You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by yl...@apache.org on 2025/06/10 11:00:38 UTC
svn commit: r1926325 - in /httpd/httpd/branches/2.4.x: ./ changes-entries/SessionDBDCookieName.txt modules/session/mod_session_dbd.c
Author: ylavic
Date: Tue Jun 10 11:00:37 2025
New Revision: 1926325
URL: http://svn.apache.org/viewvc?rev=1926325&view=rev
Log:
mod_session_dbd: set_cookie_name: ensure correct format
If args is an empty string, apr_strtok will return NULL and *last will never get set which results in a SIGSEGV in apr_isspace check
Submitted by: Thomas Meyer <th...@m3y3r.de>
Github: closes #503
Follow-up to r1922931.
In set_cookie_name() and set_cookie_name2(), now that the empty 'name' argument is explicitly handled, the error message in check_string() can be simplified because the cookie name can't be empty anymore when this function is called.
Add a change entry to give credits to the author.
Merges r1922931, r1926188, r1926189 trunk
Submitted by: covener, jailletc36, jailletc36
Reviewed by: jailletc36, rpluem, ylavic
Added:
httpd/httpd/branches/2.4.x/changes-entries/SessionDBDCookieName.txt
- copied unchanged from r1926189, httpd/httpd/trunk/changes-entries/SessionDBDCookieName.txt
Modified:
httpd/httpd/branches/2.4.x/ (props changed)
httpd/httpd/branches/2.4.x/modules/session/mod_session_dbd.c
Propchange: httpd/httpd/branches/2.4.x/
------------------------------------------------------------------------------
Merged /httpd/httpd/trunk:r1922931,1926188-1926189
Modified: httpd/httpd/branches/2.4.x/modules/session/mod_session_dbd.c
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/modules/session/mod_session_dbd.c?rev=1926325&r1=1926324&r2=1926325&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/modules/session/mod_session_dbd.c (original)
+++ httpd/httpd/branches/2.4.x/modules/session/mod_session_dbd.c Tue Jun 10 11:00:37 2025
@@ -537,7 +537,7 @@ static const char *check_string(cmd_parm
{
if (APR_SUCCESS != ap_cookie_check_string(string)) {
return apr_pstrcat(cmd->pool, cmd->directive->directive,
- " cannot be empty, or contain '=', ';' or '&'.",
+ " cannot contain '=', ';' or '&'.",
NULL);
}
return NULL;
@@ -571,6 +571,11 @@ static const char *set_cookie_name(cmd_p
char *line = apr_pstrdup(cmd->pool, args);
session_dbd_dir_conf *conf = (session_dbd_dir_conf *) config;
char *cookie = apr_strtok(line, " \t", &last);
+ if (!cookie) {
+ return apr_pstrcat(cmd->pool, cmd->directive->directive,
+ " requires at least one argument!",
+ NULL);
+ }
conf->name = cookie;
conf->name_set = 1;
while (apr_isspace(*last)) {
@@ -586,6 +591,11 @@ static const char *set_cookie_name2(cmd_
char *line = apr_pstrdup(cmd->pool, args);
session_dbd_dir_conf *conf = (session_dbd_dir_conf *) config;
char *cookie = apr_strtok(line, " \t", &last);
+ if (!cookie) {
+ return apr_pstrcat(cmd->pool, cmd->directive->directive,
+ " requires at least one argument!",
+ NULL);
+ }
conf->name2 = cookie;
conf->name2_set = 1;
while (apr_isspace(*last)) {