From: Stefan Eissing <icing@apache.org>
Date: Tue, 5 Jun 2018 12:33:20 +0000 (+0000)
Subject: Fixing h2 proxy link header mapping to substitute correctly again after r1831231... 
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5d7b3a9ac04dbb492a683336f71e4fb1618457b1;p=apache

Fixing h2 proxy link header mapping to substitute correctly again after r1831231 breakage.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1832934 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/http2/h2_proxy_util.c b/modules/http2/h2_proxy_util.c
index 3690a0d930..51feac4a06 100644
--- a/modules/http2/h2_proxy_util.c
+++ b/modules/http2/h2_proxy_util.c
@@ -909,17 +909,17 @@ static size_t subst_str(link_ctx *ctx, int start, int end, const char *ns)
 {
     int olen, nlen, plen;
     int delta;
-    char *s, *p;
+    char *p;
     
     olen = end - start;
     nlen = (int)strlen(ns);
     delta = nlen - olen;
     plen = ctx->slen + delta + 1;
-    s = apr_pcalloc(ctx->pool, plen);
-    p = apr_cpystrn(s, ctx->s, start);
-    p = apr_cpystrn(p, ns, nlen);
-    strcpy(p, ctx->s + end);
-    ctx->s = s;
+    p = apr_pcalloc(ctx->pool, plen);
+    memcpy(p, ctx->s, start);
+    memcpy(p + start, ns, nlen);
+    strcpy(p + start + nlen, ctx->s + end);
+    ctx->s = p;
     ctx->slen = (int)strlen(p);
     if (ctx->i >= end) {
         ctx->i += delta;
@@ -930,7 +930,7 @@ static size_t subst_str(link_ctx *ctx, int start, int end, const char *ns)
 static void map_link(link_ctx *ctx) 
 {
     if (ctx->link_start < ctx->link_end) {
-        char buffer[HUGE_STRING_LEN], *p;
+        char buffer[HUGE_STRING_LEN];
         int need_len, link_len, buffer_len, prepend_p_server; 
         const char *mapped;
         
@@ -951,7 +951,9 @@ static void map_link(link_ctx *ctx)
                           "link_reverse_map uri too long, skipped: %s", ctx->s);
             return;
         }
-        apr_cpystrn(buffer + buffer_len, ctx->s + ctx->link_start, link_len);
+        strncpy(buffer + buffer_len, ctx->s + ctx->link_start, link_len);
+        buffer_len += link_len;
+        buffer[buffer_len] = '\0';
         if (!prepend_p_server
             && strcmp(ctx->real_backend_uri, ctx->p_server_uri)
             && !strncmp(buffer, ctx->real_backend_uri, ctx->rbu_len)) {
@@ -959,8 +961,10 @@ static void map_link(link_ctx *ctx)
              * to work, we need to use the proxy uri */
             int path_start = ctx->link_start + ctx->rbu_len;
             link_len -= ctx->rbu_len;
-            p = apr_cpystrn(buffer, ctx->p_server_uri, sizeof buffer);
-            apr_cpystrn(p, ctx->s + path_start, link_len);
+            strcpy(buffer, ctx->p_server_uri);
+            strncpy(buffer + ctx->psu_len, ctx->s + path_start, link_len);
+            buffer_len = ctx->psu_len + link_len;
+            buffer[buffer_len] = '\0';            
         }
         mapped = ap_proxy_location_reverse_map(ctx->r, ctx->conf, buffer);
         ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, ctx->r,