Fix a bunch of cases where the return code of the regex compiler

was not checked properly. This affects: mod_setenvif, mod_usertrack,
mod_proxy, mod_proxy_ftp and core.

PR: 28218


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@103328 13f79535-47bb-0310-9956-ffa450edef68

6 files changed, 35 insertions, 4 deletions

diff --git a/CHANGES b/CHANGES
index 42d0c23a86..65433ebcb6 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,10 @@ Changes with Apache 2.1.0-dev
 
   [Remove entries to the current 2.0 section below, when backported]
 
+  *) Fix a bunch of cases where the return code of the regex compiler
+     was not checked properly. This affects: mod_setenvif, mod_usertrack,
+     mod_proxy, mod_proxy_ftp and core. PR 28218.  [André Malo]
+
   *) mod_usertrack: Escape the cookie name before pasting into the
      regexp.  [André Malo]
 
diff --git a/modules/metadata/mod_setenvif.c b/modules/metadata/mod_setenvif.c
index 78eb5c76d6..bf2e0ec02e 100644
--- a/modules/metadata/mod_setenvif.c
+++ b/modules/metadata/mod_setenvif.c
@@ -172,11 +172,12 @@ static int is_header_regex(apr_pool_t *p, const char* name)
      */
     regex_t *preg = ap_pregcomp(p, "^[-A-Za-z0-9_]*$",
                                 (REG_EXTENDED | REG_NOSUB ));
-    if (preg) {
-        if (ap_regexec(preg, name, 0, NULL, 0)) {
-            return 1;
-        }
+    ap_assert(preg != NULL);
+
+    if (ap_regexec(preg, name, 0, NULL, 0)) {
+        return 1;
     }
+
     return 0;
 }
 
diff --git a/modules/metadata/mod_usertrack.c b/modules/metadata/mod_usertrack.c
index 9c00a9a1d0..a707617997 100644
--- a/modules/metadata/mod_usertrack.c
+++ b/modules/metadata/mod_usertrack.c
@@ -200,6 +200,7 @@ static void set_and_comp_regexp(cookie_dir_rec *dcfg,
                                       "=([^;,]+)", NULL);
 
     dcfg->regexp = ap_pregcomp(p, dcfg->regexp_string, REG_EXTENDED);
+    ap_assert(dcfg->regexp != NULL);
 }
 
 static int spot_cookie(request_rec *r)
diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
index 2bb4b41cac..78c59083f3 100644
--- a/modules/proxy/mod_proxy.c
+++ b/modules/proxy/mod_proxy.c
@@ -946,6 +946,9 @@ static const char *proxysection(cmd_parms *cmd, void *mconfig, const char *arg)
      */
     if (thiscmd->cmd_data) { /* <ProxyMatch> */
         r = ap_pregcomp(cmd->pool, cmd->path, REG_EXTENDED);
+        if (!r) {
+            return "Regex could not be compiled";
+        }
     }
     else if (!strcmp(cmd->path, "~")) {
         cmd->path = ap_getword_conf(cmd->pool, &arg);
@@ -954,6 +957,9 @@ static const char *proxysection(cmd_parms *cmd, void *mconfig, const char *arg)
         if (strncasecmp(cmd->path, "proxy:", 6))
             cmd->path += 6;
         r = ap_pregcomp(cmd->pool, cmd->path, REG_EXTENDED);
+        if (!r) {
+            return "Regex could not be compiled";
+        }
     }
 
     /* initialize our config and fetch it */
diff --git a/modules/proxy/proxy_ftp.c b/modules/proxy/proxy_ftp.c
index f376ba96b9..ad29d08463 100644
--- a/modules/proxy/proxy_ftp.c
+++ b/modules/proxy/proxy_ftp.c
@@ -427,6 +427,7 @@ apr_status_t ap_proxy_send_dir_filter(ap_filter_t *f, apr_bucket_brigade *in)
 
         /* Compile the output format of "ls -s1" as a fallback for non-unix ftp listings */
         re = ap_pregcomp(p, LS_REG_PATTERN, REG_EXTENDED);
+        ap_assert(re != NULL);
 
         /* get a complete line */
         /* if the buffer overruns - throw data away */
diff --git a/server/core.c b/server/core.c
index 302aa0798d..915f752d6c 100644
--- a/server/core.c
+++ b/server/core.c
@@ -1651,9 +1651,15 @@ static const char *dirsection(cmd_parms *cmd, void *mconfig, const char *arg)
         if (!cmd->path)
             return "<Directory ~ > block must specify a path";
         r = ap_pregcomp(cmd->pool, cmd->path, REG_EXTENDED|USE_ICASE);
+        if (!r) {
+            return "Regex could not be compiled";
+        }
     }
     else if (thiscmd->cmd_data) { /* <DirectoryMatch> */
         r = ap_pregcomp(cmd->pool, cmd->path, REG_EXTENDED|USE_ICASE);
+        if (!r) {
+            return "Regex could not be compiled";
+        }
     }
     else if (!strcmp(cmd->path, "/") == 0)
     {
@@ -1735,10 +1741,16 @@ static const char *urlsection(cmd_parms *cmd, void *mconfig, const char *arg)
 
     if (thiscmd->cmd_data) { /* <LocationMatch> */
         r = ap_pregcomp(cmd->pool, cmd->path, REG_EXTENDED);
+        if (!r) {
+            return "Regex could not be compiled";
+        }
     }
     else if (!strcmp(cmd->path, "~")) {
         cmd->path = ap_getword_conf(cmd->pool, &arg);
         r = ap_pregcomp(cmd->pool, cmd->path, REG_EXTENDED);
+        if (!r) {
+            return "Regex could not be compiled";
+        }
     }
 
     /* initialize our config and fetch it */
@@ -1797,10 +1809,16 @@ static const char *filesection(cmd_parms *cmd, void *mconfig, const char *arg)
 
     if (thiscmd->cmd_data) { /* <FilesMatch> */
         r = ap_pregcomp(cmd->pool, cmd->path, REG_EXTENDED|USE_ICASE);
+        if (!r) {
+            return "Regex could not be compiled";
+        }
     }
     else if (!strcmp(cmd->path, "~")) {
         cmd->path = ap_getword_conf(cmd->pool, &arg);
         r = ap_pregcomp(cmd->pool, cmd->path, REG_EXTENDED|USE_ICASE);
+        if (!r) {
+            return "Regex could not be compiled";
+        }
     }
     else {
         char *newpath;