Re: segfault in mod_negotiation.c

2002-10-13 Thread Gregory (Grisha) Trubetskoy


Sorry - nevermind that, obviously I was being extra sloppy, here is
another stab at this.

It segafults if a translate_name doesn't set req->filename. (I don't know
how probable this is, but it did happen to someone using mod_python,
perhpas the way to solve it is to make mod_python guard against this)

The segfault will happen in mod_mime.c, line 807 in find_ct()

/* If use_path_info is explicitly set to on (value & 1 == 1), append. */
if (conf->use_path_info & 1) {
resource_name = apr_pstrcat(r->pool, r->filename, r->path_info, NULL);
}
else {
resource_name = r->filename;
}

/* Always drop the path leading up to the file name.
 */
if ((fn = ap_strrchr_c(resource_name, '/')) == NULL) {

It's not considering the possibility of r->filename being null.

Grisha

On Sat, 12 Oct 2002 [EMAIL PROTECTED] wrote:

> On 12 Oct 2002, Jeff Trawick wrote:
>
> > "Gregory (Grisha) Trubetskoy" <[EMAIL PROTECTED]> writes:
> >
> > > --- mod_negotiation.c   Fri Aug  9 15:21:57 2002
> > > +++ mod_negotiation.c.new   Sat Oct 12 15:47:36 2002
> > > @@ -2881,7 +2881,7 @@
> > >  int res;
> > >  int j;
> > >
> > > -if (r->finfo.filetype != APR_NOFILE
> > > +if (!r->finfo || r->finfo.filetype != APR_NOFILE
> > >  || !(ap_allow_options(r) & OPT_MULTI)) {
> > >  return DECLINED;
> > >  }
> >
> > what does it mean to say "!r->finfo" when finfo is a structure, not a pointer?
>
> Better question, how in the world is this seg faulting?
>
>
> Ryan
>
> ___
> Ryan Bloom[EMAIL PROTECTED]
> 550 Jean St
> Oakland CA 94610
> ---
>




Re: segfault in mod_negotiation.c

2002-10-13 Thread rbb

On 12 Oct 2002, Jeff Trawick wrote:

> "Gregory (Grisha) Trubetskoy" <[EMAIL PROTECTED]> writes:
> 
> > --- mod_negotiation.c   Fri Aug  9 15:21:57 2002
> > +++ mod_negotiation.c.new   Sat Oct 12 15:47:36 2002
> > @@ -2881,7 +2881,7 @@
> >  int res;
> >  int j;
> > 
> > -if (r->finfo.filetype != APR_NOFILE
> > +if (!r->finfo || r->finfo.filetype != APR_NOFILE
> >  || !(ap_allow_options(r) & OPT_MULTI)) {
> >  return DECLINED;
> >  }
> 
> what does it mean to say "!r->finfo" when finfo is a structure, not a pointer?

Better question, how in the world is this seg faulting?


Ryan

___
Ryan Bloom  [EMAIL PROTECTED]
550 Jean St
Oakland CA 94610
---




Re: segfault in mod_negotiation.c

2002-10-13 Thread Jeff Trawick

"Gregory (Grisha) Trubetskoy" <[EMAIL PROTECTED]> writes:

> --- mod_negotiation.c   Fri Aug  9 15:21:57 2002
> +++ mod_negotiation.c.new   Sat Oct 12 15:47:36 2002
> @@ -2881,7 +2881,7 @@
>  int res;
>  int j;
> 
> -if (r->finfo.filetype != APR_NOFILE
> +if (!r->finfo || r->finfo.filetype != APR_NOFILE
>  || !(ap_allow_options(r) & OPT_MULTI)) {
>  return DECLINED;
>  }

what does it mean to say "!r->finfo" when finfo is a structure, not a pointer?

-- 
Jeff Trawick | [EMAIL PROTECTED]
Born in Roswell... married an alien...