Solve 416291, but in a more elegant manner, and with a little

  more attention to clearing the subreq and determining that
  an r->filename existed.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@416293 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/arch/win32/mod_isapi.c b/modules/arch/win32/mod_isapi.c
index 5ccb61f50c921aa3cbc1d4c051e02dbb88308618..cea81ec17889879a2f9703654c92ea1c922de738 100644 (file)
--- a/modules/arch/win32/mod_isapi.c
+++ b/modules/arch/win32/mod_isapi.c
@@ -954,21 +954,33 @@ int APR_THREAD_FUNC ServerSupportFunction(isapi_cid    *cid,
         /* Map a URL to a filename */
         char *file = (char *)buf_data;
         apr_uint32_t len;
-        subreq = ap_sub_req_lookup_uri(apr_pstrndup(r->pool, file, *buf_size),
-                                       r, NULL);
+        subreq = ap_sub_req_lookup_uri(
+                     apr_pstrndup(cid->r->pool, file, *buf_size), r, NULL);
 
-        len = apr_cpystrn(file, subreq->filename, *buf_size) - file;
+        if (!subreq->filename) {
+            ap_destroy_sub_req(subreq);
+            return 0;
+        }
 
+        len = (apr_uint32_t)strlen(r->filename);
+
+        if ((subreq->finfo.filetype == APR_DIR)
+              && (!subreq->path_info)
+              && (file[len - 1] != '/'))
+            file = apr_pstrcat(cid->r->pool, subreq->filename, "/", NULL);
+        else
+            file = apr_pstrcat(cid->r->pool, subreq->filename, 
+                                              subreq->path_info, NULL);
+
+        ap_destroy_sub_req(subreq);
+
+#ifdef WIN32
+        /* We need to make this a real Windows path name */
+        apr_filepath_merge(&file, "", file, APR_FILEPATH_NATIVE, r->pool);
+#endif
+
+        *buf_size = apr_cpystrn(buf_data, file, *buf_size) - buf_data;
 
-        /* IIS puts a trailing slash on directories, Apache may not */
-        if (subreq->finfo.filetype == APR_DIR) {
-            if ((len < *buf_size - 1) && (file[len - 1] != '/') 
-                                      && (file[len - 1] != '\\')) {
-                file[len++] = '\\';
-                file[len] = '\0';
-            }
-        }
-        *buf_size = len;
         return 1;
     }