From: Yann Ylavic <ylavic@apache.org>
Date: Tue, 3 Feb 2015 10:42:21 +0000 (+0000)
Subject: mod_macro: Clear macros before initialization to avoid use-after-free
X-Git-Tag: 2.5.0-alpha~3485
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e454f1a48b5f4dbb34104deb1c6ca686ab18f280;p=apache

mod_macro: Clear macros before initialization to avoid use-after-free
on startup or restart when the module is linked statically. PR 57525

Submitted by: apache.org tech.futurequest.net
Committed by: Yann Ylavic


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1656669 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index d14b8664ef..1fdb46dd24 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.0
 
+  *) mod_macro: Clear macros before initialization to avoid use-after-free
+     on startup or restart when the module is linked statically. PR 57525
+     [apache.org tech.futurequest.net, Yann Ylavic]
+
   *) mod_proxy_http: Don't establish or reuse a backend connection before pre-
      fetching the request body, so to minimize the delay between it is supposed
      to be alive and the first bytes sent: this is a best effort to prevent the
diff --git a/modules/core/mod_macro.c b/modules/core/mod_macro.c
index 3fc72176e5..ea89a6098c 100644
--- a/modules/core/mod_macro.c
+++ b/modules/core/mod_macro.c
@@ -75,14 +75,9 @@ typedef struct
   Macros are kept globally...
   They are not per-server or per-directory entities.
 
-  I would need a hook BEFORE and AFTER configuration processing
-  to initialize and close them properly, but no such thing is exported,
-  although it could be available from within apache.
-
-  I would have such a hook if in server/config.c
-  The "initializer" does not seem to be called before.
-
   note: they are in a temp_pool, and there is a lazy initialization.
+        ap_macros is reset to NULL in pre_config hook to not depend
+        on static vs dynamic configuration.
 
   hash type: (char *) name -> (ap_macro_t *) macro
 */
@@ -914,6 +909,12 @@ static const char *undef_macro(cmd_parms * cmd, void *dummy, const char *arg)
     return NULL;
 }
 
+static int macro_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp)
+{
+    ap_macros = NULL;
+    return OK;
+}
+
 /************************************************************* EXPORT MODULE */
 
 /*
@@ -932,6 +933,11 @@ static const command_rec macro_cmds[] = {
     {NULL}
 };
 
+static void macro_hooks(apr_pool_t *p)
+{
+    ap_hook_pre_config(macro_pre_config, NULL, NULL, APR_HOOK_MIDDLE);
+}
+
 /*
   Module hooks are request-oriented thus it does not suit configuration
   file utils a lot. I haven't found any clean hook to apply something
@@ -949,5 +955,5 @@ AP_DECLARE_MODULE(macro) = {
         NULL,                   /* create per-server config structure */
         NULL,                   /* merge per-server config structures */
         macro_cmds,             /* configuration commands */
-        NULL                    /* register hooks */
+        macro_hooks             /* register hooks */
 };