Merge r785457 from trunk:

Fix bug in r785425 (dereference null pointer when not configured)
and add a couple of comments.

Submitted by: niq
Reviewed by: rpluem, niq, rjung

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@963220 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/STATUS b/STATUS
index 43025272e801a213ec693e229baeddc2babba764..8ba48e8477976d347cbd769a5dc7ce3f3d174d1b 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -114,13 +114,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
            option in the docs page, like e.g. we did for SSLInsecureRenegotiation.
     wrowe asks; you mean <Compatibility> tag?  Yes, of course.
 
-  * mod_dir: Fix NULL pointer dereference if FallBackResource is not configured
-      Trunk version of patch:
-         http://svn.apache.org/viewcvs.cgi?rev=785457&view=rev
-      Backport version for 2.2.x of patch:
-         Trunk version of patch works
-      +1: rpluem, niq, rjung
-
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]
 

diff --git a/modules/mappers/mod_dir.c b/modules/mappers/mod_dir.c
index 59ae536c97ec43b788665552c5958bbd7f780400..e3a9537bcb1be4ab3f6606f2f4a190dc8275d305 100644 (file)
--- a/modules/mappers/mod_dir.c
+++ b/modules/mappers/mod_dir.c
@@ -108,6 +108,17 @@ static int fixup_dflt(request_rec *r)
         return DECLINED;
     }
     name_ptr = d->dflt;
+    if (name_ptr == NULL) {
+        return DECLINED;
+    }
+    /* XXX: if DefaultHandler points to something that doesn't exist,
+     * this may recurse until it hits the limit for internal redirects
+     * before returning an Internal Server Error.
+     */
+
+    /* The logic of this function is basically cloned and simplified
+     * from fixup_dir below.  See the comments there.
+     */
     if (r->args != NULL) {
         name_ptr = apr_pstrcat(r->pool, name_ptr, "?", r->args, NULL);
     }
@@ -290,6 +301,7 @@ static int fixup_dir(request_rec *r)
 
 static void register_hooks(apr_pool_t *p)
 {
+    /* the order of these is of no consequence */
     ap_hook_fixups(fixup_dir,NULL,NULL,APR_HOOK_LAST);
     ap_hook_fixups(fixup_dflt,NULL,NULL,APR_HOOK_LAST);
 }