Merge r1822857, r1876815, r1893499, r1900024, r1900152, r1900306, r1900559, r1900564...

* Makefile.in (build/config_vars.out): Rebuild if build/config_vars.sh
  has changed.

sort safe_env_lst
bz 64371

mod_optional_hook_import: debug message at APLOG_DEBUG level.

  *) de-duplicate ALOGNO from code copy.

ab: apr_base64_encode already NUL-terminate the output.

And returns the length including the trailing \0, so setting it at that
length is off by +1.

* Avoid an overflow on large inputs

PR: 66033

dav_get_liveprop_info() returns a long not an int.

Update the type of global_ns accordingly and update the format specifier when this variable is used in printf like functions.

This also aligns code with dav_core_insert_prop() in modules/dav/main/std_liveprop.c

Length computed by count_string() are accumulated in an apr_size_t, so be more consistent and use this data type also in this function.

Fix some typo

[skip ci]

Fix some typos

[skip ci]
Submitted by: jorton, gbechis, ylavic, icing, ylavic, rpluem, jailletc36, jailletc36, jailletc36, jailletc36
Reviewed by: jailletc36, rpluem, jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1903618 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/Makefile.in b/Makefile.in
index e822b045f2cc5c4042656cd6c93b482f4e815a78..dd46a59e1a35a506bf8bb3233082074d49e3836e 100644 (file)
--- a/Makefile.in
+++ b/Makefile.in
@@ -128,7 +128,7 @@ install-conf:
        fi
 
 # Create a sanitized config_vars.mk
-build/config_vars.out: build/config_vars.mk
+build/config_vars.out: build/config_vars.mk build/config_vars.sh
        @$(SHELL) build/config_vars.sh < build/config_vars.mk > build/config_vars.out
 
 install-build: build/config_vars.out

diff --git a/STATUS b/STATUS
index 9e61de43c639b1446d4ee07df51d8738a54f33cd..a359feddf3645e8b2c423d4937637663fd4449d1 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -149,31 +149,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-  *) Easy patches: synch 2.4.x and trunk
-         - Makefile.in (build/config_vars.out): Rebuild if build/config_vars.sh has changed
-         - suexec: sort the 'safe_env_lst' array
-         - mod_optional_hook_import: debug message at APLOG_DEBUG level
-         - worker: de-duplicate ALOGNO from code copy
-         - ab: tweak usage of apr_base64_encode()
-         - core: Avoid an overflow on large inputs in ap_is_matchexp()
-         - mod_dav: be more consistent with datatypes
-         - mod_log_forensic: be more consistent with datatypes
-         - mod_ssl: fix some typo
-         - mod_ssl: fix some typo
-     trunk patch:
-          https://svn.apache.org/r1822857
-          https://svn.apache.org/r1876815
-          https://svn.apache.org/r1893499
-          https://svn.apache.org/r1900024
-          https://svn.apache.org/r1900152
-          https://svn.apache.org/r1900306
-          https://svn.apache.org/r1900559
-          https://svn.apache.org/r1900564
-          https://svn.apache.org/r1900691
-          https://svn.apache.org/r1900694
-     2.4.x patch: svn merge -c 1822857,1876815,1893499,1900024,1900152,1900306,1900559,1900564,1900691,1900694 ^/httpd/httpd/trunk .
-     +1: jailletc36, rpluem, jim
-
   *) mod_heartmonitor: Allow "HeartbeatMaxServers 0"
      to use file based storage instead of slotmem.
      Needed after setting HeartbeatMaxServers default

diff --git a/changes-entries/pr66033.txt b/changes-entries/pr66033.txt
new file mode 100644 (file)
index 0000000..caa98d1
--- /dev/null
+++ b/changes-entries/pr66033.txt
@@ -0,0 +1,2 @@
+  *) core: Avoid an overflow on large inputs in ap_is_matchexp.  PR 66033
+     [Ruediger Pluem]

diff --git a/include/http_ssl.h b/include/http_ssl.h
index e9fb0efd56a2e9644aeed76f26f3ff123b1ec42e..2e052c5ef32bfe6e8532a093d56dcc69bf59b5bf 100644 (file)
--- a/include/http_ssl.h
+++ b/include/http_ssl.h
@@ -104,7 +104,7 @@ AP_DECLARE_HOOK(const char *,ssl_var_lookup,
 /**
  * Lookup an SSL related variable for the server/connection/request or a global
  * value when all those parameters are set to NULL. Pool and name must always be
- * provided and the returned value (if not NULL) will be allocated fromt he pool.
+ * provided and the returned value (if not NULL) will be allocated from the pool.
  * @param p The pool to allocate a returned value in, MUST be provided
  * @param s The server to inquire a value for, maybe NULL
  * @param c The current connection, maybe NULL
@@ -118,7 +118,7 @@ AP_DECLARE(const char *) ap_ssl_var_lookup(apr_pool_t *p, server_rec *s,
 
