The following reply was made to PR mod_include/1921; it has been noted by GNATS.
From: Dean Gaudet <[EMAIL PROTECTED]>
To: Peter Jakobi <[EMAIL PROTECTED]>
Cc: Rubinstein Dmitry <[EMAIL PROTECTED]>, [EMAIL PROTECTED]
Subject: Re: mod_include/1921: '$' is not recognized as 'end of line' in regex
matching
Date: Mon, 25 May 1998 18:39:33 -0700 (PDT)
On Mon, 25 May 1998, Peter Jakobi wrote:
> 2249 mod_include 1.2.5 onward Noncr apache open sw-bug [EMAIL PROTECTED] SSI
> regex error: /^$/ should only match undef'd or empty vars 2249
> 1921 Synopsis: '$' is not recognized as 'end of line' in regex matching
Try this... I screwed up during the security patches in 1.2.5. I've
already committed this fix to 1.2.7-dev and 1.3b8-dev. Tell me if it does
the job for you.
Dean
Index: modules/standard/mod_include.c
===================================================================
RCS file: /export/home/cvs/apache-1.3/src/modules/standard/mod_include.c,v
retrieving revision 1.91
diff -u -r1.91 mod_include.c
--- mod_include.c 1998/05/20 19:41:11 1.91
+++ mod_include.c 1998/05/26 00:51:17
@@ -532,20 +532,26 @@
/* what a pain, too bad there's no table_getn where you can
* pass a non-nul terminated string */
l = end_of_var_name - start_of_var_name;
- l = (l > sizeof(var) - 1) ? (sizeof(var) - 1) : l;
- memcpy(var, start_of_var_name, l);
- var[l] = '\0';
+ if (l != 0) {
+ l = (l > sizeof(var) - 1) ? (sizeof(var) - 1) : l;
+ memcpy(var, start_of_var_name, l);
+ var[l] = '\0';
- val = table_get(r->subprocess_env, var);
- if (val) {
- expansion = val;
- l = strlen(expansion);
+ val = table_get(r->subprocess_env, var);
+ if (val) {
+ expansion = val;
+ l = strlen(expansion);
+ }
+ else if (leave_name) {
+ l = in - expansion;
+ }
+ else {
+ break; /* no expansion to be done */
+ }
}
- else if (leave_name) {
- l = in - expansion;
- }
else {
- break; /* no expansion to be done */
+ /* zero-length variable name causes just the $ to be copied
*/
+ l = 1;
}
l = (l > end_out - next) ? (end_out - next) : l;
memcpy(next, expansion, l);
