Attachment #18247 for bug #39518

View | Details | Raw Unified | Return to bug 39518
Collapse All | Expand All

Lines 88-95 Link Here

(-)modules/aaa/mod_authn_core.c (-2 / +1 lines)
88	/* Create this conf by duplicating the base, replacing elements	88	/* Create this conf by duplicating the base, replacing elements
89	* (or creating copies for merging) where new-> values exist.	89	* (or creating copies for merging) where new-> values exist.
90	*/	90	*/
91	conf = (authn_core_dir_conf *)apr_palloc(a, sizeof(authn_core_dir_conf));	91	conf = (authn_core_dir_conf *)apr_pmemdup(a, base, sizeof(authn_core_dir_conf));
92	memcpy(conf, base, sizeof(authn_core_dir_conf));
93		92
94	if (new->ap_auth_type) {	93	if (new->ap_auth_type) {
95	conf->ap_auth_type = new->ap_auth_type;	94	conf->ap_auth_type = new->ap_auth_type;

Lines 370-377 Link Here

(-)modules/ssl/ssl_scache_dbm.c (-2 / +1 lines)
370	bDelete = TRUE;	370	bDelete = TRUE;
371	}	371	}
372	if (bDelete) {	372	if (bDelete) {
373	if ((keylist[keyidx].dptr = apr_palloc(p, dbmkey.dsize)) != NULL) {	373	if ((keylist[keyidx].dptr = apr_pmemdup(p, dbmkey.dptr, dbmkey.dsize)) != NULL) {
374	memcpy(keylist[keyidx].dptr, dbmkey.dptr, dbmkey.dsize);
375	keylist[keyidx].dsize = dbmkey.dsize;	374	keylist[keyidx].dsize = dbmkey.dsize;
376	keyidx++;	375	keyidx++;
377	if (keyidx == KEYMAX)	376	if (keyidx == KEYMAX)





            /* check if we mismatched earlier and have to release some chars */
            if (release && (ctx->flags & SSI_FLAG_PRINTING)) {
                char *to_release = apr_pmemdup(ctx->pool, intern->start_seq, release);

                memcpy(to_release, intern->start_seq, release);
                newb = apr_bucket_pool_create(to_release, release, ctx->pool,
                                              f->c->bucket_alloc);
                APR_BRIGADE_INSERT_TAIL(pass_bb, newb);

    if (intern->seen_eos) {
        if (PARSE_HEAD == intern->state) {
            if (ctx->flags & SSI_FLAG_PRINTING) {
                char *to_release = apr_pmemdup(ctx->pool, intern->start_seq,
                                                          intern->parse_pos);

                memcpy(to_release, intern->start_seq, intern->parse_pos);
                APR_BRIGADE_INSERT_TAIL(pass_bb,
                                        apr_bucket_pool_create(to_release,
                                        intern->parse_pos, ctx->pool,




    /* Create this conf by duplicating the base, replacing elements
     * (or creating copies for merging) where new-> values exist.
     */
    conf = (core_dir_config *)apr_pmemdup(a, base, sizeof(core_dir_config));
    memcpy(conf, base, sizeof(core_dir_config));

    conf->d = new->d;
    conf->d_is_fnmatch = new->d_is_fnmatch;

    else if (new->response_code_strings != NULL) {
        /* If we merge, the merge-result must have it's own array
         */
        conf->response_code_strings = apr_pmemdup(a,
            base->response_code_strings,
            sizeof(*conf->response_code_strings) * RESPONSE_CODES);
        memcpy(conf->response_code_strings, base->response_code_strings,
               sizeof(*conf->response_code_strings) * RESPONSE_CODES);

        for (i = 0; i < RESPONSE_CODES; ++i) {
            if (new->response_code_strings[i] != NULL) {

    core_server_config *virt = (core_server_config *)virtv;
    core_server_config *conf;

    conf = (core_server_config *)apr_pmemdup(p, virt, sizeof(core_server_config));
    memcpy(conf, virt, sizeof(core_server_config));

    if (!conf->access_name) {
        conf->access_name = base->access_name;




                                        const void *base_val,
                                        const void *data)
{
    extension_info *new_info = apr_palloc(p, sizeof(extension_info));
    const extension_info *overlay_info = (const extension_info *)overlay_val;
    const extension_info *base_info = (const extension_info *)base_val;
    extension_info *new_info = apr_pmemdup(p, base_info, sizeof(extension_info));

    memcpy(new_info, base_info, sizeof(extension_info));
    if (overlay_info->forced_type) {
        new_info->forced_type = overlay_info->forced_type;
    }