 /**
  * Register to provide certificate/key files for servers. Certificate files are
- * exepcted to contain the certificate chain, beginning with the server's certificate,
+ * expected to contain the certificate chain, beginning with the server's certificate,
  * excluding the trust anchor, in PEM format.
  * They must be accompanied by a private key file, also in PEM format.
  *

diff --git a/modules/dav/fs/repos.c b/modules/dav/fs/repos.c
index 1f7379a4d3573cf1615363ed2cc692c6b684f70c..d38868c70a1a2d81a94b4d58237e5edd89d1f3db 100644 (file)
--- a/modules/dav/fs/repos.c
+++ b/modules/dav/fs/repos.c
@@ -1926,7 +1926,7 @@ static dav_prop_insert dav_fs_insert_prop(const dav_resource *resource,
     const char *s;
     apr_pool_t *p = resource->info->pool;
     const dav_liveprop_spec *info;
-    int global_ns;
+    long global_ns;
 
     /* an HTTP-date can be 29 chars plus a null term */
     /* a 64-bit size can be 20 chars plus a null term */
@@ -2007,11 +2007,11 @@ static dav_prop_insert dav_fs_insert_prop(const dav_resource *resource,
     /* DBG3("FS: inserting lp%d:%s  (local %d)", ns, scan->name, scan->ns); */
 
     if (what == DAV_PROP_INSERT_VALUE) {
-        s = apr_psprintf(p, "<lp%d:%s>%s</lp%d:%s>" DEBUG_CR,
+        s = apr_psprintf(p, "<lp%ld:%s>%s</lp%ld:%s>" DEBUG_CR,
                          global_ns, info->name, value, global_ns, info->name);
     }
     else if (what == DAV_PROP_INSERT_NAME) {
-        s = apr_psprintf(p, "<lp%d:%s/>" DEBUG_CR, global_ns, info->name);
+        s = apr_psprintf(p, "<lp%ld:%s/>" DEBUG_CR, global_ns, info->name);
     }
     else {
         /* assert: what == DAV_PROP_INSERT_SUPPORTED */

diff --git a/modules/loggers/mod_log_forensic.c b/modules/loggers/mod_log_forensic.c
index 07127b5f215db1dcbabe1da742585fa181a11475..4884f25ce5936aefdf40df76a7619442e11b06be 100644 (file)
--- a/modules/loggers/mod_log_forensic.c
+++ b/modules/loggers/mod_log_forensic.c
@@ -146,9 +146,9 @@ typedef struct hlog {
     apr_size_t count;
 } hlog;
 
-static int count_string(const char *p)
+static apr_size_t count_string(const char *p)
 {
-    int n;
+    apr_size_t n;
 
     for (n = 0 ; *p ; ++p, ++n)
         if (TEST_CHAR(*p, T_ESCAPE_FORENSIC))

diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
index 7e950259eaaaf38eb72d742c87576aa76a317543..01c5a17669741fa9cc6b3e60cae72b341ecdfa1c 100644 (file)
--- a/modules/ssl/ssl_engine_config.c
+++ b/modules/ssl/ssl_engine_config.c
@@ -798,7 +798,7 @@ const char *ssl_cmd_SSLCipherSuite(cmd_parms *cmd,
         return NULL;
     }
 #endif
-    return apr_pstrcat(cmd->pool, "procotol '", arg1, "' not supported", NULL);
+    return apr_pstrcat(cmd->pool, "protocol '", arg1, "' not supported", NULL);
 }
 
 #define SSL_FLAGS_CHECK_FILE \
@@ -1556,7 +1556,7 @@ const char *ssl_cmd_SSLProxyCipherSuite(cmd_parms *cmd,
         return NULL;
     }
 #endif
-    return apr_pstrcat(cmd->pool, "procotol '", arg1, "' not supported", NULL);
+    return apr_pstrcat(cmd->pool, "protocol '", arg1, "' not supported", NULL);
 }
 
 const char *ssl_cmd_SSLProxyVerify(cmd_parms *cmd,

diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
index 35c34d35cf3000b832cb44113c6d41cc4bd08ebf..825621de94bfdb4c991b9f4c1f8fc57137e74262 100644 (file)
--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
@@ -471,7 +471,7 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
 
