diff options
| -rw-r--r-- | CHANGES | 4 | ||||
| -rw-r--r-- | server/util_fcgi.c | 11 |
2 files changed, 11 insertions, 4 deletions
@@ -1,6 +1,10 @@ -*- coding: utf-8 -*- Changes with Apache 2.5.0 + *) mod_proxy_fcgi, mod_fcgid: Fix crashes in ap_fcgi_encoded_env_len() when + modules add empty environment variables to the request. PR60275. + [<alex2grad AT gmail.com>] + *) mod_rewrite: Limit runaway memory use by short circuiting some kinds of looping RewriteRules when the local path significantly exceeds LimitRequestLine. PR 60478. [Jeff Wheelhouse <apache wheelhouse.org>] diff --git a/server/util_fcgi.c b/server/util_fcgi.c index a241e965f6..7fb2c8c1c2 100644 --- a/server/util_fcgi.c +++ b/server/util_fcgi.c @@ -153,7 +153,7 @@ AP_DECLARE(apr_size_t) ap_fcgi_encoded_env_len(apr_table_t *env, envlen += keylen; - vallen = strlen(elts[i].val); + vallen = elts[i].val ? strlen(elts[i].val) : 0; if (vallen >> 7 == 0) { envlen += 1; @@ -226,7 +226,7 @@ AP_DECLARE(apr_status_t) ap_fcgi_encode_env(request_rec *r, buflen -= 4; } - vallen = strlen(elts[i].val); + vallen = elts[i].val ? strlen(elts[i].val) : 0; if (vallen >> 7 == 0) { if (buflen < 1) { @@ -262,8 +262,11 @@ AP_DECLARE(apr_status_t) ap_fcgi_encode_env(request_rec *r, rv = APR_ENOSPC; /* overflow */ break; } - memcpy(itr, elts[i].val, vallen); - itr += vallen; + + if (elts[i].val) { + memcpy(itr, elts[i].val, vallen); + itr += vallen; + } if (buflen == vallen) { (*starting_elem)++; |