From: Yann Ylavic <ylavic@apache.org>
Date: Wed, 3 Jan 2018 13:40:26 +0000 (+0000)
Subject: mod_proxy_html: don't depend on NUL terminated bucket data.
X-Git-Tag: 2.5.0-alpha2-ci-test-only~3011
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2e8b662a0a56f726caab1c47c2b85a692094d534;p=thirdparty%2Fapache%2Fhttpd.git

mod_proxy_html: don't depend on NUL terminated bucket data.

ap_regexec() wants NUL terminated strings, so use ap_regexec_len() instead.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1819970 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c
index 08c73c4b76f..d737e8be264 100644
--- a/modules/filters/mod_proxy_html.c
+++ b/modules/filters/mod_proxy_html.c
@@ -669,7 +669,7 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
     }
 }
 
-static meta *metafix(request_rec *r, const char *buf)
+static meta *metafix(request_rec *r, const char *buf, apr_size_t len)
 {
     meta *ret = NULL;
     size_t offs = 0;
@@ -680,7 +680,8 @@ static meta *metafix(request_rec *r, const char *buf)
     ap_regmatch_t pmatch[2];
     char delim;
 
-    while (!ap_regexec(seek_meta, buf+offs, 2, pmatch, 0)) {
+    while (offs < len &&
+           !ap_regexec_len(seek_meta, buf + offs, len - offs, 2, pmatch, 0)) {
         header = NULL;
         content = NULL;
         p = buf+offs+pmatch[1].rm_eo;
@@ -1004,7 +1005,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
                                   "Unsupported parser opts %x", xmlopts);
 #endif
                 if (ctxt->cfg->metafix)
-                    m = metafix(f->r, buf);
+                    m = metafix(f->r, buf, bytes);
                 if (m) {
                     consume_buffer(ctxt, buf, m->start, 0);
                     consume_buffer(ctxt, buf+m->end, bytes-m->end, 0);