www-apache-bugdb mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Chris Stratford <chr...@uunet.pipex.com>
Subject mod_imap/748: imap_url() loops if map file has value above server_root
Date Wed, 18 Jun 1997 16:00:03 GMT

>Number:         748
>Category:       mod_imap
>Synopsis:       imap_url() loops if map file has value above server_root
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache (Apache HTTP Project)
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Wed Jun 18 09:00:01 1997
>Originator:     chriss@uunet.pipex.com
>Release:        1.2.0
SunOS 5.5.1 Generic_103640-03 sun4m sparc SUNW,SPARCstation-20
gcc 2.7.2
If you have a map file with an entry like:
rect ../../sales/index.shtml 237,5 369,22
being called from a URL like http://server.com/graphics/cell.map
the imap_url function gets stuck in a loop trying to remove the second "../"
The variable "directory" seems to run out of directory entries before
the variable "value" runs out of dots.

It seems to loop forever inside the 
while ( ! strncmp(value, "../", 3) || ! strcmp(value, "..") )
loop (line 457)
See full description.
A test like:
if ((!strncmp(value, "../", 3)) && (strlen(directory) == 0))
    url[0] = '\0';
    log_reason("invalid directory name in map file", r->uri, r);
should work (I think%2

View raw message