 /*
  * Support for external a Crypto Device ("engine"), usually
- * a hardware accellerator card for crypto operations.
+ * a hardware accelerator card for crypto operations.
  */
 #if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
 apr_status_t ssl_init_Engine(server_rec *s, apr_pool_t *p)

diff --git a/modules/test/mod_optional_hook_import.c b/modules/test/mod_optional_hook_import.c
index 12da318e86c80e08d1a98447df6f44d753de8f03..f921d6498e5415bac5ba2399867bdd45566b8941 100644 (file)
--- a/modules/test/mod_optional_hook_import.c
+++ b/modules/test/mod_optional_hook_import.c
@@ -21,8 +21,8 @@
 
 static int ImportOptionalHookTestHook(const char *szStr)
 {
-    ap_log_error(APLOG_MARK,APLOG_ERR,OK,NULL, APLOGNO(01866)"Optional hook test said: %s",
-                 szStr);
+    ap_log_error(APLOG_MARK,APLOG_DEBUG,OK,NULL, APLOGNO(01866)
+                 "Optional hook test said: %s", szStr);
 
     return OK;
 }

diff --git a/server/mpm/worker/worker.c b/server/mpm/worker/worker.c
index 0907db3281cc4c071dfefe26786f4fa36b6a9c24..7b572bd14c9a8e3a146025d5eef3d1dd0ae57900 100644 (file)
--- a/server/mpm/worker/worker.c
+++ b/server/mpm/worker/worker.c
@@ -1697,7 +1697,7 @@ static void server_main_loop(int remaining_children_to_start)
             if (++successive_kills >= 3) {
                 if (successive_kills % 10 == 3) {
                     ap_log_error(APLOG_MARK, APLOG_WARNING, 0,
-                                 ap_server_conf, APLOGNO(10392)
+                                 ap_server_conf, APLOGNO(10393)
                                  "children are killed successively!");
                 }
                 continue;

diff --git a/server/util.c b/server/util.c
index 3f1a6c838e55fb3cf1448869aba26c6ebdac37d2..2015e430fba58b976e072a7e6ab57f6b566bb9d8 100644 (file)
--- a/server/util.c
+++ b/server/util.c
@@ -250,10 +250,8 @@ AP_DECLARE(int) ap_os_is_path_absolute(apr_pool_t *p, const char *dir)
 
 AP_DECLARE(int) ap_is_matchexp(const char *str)
 {
-    int x;
-
-    for (x = 0; str[x]; x++)
-        if ((str[x] == '*') || (str[x] == '?'))
+    for (; *str; str++)
+        if ((*str == '*') || (*str == '?'))
             return 1;
     return 0;
 }

diff --git a/support/ab.c b/support/ab.c
index ee3420d389c458f023fc5fb022a0a5fe0851b1a2..3a3ffbfb610a0a9b6106d85c0ebb76b69abc7bb7 100644 (file)
--- a/support/ab.c
+++ b/support/ab.c
@@ -2306,7 +2306,6 @@ static apr_status_t open_postfile(const char *pfile)
 /* sort out command-line args and call test */
 int main(int argc, const char * const argv[])
 {
-    int l;
     char tmp[1024];
     apr_status_t status;
     apr_getopt_t *opt;
@@ -2447,8 +2446,7 @@ int main(int argc, const char * const argv[])
                 if (apr_base64_encode_len(strlen(opt_arg)) > sizeof(tmp)) {
                     err("Authentication credentials too long\n");
                 }
-                l = apr_base64_encode(tmp, opt_arg, strlen(opt_arg));
-                tmp[l] = '\0';
+                apr_base64_encode(tmp, opt_arg, strlen(opt_arg));
 
                 auth = apr_pstrcat(cntxt, auth, "Authorization: Basic ", tmp,
                                        "\r\n", NULL);
@@ -2462,8 +2460,7 @@ int main(int argc, const char * const argv[])
                 if (apr_base64_encode_len(strlen(opt_arg)) > sizeof(tmp)) {
                     err("Proxy credentials too long\n");
                 }
-                l = apr_base64_encode(tmp, opt_arg, strlen(opt_arg));
-                tmp[l] = '\0';
+                apr_base64_encode(tmp, opt_arg, strlen(opt_arg));
 
                 auth = apr_pstrcat(cntxt, auth, "Proxy-Authorization: Basic ",
                                        tmp, "\r\n", NULL);

diff --git a/support/suexec.c b/support/suexec.c
index eb2d38a4282b7a151fdd5f2d3171f45587db4e0b..c2eb0b63995e865891e9f182369e65fbaf734436 100644 (file)
--- a/support/suexec.c
+++ b/support/suexec.c
@@ -127,15 +127,15 @@ static const char *const safe_env_lst[] =
     "REDIRECT_STATUS=",
     "REDIRECT_URL=",
     "REQUEST_METHOD=",
-    "REQUEST_URI=",
     "REQUEST_SCHEME=",
+    "REQUEST_URI=",
     "SCRIPT_FILENAME=",
     "SCRIPT_NAME=",
     "SCRIPT_URI=",
     "SCRIPT_URL=",
+    "SERVER_ADDR=",
     "SERVER_ADMIN=",
     "SERVER_NAME=",
-    "SERVER_ADDR=",
     "SERVER_PORT=",
     "SERVER_PROTOCOL=",
     "SERVER_SIGNATURE=",