From aba71163153e8e980107b5545c43a04afdd39122 Mon Sep 17 00:00:00 2001
From: Stefan Eissing <icing@apache.org>
Date: Tue, 2 Jul 2019 11:11:08 +0000
Subject: [PATCH]   *) mod_proxy_http2: fixing a potential NULL pointer use in
 logging.      [Christophe Jaillet <christophe.jaillet wanadoo.fr>, Dr Silvio
 Cesare InfoSect]

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1862418 13f79535-47bb-0310-9956-ffa450edef68
---
 CHANGES                          | 3 +++
 modules/http2/h2_proxy_session.c | 6 +++---
 modules/http2/h2_proxy_util.c    | 4 ++--
 3 files changed, 8 insertions(+), 5 deletions(-)

# diff --git a/CHANGES b/CHANGES
# index 9cb41a6cde..be97a1b63a 100644
# --- a/CHANGES
# +++ b/CHANGES
# @@ -1,6 +1,9 @@
#                                                           -*- coding: utf-8 -*-
#  Changes with Apache 2.4.40
#  
# +  *) mod_proxy_http2: fixing a potential NULL pointer use in logging.
# +     [Christophe Jaillet <christophe.jaillet wanadoo.fr>, Dr Silvio Cesare InfoSect]
# +
#    *) mod_dav: Reduce the amount of memory needed when doing PROPFIND's on large
#       collections by improving the memory management. [Joe Orton, Ruediger Pluem]
#  
diff --git a/modules/http2/h2_proxy_session.c b/modules/http2/h2_proxy_session.c
index 4b852bf366..3246ce1af4 100644
--- a/modules/http2/h2_proxy_session.c
+++ b/modules/http2/h2_proxy_session.c
@@ -494,8 +494,8 @@ static ssize_t stream_request_data(nghttp2_session *ngh2, int32_t stream_id,
     stream = nghttp2_session_get_stream_user_data(ngh2, stream_id);
     if (!stream) {
         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, APLOGNO(03361)
-                     "h2_proxy_stream(%s): data_read, stream %d not found", 
-                     stream->session->id, stream_id);
+                     "h2_proxy_stream(NULL): data_read, stream %d not found", 
+                     stream_id);
         return NGHTTP2_ERR_CALLBACK_FAILURE;
     }
     
@@ -1443,7 +1443,7 @@ run_loop:
                 ap_log_cerror(APLOG_MARK, APLOG_TRACE3, status, session->c, 
                               APLOGNO(03365)
                               "h2_proxy_session(%s): WAIT read, timeout=%fms", 
-                              session->id, (float)session->wait_timeout/1000.0);
+                              session->id, session->wait_timeout/1000.0);
                 if (status == APR_SUCCESS) {
                     have_read = 1;
                     dispatch_event(session, H2_PROXYS_EV_DATA_READ, 0, NULL);
diff --git a/modules/http2/h2_proxy_util.c b/modules/http2/h2_proxy_util.c
index c291193d2e..1e6cb277b0 100644
--- a/modules/http2/h2_proxy_util.c
+++ b/modules/http2/h2_proxy_util.c
@@ -937,12 +937,12 @@ static size_t subst_str(link_ctx *ctx, int start, int end, const char *ns)
     nlen = (int)strlen(ns);
     delta = nlen - olen;
     plen = ctx->slen + delta + 1;
-    p = apr_pcalloc(ctx->pool, plen);
+    p = apr_palloc(ctx->pool, plen);
     memcpy(p, ctx->s, start);
     memcpy(p + start, ns, nlen);
     strcpy(p + start + nlen, ctx->s + end);
     ctx->s = p;
-    ctx->slen = (int)strlen(p);
+    ctx->slen = plen - 1;   /* (int)strlen(p) */
     if (ctx->i >= end) {
         ctx->i += delta;
     }
-- 
2.17.1