Lines 130-137 Link Here

(-)modules/aaa/mod_authz_core.c (-2 / +1 lines)
130	/* Create this conf by duplicating the base, replacing elements	130	/* Create this conf by duplicating the base, replacing elements
131	* (or creating copies for merging) where new-> values exist.	131	* (or creating copies for merging) where new-> values exist.
132	*/	132	*/
133	conf = (authz_core_dir_conf *)apr_palloc(a, sizeof(authz_core_dir_conf));	133	conf = (authz_core_dir_conf *)apr_pmemdup(a, new, sizeof(authz_core_dir_conf));
134	memcpy(conf, new, sizeof(authz_core_dir_conf));
135		134
136	conf->some_authz = base->some_authz == -1 ? 0:base->some_authz == 0 ? 0:new->some_authz;	135	conf->some_authz = base->some_authz == -1 ? 0:base->some_authz == 0 ? 0:new->some_authz;
137		136




            dp = apr_pcalloc(p, sizeof(*dp));
            memcpy(dp, val.dptr + offset, sizeof(dp->f));
            offset += sizeof(dp->f);
            dp->locktoken = apr_pmemdup(p, val.dptr + offset, sizeof(*dp->locktoken));
            memcpy(dp->locktoken, val.dptr + offset, sizeof(*dp->locktoken));
            offset += sizeof(*dp->locktoken);
            if (*(val.dptr + offset) == '\0') {
                ++offset;

            /* Create and fill a dav_lock_indirect structure */

            ip = apr_pcalloc(p, sizeof(*ip));
            ip->locktoken = apr_pmemdup(p, val.dptr + offset, sizeof(*ip->locktoken));
            memcpy(ip->locktoken, val.dptr + offset, sizeof(*ip->locktoken));
            offset += sizeof(*ip->locktoken);
            memcpy(&ip->timeout, val.dptr + offset, sizeof(ip->timeout));
            offset += sizeof(ip->timeout);
            memcpy(&ip->key.dsize, val.dptr + offset, sizeof(ip->key.dsize)); /* length of datum */
            offset += sizeof(ip->key.dsize);
            ip->key.dptr = apr_pmemdup(p, val.dptr + offset, ip->key.dsize);
            memcpy(ip->key.dptr, val.dptr + offset, ip->key.dsize);
            offset += ip->key.dsize;

            if (!dav_fs_lock_expired(ip->timeout)) {




            offset += sizeof(dp->f);

            /* Copy the lock token. */
            dp->locktoken = apr_pmemdup(p, val.dptr + offset, sizeof(*dp->locktoken));
            memcpy(dp->locktoken, val.dptr + offset, sizeof(*dp->locktoken));
            offset += sizeof(*dp->locktoken);

            /* Do we have an owner field? */

            /* Create and fill a dav_lock_indirect structure */

            ip = apr_pcalloc(p, sizeof(*ip));
            ip->locktoken = apr_pmemdup(p, val.dptr + offset, sizeof(*ip->locktoken));
            memcpy(ip->locktoken, val.dptr + offset, sizeof(*ip->locktoken));
            offset += sizeof(*ip->locktoken);
            memcpy(&ip->timeout, val.dptr + offset, sizeof(ip->timeout));
            offset += sizeof(ip->timeout);
            /* length of datum */
            ip->key.dsize = *((int *) (val.dptr + offset));
            offset += sizeof(ip->key.dsize);
            ip->key.dptr = apr_pmemdup(p, val.dptr + offset, ip->key.dsize);
            memcpy(ip->key.dptr, val.dptr + offset, ip->key.dsize);
            offset += ip->key.dsize;

            if (!dav_generic_lock_expired(ip->timeout)) {

Return to bug 39518

Lines 3225-3233 Link Here

(-)modules/filters/mod_include.c (-4 / +3 lines)
3225		3225
3226	/* check if we mismatched earlier and have to release some chars */	3226	/* check if we mismatched earlier and have to release some chars */
3227	if (release && (ctx->flags & SSI_FLAG_PRINTING)) {	3227	if (release && (ctx->flags & SSI_FLAG_PRINTING)) {
3228	char *to_release = apr_palloc(ctx->pool, release);	3228	char *to_release = apr_pmemdup(ctx->pool, intern->start_seq, release);
3229		3229
3230	memcpy(to_release, intern->start_seq, release);
3231	newb = apr_bucket_pool_create(to_release, release, ctx->pool,	3230	newb = apr_bucket_pool_create(to_release, release, ctx->pool,
3232	f->c->bucket_alloc);	3231	f->c->bucket_alloc);
3233	APR_BRIGADE_INSERT_TAIL(pass_bb, newb);	3232	APR_BRIGADE_INSERT_TAIL(pass_bb, newb);
Lines 3414-3422 Link Here
3414	if (intern->seen_eos) {	3413	if (intern->seen_eos) {
3415	if (PARSE_HEAD == intern->state) {	3414	if (PARSE_HEAD == intern->state) {
3416	if (ctx->flags & SSI_FLAG_PRINTING) {	3415	if (ctx->flags & SSI_FLAG_PRINTING) {
3417	char *to_release = apr_palloc(ctx->pool, intern->parse_pos);	3416	char *to_release = apr_pmemdup(ctx->pool, intern->start_seq,
		3417	intern->parse_pos);
3418		3418
3419	memcpy(to_release, intern->start_seq, intern->parse_pos);
3420	APR_BRIGADE_INSERT_TAIL(pass_bb,	3419	APR_BRIGADE_INSERT_TAIL(pass_bb,
3421	apr_bucket_pool_create(to_release,	3420	apr_bucket_pool_create(to_release,
3422	intern->parse_pos, ctx->pool,	3421	intern->parse_pos, ctx->pool,

