From e275cc3dc620310aa731b985645c36c787aed677 Mon Sep 17 00:00:00 2001
From: Yann Ylavic <ylavic@apache.org>
Date: Wed, 2 May 2018 11:32:22 +0000
Subject: [PATCH] mod_proxy_html: Fix variable interpolation and memory
 allocation failure in ProxyHTMLURLMap.

Proposed by: Ewald Dieterich <ewald mailbox.org>
Reviewed by: ylavic



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1830746 13f79535-47bb-0310-9956-ffa450edef68
---
 CHANGES                          | 3 +++
 modules/filters/mod_proxy_html.c | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/CHANGES b/CHANGES
index f55f0feea6..c9fc19f894 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  *) mod_proxy_html: Fix variable interpolation and memory allocation failure
+     in ProxyHTMLURLMap.  [Ewald Dieterich <ewald mailbox.org>]
+
   *) core: In ONE_PROCESS/debug mode, cleanup everything when exiting.
      [Yann Ylavic]
 
diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c
index 9f5e10857e..6a1ac07b18 100644
--- a/modules/filters/mod_proxy_html.c
+++ b/modules/filters/mod_proxy_html.c
@@ -752,6 +752,12 @@ static const char *interpolate_vars(request_rec *r, const char *str)
             break;
 
         delim = ap_strchr_c(start, '|');
+
+        /* Restrict delim to ${...} */
+        if (delim && delim >= end) {
+            delim = NULL;
+        }
+
         before = apr_pstrndup(r->pool, str, start-str);
         after = end+1;
         if (delim) {
-- 
2.40.0