blob: f9cf868d01223b8ded3623c1e73ae298bc3c1352 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
From 7e09dd714fc62c08c5b0319ed7b9702594faf49b Mon Sep 17 00:00:00 2001
From: Yann Ylavic <ylavic@apache.org>
Date: Mon, 1 Mar 2021 20:13:54 +0000
Subject: [PATCH] mod_session: account for the '&' in identity_concat().
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1887052 13f79535-47bb-0310-9956-ffa450edef68
Upstream-Status: Backport
CVE: CVE-2021-26691
Reference to upstream patch:
https://bugzilla.redhat.com/show_bug.cgi?id=1966732
https://github.com/apache/httpd/commit/7e09dd714fc62c08c5b0319ed7b9702594faf49b
Signed-off-by: Li Wang <li.wang@windriver.com>
---
modules/session/mod_session.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/modules/session/mod_session.c b/modules/session/mod_session.c
index 7ee477c..ebd05b0 100644
--- a/modules/session/mod_session.c
+++ b/modules/session/mod_session.c
@@ -317,7 +317,7 @@ static apr_status_t ap_session_set(request_rec * r, session_rec * z,
static int identity_count(void *v, const char *key, const char *val)
{
int *count = v;
- *count += strlen(key) * 3 + strlen(val) * 3 + 1;
+ *count += strlen(key) * 3 + strlen(val) * 3 + 2;
return 1;
}
--
2.7.4
|
