gbucchino/cve-2024-38477
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove comments

Browse Source
This commit is contained in:
gbucchino 2025-07-31 09:38:18 +02:00
parent 86ef235216
commit 83aeed971b
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
httpd-2.4.59/modules/proxy/mod_proxy.c
View File

@ -1221,7 +1221,7 @@ static int proxy_fixup(request_rec *r)
return DECLINED; return DECLINED;
/* XXX: Shouldn't we try this before we run the proxy_walk? */ /* XXX: Shouldn't we try this before we run the proxy_walk? */
url = &r->filename[6]; /* CVE: how filename is construct ? If filename is NULL crash here ???? Or len is less than 6 ?*/ url = &r->filename[6];
if ((dconf->interpolate_env == 1) && (r->proxyreq == PROXYREQ_REVERSE)) { if ((dconf->interpolate_env == 1) && (r->proxyreq == PROXYREQ_REVERSE)) {
/* create per-request copy of reverse proxy conf, /* create per-request copy of reverse proxy conf,
@ -1313,14 +1313,13 @@ static int proxy_handler(request_rec *r)
return DECLINED; return DECLINED;
} }
if (!r->proxyreq) { // Equal 0 if (!r->proxyreq) {
/* We may have forced the proxy handler via config or .htaccess */ /* We may have forced the proxy handler via config or .htaccess */
if (r->handler && if (r->handler &&
strncmp(r->handler, "proxy:", 6) == 0 && strncmp(r->handler, "proxy:", 6) == 0 &&
strncmp(r->filename, "proxy:", 6) != 0) { strncmp(r->filename, "proxy:", 6) != 0) {
r->proxyreq = PROXYREQ_REVERSE; r->proxyreq = PROXYREQ_REVERSE;
r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); /* CVE: can return NULL ???? */ r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL);
/* If r->pool has been destroyed, the result can be NULL ??? */
} }
else { else {
return DECLINED; return DECLINED;
@ -1408,7 +1407,7 @@ static int proxy_handler(request_rec *r)
} }
} }
uri = r->filename + 6; // If NULL ?? uri = r->filename + 6;
p = strchr(uri, ':'); p = strchr(uri, ':');
if (p == NULL) { if (p == NULL) {
ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01141) ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01141)