← Back to branch summary

~ubuntu-branches/ubuntu/feisty/apache2/feisty

« back to all changes in this revision

Viewing changes to debian/patches/008_make_include_safe

  • Committer: Bazaar Package Importer
  • Author(s): Andreas Barth
  • Date: 2006-12-09 21:05:45 UTC
  • mfrom: (0.6.1 upstream)
  • Revision ID: james.westby@ubuntu.com-20061209210545-h70s0xaqc2v8vqr2
Tags: 2.2.3-3.2
http://bugs.debian.org/396265
* Non-maintainer upload.
* 043_ajp_connection_reuse: Patch from upstream Bugzilla, fixing a critical
  issue with regard to connection reuse in mod_proxy_ajp.
  Closes: #396265

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/008_make_include_safe
1
 
diff -ruN -x configure -x '*~' -x build-tree.orig -x '*.rej' build-tree.orig/apache2/server/config.c build-tree/apache2/server/config.c
2
 
--- build-tree.orig/apache2/server/config.c     2003-09-17 11:30:47.000000000 +0100
3
 
+++ build-tree/apache2/server/config.c  2003-10-07 13:03:15.000000000 +0100
 
1
#! /bin/sh /usr/share/dpatch/dpatch-run
 
2
## 008_make_include_safe by Adam Conrad <adconrad@0c3.net>
 
3
##
 
4
## All lines beginning with `## DP:' are a description of the patch.
 
5
## DP: Avoid including dpkg droppings in globbed includes.
 
6
 
 
7
@DPATCH@
 
8
--- apache2-2.2.0/server/config.c       2005-11-17 13:39:15.000000000 +0000
 
9
+++ apache2-2.2.0/server/config.c       2006-01-27 17:06:19.000000000 +0000
4
10
@@ -34,6 +34,7 @@
5
11
 #include "apr_portable.h"
6
12
 #include "apr_file_io.h"
7
13
 #include "apr_fnmatch.h"
8
14
+#include "apr_lib.h"
9
 
 
 
15
 
10
16
 #define APR_WANT_STDIO
11
17
 #define APR_WANT_STRFUNC
12
 
@@ -1535,6 +1535,30 @@
13
 
     return;
 
18
@@ -1521,6 +1522,30 @@
 
19
     return strcmp(f1->fname,f2->fname);
14
20
 }
15
21
 
16
22
+static int fname_valid(const char *fname) {
37
43
+    return 1;
38
44
+}
39
45
+
40
 
 AP_DECLARE(void) ap_process_resource_config(server_rec *s, const char *fname,
41
 
                                             ap_directive_t **conftree,
42
 
                                             apr_pool_t *p,
43
 
@@ -1608,7 +1624,8 @@
 
46
 static const char *process_resource_config_nofnmatch(server_rec *s,
 
47
                                                      const char *fname,
 
48
                                                      ap_directive_t **conftree,
 
49
@@ -1564,7 +1589,8 @@
 
50
         while (apr_dir_read(&dirent, APR_FINFO_DIRENT, dirp) == APR_SUCCESS) {
 
51
             /* strip out '.' and '..' */
 
52
             if (strcmp(dirent.name, ".")
 
53
-                && strcmp(dirent.name, "..")) {
 
54
+                && strcmp(dirent.name, "..")
 
55
+                && fname_valid(dirent.name)) {
 
56
                 fnew = (fnames *) apr_array_push(candidates);
 
57
                 fnew->fname = ap_make_full_path(p, path, dirent.name);
 
58
             }
 
59
@@ -1692,7 +1718,8 @@
44
60
             if (strcmp(dirent.name, ".")
45
61
                 && strcmp(dirent.name, "..")
46
62
                 && (apr_fnmatch(pattern, dirent.name,
47
 
-                                FNM_PERIOD) == APR_SUCCESS)) {
48
 
+                                FNM_PERIOD) == APR_SUCCESS)
 
63
-                                APR_FNM_PERIOD) == APR_SUCCESS)) {
 
64
+                                APR_FNM_PERIOD) == APR_SUCCESS)
49
65
+                && fname_valid(dirent.name)) {
50
66
                 fnew = (fnames *) apr_array_push(candidates);
51
67
                 fnew->fname = ap_make_full_path(p, path, dirent.name);