[jira] [Updated] (SVN-4782) Using (const char*)1 in Apache HTTP server modules as value for r->notes cause httpd to crash

     [ https://issues.apache.org/jira/browse/SVN-4782?page=3Dcom.atlassian.=
jira.plugin.system.issuetabpanels:all-tabpanel ]

Daniel Sahlberg updated SVN-4782:
---------------------------------
    Fix Version/s: 1.14.0

> Using (const char*)1 in Apache HTTP server modules as value for r->notes =
cause httpd to crash
> -------------------------------------------------------------------------=
--------------------
>
>                 Key: SVN-4782
>                 URL: https://issues.apache.org/jira/browse/SVN-4782
>             Project: Subversion
>          Issue Type: Bug
>    Affects Versions: 1.9.x, trunk, 1.10.x, 1.11.x
>         Environment: All environments
>            Reporter: Ruediger Pluem
>            Priority: Major
>              Labels: patch
>             Fix For: 1.14.0
>
>         Attachments: notes_fix.diff
>
>
> *mod_authz_svn.c* and *mod_dav_svn.c*=C2=A0add keys to *r->notes*=C2=A0to=
 memorize boolean states (*FORCE_AUTHN_NOTE*, *IN_SOME_AUTHN_NOTE*, *authz_=
svn-anon-ok*, *NO_MAP_TO_STORAGE_NOTE*). They use=C2=A0_(const char*)1_ as =
values for the keys. This causes any call to *apr_table_clone* for *r->note=
s* to crash with a SEGFAULT, because _(const char*)1_ is an invalid address=
. *mod_http2* in httpd calls  *apr_table_clone* for *r->notes* and hence th=
e httpd process crashes. The attached patch (against trunk) replaces the va=
lue of =C2=A0_(const char*)1_ in these cases with a value of _"1"_.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)