← Back to branch summary

~ubuntu-branches/ubuntu/feisty/apache2/feisty

« back to all changes in this revision

Viewing changes to debian/patches/050_mod_imap_CVE-2005-3352

  • Committer: Bazaar Package Importer
  • Author(s): Andreas Barth
  • Date: 2006-12-09 21:05:45 UTC
  • mfrom: (0.6.1 upstream)
  • Revision ID: james.westby@ubuntu.com-20061209210545-h70s0xaqc2v8vqr2
Tags: 2.2.3-3.2
http://bugs.debian.org/396265
* Non-maintainer upload.
* 043_ajp_connection_reuse: Patch from upstream Bugzilla, fixing a critical
  issue with regard to connection reuse in mod_proxy_ajp.
  Closes: #396265

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/050_mod_imap_CVE-2005-3352
1
 
Index: server/util.c
2
 
===================================================================
3
 
--- build-tree/apache2/server/util.c    (revision 330526)
4
 
+++ build-tree/apache2/server/util.c    (working copy)
5
 
@@ -1762,6 +1762,8 @@
6
 
             j += 3;
7
 
         else if (s[i] == '&')
8
 
             j += 4;
9
 
+        else if (s[i] == '"')
10
 
+            j += 5;
11
 
 
12
 
     if (j == 0)
13
 
         return apr_pstrmemdup(p, s, i);
14
 
@@ -1780,6 +1782,10 @@
15
 
             memcpy(&x[j], "&", 5);
16
 
             j += 4;
17
 
         }
18
 
+        else if (s[i] == '"') {
19
 
+            memcpy(&x[j], """, 6);
20
 
+            j += 5;
21
 
+        }
22
 
         else
23
 
             x[j] = s[i];
24
 
 
25
 
Index: modules/mappers/mod_imap.c
26
 
===================================================================
27
 
--- build-tree/apache2/modules/mappers/mod_imap.c       (revision 330526)
28
 
+++ build-tree/apache2/modules/mappers/mod_imap.c       (working copy)
29
 
@@ -342,7 +342,7 @@
30
 
     if (!strcasecmp(value, "referer")) {
31
 
         referer = apr_table_get(r->headers_in, "Referer");
32
 
         if (referer && *referer) {
33
 
-           return apr_pstrdup(r->pool, referer);
34
 
+           return ap_escape_html(r->pool, referer);
35
 
         }
36
 
         else {
37
 
            /* XXX:  This used to do *value = '\0'; ... which is totally bogus