From: Yann Ylavic <ylavic@apache.org>
Date: Thu, 14 Mar 2024 14:38:36 +0000 (+0000)
Subject: mod_rewrite: disambiguate select_random_value_part().
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fb3dbd7da9e58517fc000d232fa34f62f2fe8ada;p=thirdparty%2Fapache%2Fhttpd.git

mod_rewrite: disambiguate select_random_value_part().

gcc-13's -fsanitize=undefined finds:

    mod_rewrite.c|1702 col 37| error: '%s' directive argument is null [-Werror=format-overflow=]
    ||  1701 |             value = select_random_value_part(r, value);
    ||  1702 |             rewritelog((r, 5, NULL, "randomly chosen the subvalue `%s'",value));
    ||       |                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

because it's not clear from select_random_value_part() whether it can return NULL or not.
Rewrite the function so that it's clearer/simpler.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1916298 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
index 0676804695c..b70c8782104 100644
--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
@@ -1205,7 +1205,7 @@ static char *rewrite_mapfunc_unescape(request_rec *r, char *key)
 static char *select_random_value_part(request_rec *r, char *value)
 {
     char *p = value;
-    unsigned n = 1;
+    unsigned n = 0;
 
     /* count number of distinct values */
     while ((p = ap_strchr(p, '|')) != NULL) {
@@ -1213,19 +1213,16 @@ static char *select_random_value_part(request_rec *r, char *value)
         ++p;
     }
 
-    if (n > 1) {
-        n = ap_random_pick(1, n);
+    if (n > 0) {
+        n = ap_random_pick(0, n);
 
-        /* extract it from the whole string */
-        while (--n && (value = ap_strchr(value, '|')) != NULL) {
-            ++value;
-        }
-
-        if (value) { /* should not be NULL, but ... */
-            p = ap_strchr(value, '|');
-            if (p) {
+        /* extract the n'th part from the whole string */
+        while ((p = ap_strchr(value, '|')) != NULL) {
+            if (!n--) {
                 *p = '\0';
+                break;
             }
+            value = p + 1;
         }
     }