Do not execute directories when running CGI
Index: bozohttpd-20060517/cgi-bozo.c
===================================================================
--- bozohttpd-20060517.orig/cgi-bozo.c	2008-03-23 22:33:06.000000000 +0100
+++ bozohttpd-20060517/cgi-bozo.c	2008-03-23 23:12:58.000000000 +0100
@@ -86,6 +86,7 @@
 void
 process_cgi(http_req *request)
 {
+	struct 	stat stat_buf;
 	char	buf[WRSZ];
 	struct	headers *headp;
 	const char *type, *clen, *info, *cgihandler;
@@ -142,14 +143,28 @@
 			/* argv[] = [ path, command, query, NULL ] */
 	} else {
 		command = url + CGIBIN_PREFIX_LEN + 1;
-		if ((s = strchr(command, '/')) != NULL) {
-			info = bozostrdup(s);
+		s = command;
+		while ((s = strchr(s, '/')) != NULL) {
 			*s = '\0';
+			path = bozomalloc(strlen(cgibin) + 1 + strlen(command) + 1);
+			strcpy(path, cgibin);
+			strcat(path, "/");
+			strcat(path, command);
+			if(stat(path, &stat_buf)==0 && S_ISREG(stat_buf.st_mode)) {
+			    *s='/';
+			    info = bozostrdup(s);
+			    *s=0;
+			    break;
+			}
+			free(path);
+			*s++='/';
+		}
+		if(s==NULL) {
+			path = bozomalloc(strlen(cgibin) + 1 + strlen(command) + 1);
+			strcpy(path, cgibin);
+			strcat(path, "/");
+			strcat(path, command);
 		}
-		path = bozomalloc(strlen(cgibin) + 1 + strlen(command) + 1);
-		strcpy(path, cgibin);
-		strcat(path, "/");
-		strcat(path, command);
 			/* argv[] = [ command, query, NULL ] */
 	}
 	argv[ix++] = command;