From: Greg Ames <gregames@apache.org>
Date: Sat, 26 Jan 2002 20:16:01 +0000 (+0000)
Subject: ap_sub_req_lookup_dirent: fix mod_negotiation loop with near infinite
X-Git-Tag: 2.0.31~84
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a84d8fa14993c50a1556f988c5ba421bb5de72d6;p=apache

ap_sub_req_lookup_dirent: fix mod_negotiation loop with near infinite
subrequests

this function has been creating bogus subrequest URIs when there is
path_info for a long time.  They didn't matter until fixup_dir started
using them for URI subrequests, which led to a loop with ever growing
bogus internal URIs and filenames.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@93035 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/server/request.c b/server/request.c
index 99db38454a..124b92bb53 100644
--- a/server/request.c
+++ b/server/request.c
@@ -84,6 +84,7 @@
 #include "http_main.h"
 #include "util_filter.h"
 #include "util_charset.h"
+#include "util_script.h"
 
 #include "mod_core.h"
 
@@ -1589,7 +1590,17 @@ AP_DECLARE(request_rec *) ap_sub_req_lookup_dirent(const apr_finfo_t *dirent,
     /* Special case: we are looking at a relative lookup in the same directory. 
      * This is 100% safe, since dirent->name just came from the filesystem.
      */
-    udir = ap_make_dirstr_parent(rnew->pool, r->uri);
+    if (r->path_info && *r->path_info) {
+        /* strip path_info off the end of the uri to keep it in sync
+         * with r->filename, which has already been stripped by directory_walk
+         */
+        udir = apr_pstrdup(rnew->pool, r->uri);
+        udir[ap_find_path_info(udir, r->path_info)] = '\0';
+        udir = ap_make_dirstr_parent(rnew->pool, udir);
+    }
+    else {
+        udir = ap_make_dirstr_parent(rnew->pool, r->uri);
+    }
     rnew->uri = ap_make_full_path(rnew->pool, udir, dirent->name);
     fdir = ap_make_dirstr_parent(rnew->pool, r->filename);
     rnew->filename = ap_make_full_path(rnew->pool, fdir, dirent->name);