diff options
| author | mrg <mrg@NetBSD.org> | 2019-01-17 07:34:06 +0000 |
|---|---|---|
| committer | mrg <mrg@NetBSD.org> | 2019-01-17 07:34:06 +0000 |
| commit | 7ff21a5aaa53c3685d496c36745b58130c424a7d (patch) | |
| tree | ef1d04fee6574ba94b6e9feea44d15557fe91121 /libexec | |
| parent | 12fe0a7aa82993ec2d58ea9338d829922dfb96db (diff) | |
- fix CGI '+' param and error handling.
- remove unused parameter to daemon_poll_err().
both from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>
Diffstat (limited to 'libexec')
| -rw-r--r-- | libexec/httpd/CHANGES | 6 | ||||
| -rw-r--r-- | libexec/httpd/cgi-bozo.c | 14 | ||||
| -rw-r--r-- | libexec/httpd/daemon-bozo.c | 6 |
3 files changed, 16 insertions, 10 deletions
diff --git a/libexec/httpd/CHANGES b/libexec/httpd/CHANGES index 09697a6d5cc..c6d151124fb 100644 --- a/libexec/httpd/CHANGES +++ b/libexec/httpd/CHANGES @@ -1,4 +1,8 @@ -$NetBSD: CHANGES,v 1.34 2018/12/19 12:40:32 mrg Exp $ +$NetBSD: CHANGES,v 1.35 2019/01/17 07:34:06 mrg Exp $ + +changes in bozohttpd 20190116: + o fix CGI '+' parameter handling, and a double free. from + rajeev_v_pillai@yahoo.com changes in bozohttpd 20181215: o fix .htpasswd bypass for authenticated users. reported by JP, diff --git a/libexec/httpd/cgi-bozo.c b/libexec/httpd/cgi-bozo.c index 49fba2969cb..9121dc26ffd 100644 --- a/libexec/httpd/cgi-bozo.c +++ b/libexec/httpd/cgi-bozo.c @@ -1,4 +1,4 @@ -/* $NetBSD: cgi-bozo.c,v 1.45 2018/11/24 13:03:15 christos Exp $ */ +/* $NetBSD: cgi-bozo.c,v 1.46 2019/01/17 07:34:06 mrg Exp $ */ /* $eterna: cgi-bozo.c,v 1.40 2011/11/18 09:21:15 mrg Exp $ */ @@ -241,10 +241,10 @@ parse_search_string(bozo_httpreq_t *request, const char *query, size_t *args_len args[0] = str; args[*args_len] = NULL; - for (s = str, i = 0; (s = strchr(s, '+')) != NULL;) { + for (s = str, i = 1; (s = strchr(s, '+')) != NULL; i++) { *s = '\0'; s++; - args[i++] = s; + args[i] = s; } /* @@ -333,8 +333,7 @@ parse_search_string(bozo_httpreq_t *request, const char *query, size_t *args_len parse_err: - free (str); - free (*args); + free(str); free(args); *args_len = 0; @@ -610,9 +609,12 @@ bozo_process_cgi(bozo_httpreq_t *request) closelog(); bozo_daemon_closefds(httpd); - if (-1 == execve(path, argv, envp)) + if (-1 == execve(path, argv, envp)) { + bozo_http_error(httpd, 404, request, + "Cannot execute CGI"); bozoerr(httpd, 1, "child exec failed: %s: %s", path, strerror(errno)); + } /* NOT REACHED */ bozoerr(httpd, 1, "child execve returned?!"); } diff --git a/libexec/httpd/daemon-bozo.c b/libexec/httpd/daemon-bozo.c index 4666fcf308c..3391c01b2b1 100644 --- a/libexec/httpd/daemon-bozo.c +++ b/libexec/httpd/daemon-bozo.c @@ -1,4 +1,4 @@ -/* $NetBSD: daemon-bozo.c,v 1.19 2018/11/22 08:54:08 mrg Exp $ */ +/* $NetBSD: daemon-bozo.c,v 1.20 2019/01/17 07:34:06 mrg Exp $ */ /* $eterna: daemon-bozo.c,v 1.24 2011/11/18 09:21:15 mrg Exp $ */ @@ -205,7 +205,7 @@ daemon_runchild(bozohttpd_t *httpd, int fd) } static int -daemon_poll_err(bozohttpd_t *httpd, int fd, int idx) +daemon_poll_err(bozohttpd_t *httpd, int idx) { if ((httpd->fds[idx].revents & (POLLNVAL|POLLERR|POLLHUP)) == 0) return 0; @@ -284,7 +284,7 @@ again: } for (i = 0; i < httpd->nsock; i++) { - if (daemon_poll_err(httpd, fd, i)) + if (daemon_poll_err(httpd, i)) break; if (httpd->fds[i].revents == 0) continue; |
