From: Ruediger Pluem <rpluem@apache.org>
Date: Mon, 12 Jul 2010 09:26:29 +0000 (+0000)
Subject: Merge r785457 from trunk:
X-Git-Tag: 2.2.16~29
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7ab78edc41e004e579bdadde8d0f5931c9f189d2;p=thirdparty%2Fapache%2Fhttpd.git

Merge r785457 from trunk:

Fix bug in r785425 (dereference null pointer when not configured)
and add a couple of comments.

Submitted by: niq
Reviewed by: rpluem, niq, rjung


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@963220 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/STATUS b/STATUS
index 43025272e80..8ba48e84779 100644
--- a/STATUS
+++ b/STATUS
@@ -114,13 +114,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
            option in the docs page, like e.g. we did for SSLInsecureRenegotiation.
     wrowe asks; you mean <Compatibility> tag?  Yes, of course.
 
-  * mod_dir: Fix NULL pointer dereference if FallBackResource is not configured
-      Trunk version of patch:
-         http://svn.apache.org/viewcvs.cgi?rev=785457&view=rev
-      Backport version for 2.2.x of patch:
-         Trunk version of patch works
-      +1: rpluem, niq, rjung
-
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]
 
diff --git a/modules/mappers/mod_dir.c b/modules/mappers/mod_dir.c
index 59ae536c97e..e3a9537bcb1 100644
--- a/modules/mappers/mod_dir.c
+++ b/modules/mappers/mod_dir.c
@@ -108,6 +108,17 @@ static int fixup_dflt(request_rec *r)
         return DECLINED;
     }
     name_ptr = d->dflt;
+    if (name_ptr == NULL) {
+        return DECLINED;
+    }
+    /* XXX: if DefaultHandler points to something that doesn't exist,
+     * this may recurse until it hits the limit for internal redirects
+     * before returning an Internal Server Error.
+     */
+
+    /* The logic of this function is basically cloned and simplified
+     * from fixup_dir below.  See the comments there.
+     */
     if (r->args != NULL) {
         name_ptr = apr_pstrcat(r->pool, name_ptr, "?", r->args, NULL);
     }
@@ -290,6 +301,7 @@ static int fixup_dir(request_rec *r)
 
 static void register_hooks(apr_pool_t *p)
 {
+    /* the order of these is of no consequence */
     ap_hook_fixups(fixup_dir,NULL,NULL,APR_HOOK_LAST);
     ap_hook_fixups(fixup_dflt,NULL,NULL,APR_HOOK_LAST);
 }