>Number: 748
>Category: mod_imap
>Synopsis: imap_url() loops if map file has value above server_root
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: apache (Apache HTTP Project)
>State: open
>Class: sw-bug
>Submitter-Id: apache
>Arrival-Date: Wed Jun 18 09:00:01 1997
>Originator: [EMAIL PROTECTED]
>Organization:
apache
>Release: 1.2.0
>Environment:
SunOS 5.5.1 Generic_103640-03 sun4m sparc SUNW,SPARCstation-20
gcc 2.7.2
>Description:
If you have a map file with an entry like:
rect ../../sales/index.shtml 237,5 369,22
being called from a URL like http://server.com/graphics/cell.map
the imap_url function gets stuck in a loop trying to remove the second "../"
The variable "directory" seems to run out of directory entries before
the variable "value" runs out of dots.
It seems to loop forever inside the
while ( ! strncmp(value, "../", 3) || ! strcmp(value, "..") )
loop (line 457)
>How-To-Repeat:
See full description.
>Fix:
A test like:
if ((!strncmp(value, "../", 3)) && (strlen(directory) == 0))
{
url[0] = '\0';
log_reason("invalid directory name in map file", r->uri, r);
return;
}
should work (I think%2
>Audit-Trail:
>Unformatted:
