← Back to branch summary

~ubuntu-branches/ubuntu/saucy/apache2/saucy

« back to all changes in this revision

Viewing changes to debian/patches/031_CAN-2004-0747.patch

  • Committer: Bazaar Package Importer
  • Author(s): Thom May
  • Date: 2004-10-13 19:46:10 UTC
  • Revision ID: james.westby@ubuntu.com-20041013194610-ccvqcz8vflh5zqrm
Tags: 2.0.50-12ubuntu4
Security Release. Patch from upstream for the following:
CAN-2004-0885SSLCypherSuite can be bypassed during renegotiation.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/031_CAN-2004-0747.patch
 
1
diff -Nur httpd-2.0~/server/util.c httpd-2.0/server/util.c
 
2
--- httpd-2.0~/server/util.c
 
3
+++ build-tree/apache2/server/util.c
 
4
@@ -722,7 +722,7 @@
 
5
 
 
6
     *resp++ = '\0';
 
7
 #if RESOLVE_ENV_PER_TOKEN
 
8
-    return ap_resolve_env(p,result);
 
9
+    return (char *)ap_resolve_env(p,result);
 
10
 #else
 
11
     return result;
 
12
 #endif
 
13
@@ -782,39 +782,87 @@
 
14
  */
 
15
 AP_DECLARE(const char *) ap_resolve_env(apr_pool_t *p, const char * word)
 
16
 {
 
17
-       char tmp[ MAX_STRING_LEN ];
 
18
-       const char *s, *e;
 
19
-       tmp[0] = '\0';
 
20
-
 
21
-       if (!(s=ap_strchr_c(word,'$')))
 
22
-               return word;
 
23
-
 
24
-       do {
 
25
-               /* XXX - relies on strncat() to add '\0'
 
26
-                */
 
27
-               strncat(tmp,word,s - word);
 
28
-               if ((s[1] == '{') && (e=ap_strchr_c(s,'}'))) {
 
29
-                       const char *e2 = e;
 
30
-                       char *var;
 
31
-                       word = e + 1;
 
32
-                       var = apr_pstrndup(p, s+2, e2-(s+2));
 
33
-                       e = getenv(var);
 
34
-                       if (e) {
 
35
-                           strcat(tmp,e);
 
36
-                       } else {
 
37
-                           strncat(tmp, s, e2-s);
 
38
-                           strcat(tmp,"}");
 
39
-                       }
 
40
-               } else {
 
41
-                       /* ignore invalid strings */
 
42
-                       word = s+1;
 
43
-                       strcat(tmp,"$");
 
44
-               };
 
45
-       } while ((s=ap_strchr_c(word,'$')));
 
46
-       strcat(tmp,word);
 
47
+# define SMALL_EXPANSION 5
 
48
+    struct sll {
 
49
+        struct sll *next;
 
50
+        const char *string;
 
51
+        apr_size_t len;
 
52
+    } *result, *current, sresult[SMALL_EXPANSION];
 
53
+    char *res_buf, *cp;
 
54
+    const char *s, *e, *ep;
 
55
+    unsigned spc;
 
56
+    apr_size_t outlen;
 
57
+
 
58
+    s = ap_strchr_c(word, '$');
 
59
+    if (!s) {
 
60
+        return word;
 
61
+    }
 
62
+
 
63
+    /* well, actually something to do */
 
64
+    ep = word + strlen(word);
 
65
+    spc = 0;
 
66
+    result = current = &(sresult[spc++]);
 
67
+    current->next = NULL;
 
68
+    current->string = word;
 
69
+    current->len = s - word;
 
70
+    outlen = current->len;
 
71
+
 
72
+    do {
 
73
+        /* prepare next entry */
 
74
+        if (current->len) {
 
75
+            current->next = (spc < SMALL_EXPANSION)
 
76
+                            ? &(sresult[spc++])
 
77
+                            : (struct sll *)apr_palloc(p,
 
78
+                                                       sizeof(*current->next));
 
79
+            current = current->next;
 
80
+            current->next = NULL;
 
81
+            current->len = 0;
 
82
+        }
 
83
 
 
84
-       return apr_pstrdup(p,tmp);
 
85
+        if (*s == '$') {
 
86
+            if (s[1] == '{' && (e = ap_strchr_c(s, '}'))) {
 
87
+                word = getenv(apr_pstrndup(p, s+2, e-s-2));
 
88
+                if (word) {
 
89
+                    current->string = word;
 
90
+                    current->len = strlen(word);
 
91
+                    outlen += current->len;
 
92
+                }
 
93
+                else {
 
94
+                    current->string = s;
 
95
+                    current->len = e - s + 1;
 
96
+                    outlen += current->len;
 
97
+                }
 
98
+                s = e + 1;
 
99
+            }
 
100
+            else {
 
101
+                current->string = s++;
 
102
+                current->len = 1;
 
103
+                ++outlen;
 
104
+            }
 
105
+        }
 
106
+        else {
 
107
+            word = s;
 
108
+            s = ap_strchr_c(s, '$');
 
109
+            current->string = word;
 
110
+            current->len = s ? s - word : ep - word;
 
111
+            outlen += current->len;
 
112
+        }
 
113
+    } while (s && *s);
 
114
+
 
115
+    /* assemble result */
 
116
+    res_buf = cp = apr_palloc(p, outlen + 1);
 
117
+    do {
 
118
+        if (result->len) {
 
119
+            memcpy(cp, result->string, result->len);
 
120
+            cp += result->len;
 
121
+        }
 
122
+        result = result->next;
 
123
+    } while (result);
 
124
+    res_buf[outlen] = '\0';
 
125
+
 
126
+    return res_buf;
 
127
 }
 
128
+
 
129
 AP_DECLARE(int) ap_cfg_closefile(ap_configfile_t *cfp)
 
130
 {
 
131
 #ifdef DEBUG
 
132