https://bz.apache.org/bugzilla/show_bug.cgi?id=60636
Bug ID: 60636
Summary: aaa modules do not always fully initialise value of
authn provider
Product: Apache httpd-2
Version: 2.4.25
Hardware: All
OS: All
Status: NEW
Severity: minor
Priority: P2
Component: mod_authnz_ldap
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
ap_register_auth_provider is typically used with its fifth argument pointing to
a static structure initialised in the module code. One of the types for this is
authn_provider* which currently has two functions.
I noticed some modules like mod_authnz_ldap.c do not initialise all the values.
I believe they are relying upon the c language feature where statics will be
initialized with 0 values for unspecified values.
1865 static const authn_provider authn_ldap_provider =
1866 {
1867 &authn_ldap_check_password,
1868 };
Would this be better to be more explicit in the code with addition of a second
value of NULL perhaps with a comment describing why it's not used? I see some
other modules have full initialization, e.g. mod_authn_core.c
188 static const authn_provider authn_alias_provider =
189 {
190 &authn_alias_check_password,
191 &authn_alias_get_realm_hash,
192 };
193
194 static const authn_provider authn_alias_provider_nodigest =
195 {
196 &authn_alias_check_password,
197 NULL,
198 };
This is only a bug if NULL is an invalid (hence dangerous) value for second
argument. In the documentation embedded in mod_auth.h I see that authz_provider
states second function pointer can be NULL but there's no discussion of this
for authn_provider. If that second argument is not allowed to be NULL this is a
bug, if it is allowed to be NULL then docs could be improved and code could be
made more safe/explicit in any module using these with full initialization to
aid understanding of this code for maintainers.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
