On Thu, 20 Sep 2001, dean gaudet wrote:
> hrm, is the segfault described below a known bug? (i haven't tried it...)
>
> -dean
>
> ---------- Forwarded message ----------
> From: Jeff Moe <[EMAIL PROTECTED]>
> To: [EMAIL PROTECTED]
> Subject: Re: Serous TUX 2.4.9-J5 problem
>
> Apache 1.3.20 (and presumably earlier) has a similar bug. I noticed this
> during the recent worming. It may be related to Tux's problem. Here's how to
> reproduce it in Apache:
>
> 1) You need to redirect 404s to a 404 document:
> ErrorDocument 404 /fourofour.shtml
> 2) You need be parsing that file:
> AddHandler server-parsed .shtml
> 3) You need to send it a request like:
> http://server.com/test%2fing
>
> Apache will Segfault and you'll get a "Document returned no data error" in
> the browser.
>
> -Jeff
yeah this segfault occurs with 1.3.20 and top of 1.3, but it appears you
need something like:
<!--#include virtual="file" -->
in the fourofour.shtml.
patch below fixes it. however i'm not so sure it's exactly the right
fix... but there appear to be other examples where we test if filename !=
NULL. (boy am i rusty in apache code.)
this bug has probably been here forever... i can't imagine any way to
exploit it.
-dean
Index: include/httpd.h
===================================================================
RCS file: /home/cvs/apache-1.3/src/include/httpd.h,v
retrieving revision 1.344
diff -u -r1.344 httpd.h
--- include/httpd.h 2001/08/13 17:09:42 1.344
+++ include/httpd.h 2001/09/21 02:09:27
@@ -806,7 +806,7 @@
char *unparsed_uri; /* the uri without any parsing performed */
char *uri; /* the path portion of the URI */
- char *filename;
+ char *filename; /* filename if found, otherwise NULL */
char *path_info;
char *args; /* QUERY_ARGS, if any */
struct stat finfo; /* ST_MODE set to zero if no such file */
Index: modules/standard/mod_include.c
===================================================================
RCS file: /home/cvs/apache-1.3/src/modules/standard/mod_include.c,v
retrieving revision 1.129
diff -u -r1.129 mod_include.c
--- modules/standard/mod_include.c 2001/07/13 19:45:52 1.129
+++ modules/standard/mod_include.c 2001/09/21 02:09:27
@@ -718,7 +718,7 @@
for (p = r; p != NULL && !founddupe; p = p->main) {
request_rec *q;
for (q = p; q != NULL; q = q->prev) {
- if ( (strcmp(q->filename, rr->filename) == 0) ||
+ if ( (q->filename && strcmp(q->filename, rr->filename) == 0) ||
(strcmp(q->uri, rr->uri) == 0) ){
founddupe = 1;
break;
