From: Stefan Eissing <icing@apache.org>
Date: Tue, 2 Jul 2019 11:11:08 +0000 (+0000)
Subject:   *) mod_proxy_http2: fixing a potential NULL pointer use in logging.
X-Git-Tag: 2.4.40~73
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=40cbe0decea108b87003b53f14ac0ea8610a808e;p=thirdparty%2Fapache%2Fhttpd.git

  *) mod_proxy_http2: fixing a potential NULL pointer use in logging.
     [Christophe Jaillet <christophe.jaillet wanadoo.fr>, Dr Silvio Cesare InfoSect]



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1862418 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index 9cb41a6cdef..be97a1b63a3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.4.40
 
+  *) mod_proxy_http2: fixing a potential NULL pointer use in logging.
+     [Christophe Jaillet <christophe.jaillet wanadoo.fr>, Dr Silvio Cesare InfoSect]
+
   *) mod_dav: Reduce the amount of memory needed when doing PROPFIND's on large
      collections by improving the memory management. [Joe Orton, Ruediger Pluem]
 
diff --git a/modules/http2/h2_proxy_session.c b/modules/http2/h2_proxy_session.c
index 4b852bf366f..3246ce1af48 100644
--- a/modules/http2/h2_proxy_session.c
+++ b/modules/http2/h2_proxy_session.c
@@ -494,8 +494,8 @@ static ssize_t stream_request_data(nghttp2_session *ngh2, int32_t stream_id,
     stream = nghttp2_session_get_stream_user_data(ngh2, stream_id);
     if (!stream) {
         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, APLOGNO(03361)
-                     "h2_proxy_stream(%s): data_read, stream %d not found", 
-                     stream->session->id, stream_id);
+                     "h2_proxy_stream(NULL): data_read, stream %d not found", 
+                     stream_id);
         return NGHTTP2_ERR_CALLBACK_FAILURE;
     }
     
@@ -1443,7 +1443,7 @@ run_loop:
                 ap_log_cerror(APLOG_MARK, APLOG_TRACE3, status, session->c, 
                               APLOGNO(03365)
                               "h2_proxy_session(%s): WAIT read, timeout=%fms", 
-                              session->id, (float)session->wait_timeout/1000.0);
+                              session->id, session->wait_timeout/1000.0);
                 if (status == APR_SUCCESS) {
                     have_read = 1;
                     dispatch_event(session, H2_PROXYS_EV_DATA_READ, 0, NULL);
diff --git a/modules/http2/h2_proxy_util.c b/modules/http2/h2_proxy_util.c
index c291193d2ef..1e6cb277b0c 100644
--- a/modules/http2/h2_proxy_util.c
+++ b/modules/http2/h2_proxy_util.c
@@ -937,12 +937,12 @@ static size_t subst_str(link_ctx *ctx, int start, int end, const char *ns)
     nlen = (int)strlen(ns);
     delta = nlen - olen;
     plen = ctx->slen + delta + 1;
-    p = apr_pcalloc(ctx->pool, plen);
+    p = apr_palloc(ctx->pool, plen);
     memcpy(p, ctx->s, start);
     memcpy(p + start, ns, nlen);
     strcpy(p + start + nlen, ctx->s + end);
     ctx->s = p;
-    ctx->slen = (int)strlen(p);
+    ctx->slen = plen - 1;   /* (int)strlen(p) */
     if (ctx->i >= end) {
         ctx->i += delta;
     }