From: Joe Orton <jorton@apache.org>
Date: Thu, 6 Jul 2023 12:20:37 +0000 (+0000)
Subject: mod_rewrite: Fix a possible NULL pointer dereference in hook_uri2file
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0de661765b63037c34f4aaea4bc6adc7b2524923;p=thirdparty%2Fapache%2Fhttpd.git

mod_rewrite: Fix a possible NULL pointer dereference in hook_uri2file

is_absolute_uri() dereferences r->filename in the function body, but
there is no check if r->filename == NULL before.

Submitted by: Luboš Uhliarik <luhliari redhat.com>
Github: closes #355


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1910815 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
index 1e97d8b75d4..0676804695c 100644
--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
@@ -4831,8 +4831,8 @@ static int hook_uri2file(request_rec *r)
     }
 
     if (rulestatus) {
-        unsigned skip_absolute = is_absolute_uri(r->filename, NULL);
         apr_size_t flen =  r->filename ? strlen(r->filename) : 0;
+        unsigned skip_absolute = flen ? is_absolute_uri(r->filename, NULL) : 0;
         int to_proxyreq = (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0);
         int will_escape = skip_absolute && (rulestatus != ACTION_NOESCAPE);