From: Stefan Fritsch <sf@apache.org>
Date: Fri, 24 Feb 2012 20:42:24 +0000 (+0000)
Subject: Fix AddOutputFilterByType brown paper bag crash bug
X-Git-Tag: 2.5.0-alpha~7447
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=3c92125e3a26dc9ceb0b51a0f47876e9534546bf;p=apache

Fix AddOutputFilterByType brown paper bag crash bug

Initialize pointers, fix off-by-one.

PR: 52755


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1293405 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/filters/mod_filter.c b/modules/filters/mod_filter.c
index 32d8bd3388..7dd7db1abb 100644
--- a/modules/filters/mod_filter.c
+++ b/modules/filters/mod_filter.c
@@ -131,6 +131,7 @@ static int filter_init(ap_filter_t *f)
     f->ctx = fctx;
     return OK;
 }
+
 static int filter_lookup(ap_filter_t *f, ap_filter_rec_t *filter)
 {
     ap_filter_provider_t *provider;
@@ -461,9 +462,11 @@ static const char *add_filter(cmd_parms *cmd, void *CFG,
                                NULL);
         }
         provider->expr = node;
+        provider->types = NULL;
     }
     else {
         provider->types = types;
+        provider->expr = NULL;
     }
     provider->frec = provider_frec;
     provider->next = frec->providers;
@@ -594,7 +597,7 @@ static const char *filter_bytype(cmd_parms *cmd, void *CFG,
     name = apr_pstrdup(cmd->temp_pool, argv[0]);
     types = apr_palloc(cmd->pool, argc * sizeof(char *));
     memcpy(types, &argv[1], (argc - 1) * sizeof(char *));
-    types[argc] = NULL;
+    types[argc-1] = NULL;
     for (pname = apr_strtok(name, ";", &strtok_state);
          pname != NULL && rv == NULL;
          pname = apr_strtok(NULL, ";", &strtok_state)) {