On Friday 13 June 2008 12:16, Peter Korsgaard wrote:
> >>>>> "Denys" == Denys Vlasenko <[EMAIL PROTECTED]> writes:
>
> Hi,
>
> >> if (strcmp(p, request) == 0) {
> >> set_remoteuser_var:
> >> - remoteuser = xstrndup(request, u - request);
> >> + remoteuser = xstrndup(request, strchr(request,
> ':') - request);
>
> Denys> Here where request without ':' will bite us.
>
> Actually, thinking about it a bit more - This cannot happen as the
> strcmp() wouldn't match.
There is no code which ensures that ':' exists *in config file*.
It seems like there is no code to ensure that leading '/' is there too.
Find this comment:
//TODO: we do not test for leading "/"??
//also, do we leak cur if BASIC_AUTH is off?
> Notice that we could use 'p' here instead of
> 'request' and the result would be the same.
Thus p can very well be lacking ':'.
--
vda
_______________________________________________
busybox mailing list
[email protected]
http://busybox.net/cgi-bin/mailman/listinfo/busybox
