,
     name = apr_pstrdup(cmd->temp_pool, argv[0]);
     types = apr_palloc(cmd->pool, argc * sizeof(char *));
     memcpy(types, &argv[1], (argc - 1) * sizeof(char *));
-    types[argc] = NULL;
+    types[argc-1] = NULL;
     for (pname = apr_strtok(name, ";", &strtok_state);
          pname != NULL && rv == NULL;
          pname = apr_strtok(NULL, ";", &strtok_state)) {