From 981c2504ad588671659e9303741255791f47cd93 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 7 Jul 2023 11:58:42 +0000 Subject: [PATCH] Merge r1910815 from trunk: MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit mod_rewrite: Fix a possible NULL pointer dereference in hook_uri2file is_absolute_uri() dereferences r->filename in the function body, but there is no check if r->filename == NULL before. Submitted by: Luboš Uhliarik Reviewed by: jorton, covener, ylavic Github: closes #355 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1910852 13f79535-47bb-0310-9956-ffa450edef68 --- modules/mappers/mod_rewrite.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c index f93f23f04f9..4be51de1f4e 100644 --- a/modules/mappers/mod_rewrite.c +++ b/modules/mappers/mod_rewrite.c @@ -4758,8 +4758,8 @@ static int hook_uri2file(request_rec *r) } if (rulestatus) { - unsigned skip_absolute = is_absolute_uri(r->filename, NULL); apr_size_t flen = r->filename ? strlen(r->filename) : 0; + unsigned skip_absolute = flen ? is_absolute_uri(r->filename, NULL) : 0; int to_proxyreq = (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0); int will_escape = skip_absolute && (rulestatus != ACTION_NOESCAPE); -- 2.47.2