From: Joe Orton <jorton@apache.org>
Date: Fri, 7 Jul 2023 11:58:42 +0000 (+0000)
Subject: Merge r1910815 from trunk:
X-Git-Tag: 2.4.58-rc1-candidate~85
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=981c2504ad588671659e9303741255791f47cd93;p=thirdparty%2Fapache%2Fhttpd.git

Merge r1910815 from trunk:

mod_rewrite: Fix a possible NULL pointer dereference in hook_uri2file

is_absolute_uri() dereferences r->filename in the function body, but
there is no check if r->filename == NULL before.

Submitted by: Luboš Uhliarik <luhliari redhat.com>
Reviewed by: jorton, covener, ylavic
Github: closes #355


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1910852 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
index f93f23f04f9..4be51de1f4e 100644
--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
@@ -4758,8 +4758,8 @@ static int hook_uri2file(request_rec *r)
     }
 
     if (rulestatus) {
-        unsigned skip_absolute = is_absolute_uri(r->filename, NULL);
         apr_size_t flen =  r->filename ? strlen(r->filename) : 0;
+        unsigned skip_absolute = flen ? is_absolute_uri(r->filename, NULL) : 0;
         int to_proxyreq = (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0);
         int will_escape = skip_absolute && (rulestatus != ACTION_NOESCAPE);