From 0d850d0b4c7a9144d21eff1b5ed6ce1108a2bda8 Mon Sep 17 00:00:00 2001
From: Jeff Trawick <trawick@apache.org>
Date: Wed, 13 Mar 2002 20:32:28 +0000
Subject: [PATCH] Fix some mod_include bugs which broke the evaluation of some
 expressions.

There are a few instances of the same basic problem which are not yet
fixed and which I have marked with /* XXX.*FUBAR*/.

PR:      10108


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@93916 13f79535-47bb-0310-9956-ffa450edef68
---
 CHANGES                       |  3 +++
 modules/filters/mod_include.c | 24 ++++++++++--------------
 2 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/CHANGES b/CHANGES
index ec24f8a8dca..1d2e30bfa85 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
 Changes with Apache 2.0.34-dev
 
+  *) Fix some mod_include problems which broke evaluation of some
+     expressions.  PR 10108  [Jeff Trawick]
+
   *) Fix the calculation of request time in mod_status.  [Stas Bekman]
 
   *) Fix the calculation of thread_num in the worker score structure.
diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
index 48b73de8cbc..ab89e5b36ef 100644
--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
@@ -1901,12 +1901,15 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
             case token_string:
                 if (current->token.value[0] != '\0') {
                     strncat(current->token.value, " ",
+                         /* XXX sizeof() use is FUBAR */
                          sizeof(current->token.value)
                             - strlen(current->token.value) - 1);
                 }
                 strncat(current->token.value, new->token.value,
+                         /* XXX sizeof() use is FUBAR */
                          sizeof(current->token.value)
                             - strlen(current->token.value) - 1);
+                /* XXX sizeof() use is FUBAR */
                 current->token.value[sizeof(current->token.value) - 1] = '\0';
                 break;
             case token_eq:
@@ -2211,8 +2214,7 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
 #endif
             buffer = ap_ssi_parse_string(r, ctx, current->token.value, NULL, 
                                          MAX_STRING_LEN, 0);
-            apr_cpystrn(current->token.value, buffer, 
-                        sizeof(current->token.value));
+            current->token.value = buffer;
             current->value = (current->token.value[0] != '\0');
             current->done = 1;
             current = current->parent;
@@ -2245,8 +2247,7 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
                 case token_string:
                     buffer = ap_ssi_parse_string(r, ctx, current->left->token.value,
                                                  NULL, MAX_STRING_LEN, 0);
-                    apr_cpystrn(current->left->token.value, buffer,
-                                sizeof(current->left->token.value));
+                    current->left->token.value = buffer;
                     current->left->value = 
                                        (current->left->token.value[0] != '\0');
                     current->left->done = 1;
@@ -2261,8 +2262,7 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
                 case token_string:
                     buffer = ap_ssi_parse_string(r, ctx, current->right->token.value,
                                                  NULL, MAX_STRING_LEN, 0);
-                    apr_cpystrn(current->right->token.value, buffer,
-                                sizeof(current->right->token.value));
+                    current->right->token.value = buffer;
                     current->right->value = 
                                       (current->right->token.value[0] != '\0');
                     current->right->done = 1;
@@ -2312,12 +2312,10 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
             }
             buffer = ap_ssi_parse_string(r, ctx, current->left->token.value,
                                          NULL, MAX_STRING_LEN, 0);
-            apr_cpystrn(current->left->token.value, buffer,
-                        sizeof(current->left->token.value));
+            current->left->token.value = buffer;
             buffer = ap_ssi_parse_string(r, ctx, current->right->token.value,
                                          NULL, MAX_STRING_LEN, 0);
-            apr_cpystrn(current->right->token.value, buffer,
-                        sizeof(current->right->token.value));
+            current->right->token.value = buffer;
             if (current->right->token.type == token_re) {
 #ifdef DEBUG_INCLUDE
                 debug_pos += sprintf (&debug[debug_pos],
@@ -2371,12 +2369,10 @@ static int parse_expr(request_rec *r, include_ctx_t *ctx, const char *expr,
             }
             buffer = ap_ssi_parse_string(r, ctx, current->left->token.value,
                                          NULL, MAX_STRING_LEN, 0);
-            apr_cpystrn(current->left->token.value, buffer,
-                        sizeof(current->left->token.value));
+            current->left->token.value = buffer;
             buffer = ap_ssi_parse_string(r, ctx, current->right->token.value,
                                          NULL, MAX_STRING_LEN, 0);
-            apr_cpystrn(current->right->token.value, buffer,
-                        sizeof(current->right->token.value));
+            current->right->token.value = buffer;
 #ifdef DEBUG_INCLUDE
             debug_pos += sprintf (&debug[debug_pos],
                                   "     Compare (%s) with (%s)\n",
-- 
2.47.3