From: Jim Jagielski <jim@apache.org>
Date: Fri, 3 Aug 2007 12:45:33 +0000 (+0000)
Subject: Merge r559837, r559999 from trunk:
X-Git-Tag: 2.2.5~54
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2d23b85174459ed4422b3c66f7273db5e5ab0a0e;p=thirdparty%2Fapache%2Fhttpd.git

Merge r559837, r559999 from trunk:

Fix integer comparisons in mod_filter
PR: 41835


Rationalisation suggested by rpluem

Submitted by: niq
Reviewed by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@562442 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/filters/mod_filter.c b/modules/filters/mod_filter.c
index 9b59fc8c340..778895b4689 100644
--- a/modules/filters/mod_filter.c
+++ b/modules/filters/mod_filter.c
@@ -200,11 +200,10 @@ static int filter_lookup(ap_filter_t *f, ap_filter_rec_t *filter)
                 match = 0;
             }
         }
-        else if (!provider->match.string) {
-            match = 0;
-        }
+        /* we can't check for NULL in provider as that kills integer 0
+         * so we have to test each string/regexp case in the switch
+         */
         else {
-            /* Now we have no nulls, so we can do string and regexp matching */
             switch (provider->match_type) {
             case STRING_MATCH:
                 if (strcasecmp(str, provider->match.string)) {
@@ -221,7 +220,7 @@ static int filter_lookup(ap_filter_t *f, ap_filter_rec_t *filter)
             case REGEX_MATCH:
                 if (ap_regexec(provider->match.regex, str, 0, NULL, 0)
                     == AP_REG_NOMATCH) {
-                match = 0;
+                    match = 0;
                 }
                 break;
             case INT_EQ:
@@ -229,23 +228,26 @@ static int filter_lookup(ap_filter_t *f, ap_filter_rec_t *filter)
                     match = 0;
                 }
                 break;
+            /* Integer comparisons should be [var] OP [match]
+             * We need to set match = 0 if the condition fails
+             */
             case INT_LT:
-                if (atoi(str) < provider->match.number) {
+                if (atoi(str) >= provider->match.number) {
                     match = 0;
                 }
                 break;
             case INT_LE:
-                if (atoi(str) <= provider->match.number) {
+                if (atoi(str) > provider->match.number) {
                     match = 0;
                 }
                 break;
             case INT_GT:
-                if (atoi(str) > provider->match.number) {
+                if (atoi(str) <= provider->match.number) {
                     match = 0;
                 }
                 break;
             case INT_GE:
-                if (atoi(str) >= provider->match.number) {
+                if (atoi(str) < provider->match.number) {
                     match = 0;
                 }
                 break;
@@ -589,6 +591,9 @@ static const char *filter_provider(cmd_parms *cmd, void *CFG, const char *args)
                                                          match,
                                                          rxend-match),
                                             flags);
+        if (provider->match.regex == NULL) {
+            return "Bad regexp";
+        }
         break;
     case '*':
         provider->match_type = DEFINED;