SECURITY: CVE-2017-7679 (cve.mitre.org)

mod_mime can read one byte past the end of a buffer when sending a
malicious Content-Type response header.

Merge r1797550 from trunk:
mod_mime: fix quoted pair scanning

Submitted By: ylavic

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1799235 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index b77503c31cd9bc74be29ff9c6e8d3b84a0f125b1..43795251174ea08a6d77be79bfe68377dde950c7 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -18,6 +18,10 @@ Changes with Apache 2.2.33
      authentication phase may lead to authentication requirements being
      bypassed.
      [Emmanuel Dreyfus <manu netbsd.org>, Jacob Champion, Eric Covener]
+
+  *) SECURITY: CVE-2017-7679 (cve.mitre.org)
+     mod_mime can read one byte past the end of a buffer when sending a
+     malicious Content-Type response header.  [Yann Ylavic]
   
   *) Fix HttpProtocolOptions to inherit from global to VirtualHost scope.
      [Joe Orton]

diff --git a/STATUS b/STATUS
index 095be39d23386046f9b6b3b88edd9941470c769f..5e029fec4f2c9d6c1dbbf1d36949c9b40069b098 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -104,11 +104,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-   *) mod_mime: Fix scanning of quoted-pairs.
-      trunk patch: http://svn.apache.org/r1797550
-      2.4.x patch: svn merge -c 1797550 ^/httpd/httpd/trunk .
-      +1: covener, ylavic, wrowe
-
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]

diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c
index eed6ebd9b93b7dc27ee98bcdd0cfda700d036e87..f3c643c0b8216161e4cff6ccc8373fc8b85ad5b9 100644 (file)
--- a/modules/http/mod_mime.c
+++ b/modules/http/mod_mime.c
@@ -528,9 +528,9 @@ static int is_quoted_pair(const char *s)
     int res = -1;
     int c;
 
-    if (((s + 1) != NULL) && (*s == '\\')) {
+    if (*s == '\\') {
         c = (int) *(s + 1);
-        if (apr_isascii(c)) {
+        if (c && apr_isascii(c)) {
             res = 1;
         }
     }