Merge r1910815 from trunk:

mod_rewrite: Fix a possible NULL pointer dereference in hook_uri2file

is_absolute_uri() dereferences r->filename in the function body, but
there is no check if r->filename == NULL before.

Submitted by: Luboš Uhliarik <luhliari redhat.com>
Reviewed by: jorton, covener, ylavic
Github: closes #355

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1910852 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
index f93f23f04f9e3cf5ba1e83770be7b0ba6d69d25c..4be51de1f4e8a4fd70ecb38a52bc2a1985f44f95 100644 (file)
--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
@@ -4758,8 +4758,8 @@ static int hook_uri2file(request_rec *r)
     }
 
     if (rulestatus) {
-        unsigned skip_absolute = is_absolute_uri(r->filename, NULL);
         apr_size_t flen =  r->filename ? strlen(r->filename) : 0;
+        unsigned skip_absolute = flen ? is_absolute_uri(r->filename, NULL) : 0;
         int to_proxyreq = (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0);
         int will_escape = skip_absolute && (rulestatus != ACTION_NOESCAPE);