From: Yann Ylavic <ylavic@apache.org>
Date: Wed, 2 May 2018 11:32:22 +0000 (+0000)
Subject: mod_proxy_html: Fix variable interpolation and memory allocation failure in ProxyHTML... 
X-Git-Tag: 2.5.0-alpha2-ci-test-only~2642
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e275cc3dc620310aa731b985645c36c787aed677;p=thirdparty%2Fapache%2Fhttpd.git

mod_proxy_html: Fix variable interpolation and memory allocation failure in ProxyHTMLURLMap.

Proposed by: Ewald Dieterich <ewald mailbox.org>
Reviewed by: ylavic



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1830746 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index f55f0feea63..c9fc19f8946 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  *) mod_proxy_html: Fix variable interpolation and memory allocation failure
+     in ProxyHTMLURLMap.  [Ewald Dieterich <ewald mailbox.org>]
+
   *) core: In ONE_PROCESS/debug mode, cleanup everything when exiting.
      [Yann Ylavic]
 
diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c
index 9f5e10857e6..6a1ac07b180 100644
--- a/modules/filters/mod_proxy_html.c
+++ b/modules/filters/mod_proxy_html.c
@@ -752,6 +752,12 @@ static const char *interpolate_vars(request_rec *r, const char *str)
             break;
 
         delim = ap_strchr_c(start, '|');
+
+        /* Restrict delim to ${...} */
+        if (delim && delim >= end) {
+            delim = NULL;
+        }
+
         before = apr_pstrndup(r->pool, str, start-str);
         after = end+1;
         if (delim) {