From: Nick Kew <niq@apache.org>
Date: Wed, 27 May 2009 00:58:41 +0000 (+0000)
Subject: mod_alias: Enforce sanity in args to Redirect
X-Git-Tag: 2.3.3~540
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=563e30e93775ef5325f2532665ae80fb3fc04dd1;p=apache

mod_alias: Enforce sanity in args to Redirect
PR 44729


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@778942 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index 657b0ad0e6..3c38f5367c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,9 @@ Changes with Apache 2.3.3
      mod_proxy_ajp: Avoid delivering content from a previous request which
      failed to send a request body. PR 46949 [Ruediger Pluem]
 
+  *) mod_alias: check sanity in Redirect arguments.
+     PR 44729 [Sönke Tesch <st kino-fahrplan.de>]
+
   *) mod_proxy_http: fix Host: header for literal IPv6 addresses.
      PR 47177 [Carlos Garcia Braschi <cgbraschi gmail.com>]
 
diff --git a/modules/mappers/mod_alias.c b/modules/mappers/mod_alias.c
index bde1703de7..79079863fe 100644
--- a/modules/mappers/mod_alias.c
+++ b/modules/mappers/mod_alias.c
@@ -180,16 +180,21 @@ static const char *add_redirect_internal(cmd_parms *cmd,
     const char *f = arg2;
     const char *url = arg3;
 
-    if (!strcasecmp(arg1, "gone"))
-        status = HTTP_GONE;
-    else if (!strcasecmp(arg1, "permanent"))
-        status = HTTP_MOVED_PERMANENTLY;
-    else if (!strcasecmp(arg1, "temp"))
-        status = HTTP_MOVED_TEMPORARILY;
-    else if (!strcasecmp(arg1, "seeother"))
-        status = HTTP_SEE_OTHER;
-    else if (apr_isdigit(*arg1))
-        status = atoi(arg1);
+    if (arg3 != NULL) {
+        if (!strcasecmp(arg1, "gone"))
+            status = HTTP_GONE;
+        else if (!strcasecmp(arg1, "permanent"))
+            status = HTTP_MOVED_PERMANENTLY;
+        else if (!strcasecmp(arg1, "temp"))
+            status = HTTP_MOVED_TEMPORARILY;
+        else if (!strcasecmp(arg1, "seeother"))
+            status = HTTP_SEE_OTHER;
+        else if (apr_isdigit(*arg1))
+            status = atoi(arg1);
+        else {
+            return "Redirect: invalid first argument (of three)";
+        }
+    }
     else {
         f = arg1;
         url = arg2;