Lines 222-229 Link Here

(-)server/core.c (-7 / +4 lines)
222	/* Create this conf by duplicating the base, replacing elements	222	/* Create this conf by duplicating the base, replacing elements
223	* (or creating copies for merging) where new-> values exist.	223	* (or creating copies for merging) where new-> values exist.
224	*/	224	*/
225	conf = (core_dir_config *)apr_palloc(a, sizeof(core_dir_config));	225	conf = (core_dir_config *)apr_pmemdup(a, base, sizeof(core_dir_config));
226	memcpy(conf, base, sizeof(core_dir_config));
227		226
228	conf->d = new->d;	227	conf->d = new->d;
229	conf->d_is_fnmatch = new->d_is_fnmatch;	228	conf->d_is_fnmatch = new->d_is_fnmatch;
Lines 269-278 Link Here
269	else if (new->response_code_strings != NULL) {	268	else if (new->response_code_strings != NULL) {
270	/* If we merge, the merge-result must have it's own array	269	/* If we merge, the merge-result must have it's own array
271	*/	270	*/
272	conf->response_code_strings = apr_palloc(a,	271	conf->response_code_strings = apr_pmemdup(a,
		272	base->response_code_strings,
273	sizeof(conf->response_code_strings) RESPONSE_CODES);	273	sizeof(conf->response_code_strings) RESPONSE_CODES);
274	memcpy(conf->response_code_strings, base->response_code_strings,
275	sizeof(conf->response_code_strings) RESPONSE_CODES);
276		274
277	for (i = 0; i < RESPONSE_CODES; ++i) {	275	for (i = 0; i < RESPONSE_CODES; ++i) {
278	if (new->response_code_strings[i] != NULL) {	276	if (new->response_code_strings[i] != NULL) {
Lines 470-477 Link Here
470	core_server_config virt = (core_server_config )virtv;	468	core_server_config virt = (core_server_config )virtv;
471	core_server_config *conf;	469	core_server_config *conf;
472		470
473	conf = (core_server_config *)apr_palloc(p, sizeof(core_server_config));	471	conf = (core_server_config *)apr_pmemdup(p, virt, sizeof(core_server_config));
474	memcpy(conf, virt, sizeof(core_server_config));
475		472
476	if (!conf->access_name) {	473	if (!conf->access_name) {
477	conf->access_name = base->access_name;	474	conf->access_name = base->access_name;

Lines 140-150 Link Here

(-)modules/http/mod_mime.c (-2 / +1 lines)
140	const void *base_val,	140	const void *base_val,
141	const void *data)	141	const void *data)
142	{	142	{
143	extension_info *new_info = apr_palloc(p, sizeof(extension_info));
144	const extension_info overlay_info = (const extension_info )overlay_val;	143	const extension_info overlay_info = (const extension_info )overlay_val;
145	const extension_info base_info = (const extension_info )base_val;	144	const extension_info base_info = (const extension_info )base_val;
		145	extension_info *new_info = apr_pmemdup(p, base_info, sizeof(extension_info));
146		146
147	memcpy(new_info, base_info, sizeof(extension_info));
148	if (overlay_info->forced_type) {	147	if (overlay_info->forced_type) {
149	new_info->forced_type = overlay_info->forced_type;	148	new_info->forced_type = overlay_info->forced_type;
150	}	149	}

Lines 600-607 Link Here

(-)modules/dav/fs/lock.c (-6 / +3 lines)
600	dp = apr_pcalloc(p, sizeof(*dp));	600	dp = apr_pcalloc(p, sizeof(*dp));
601	memcpy(dp, val.dptr + offset, sizeof(dp->f));	601	memcpy(dp, val.dptr + offset, sizeof(dp->f));
602	offset += sizeof(dp->f);	602	offset += sizeof(dp->f);
603	dp->locktoken = apr_palloc(p, sizeof(*dp->locktoken));	603	dp->locktoken = apr_pmemdup(p, val.dptr + offset, sizeof(*dp->locktoken));
604	memcpy(dp->locktoken, val.dptr + offset, sizeof(*dp->locktoken));
605	offset += sizeof(*dp->locktoken);	604	offset += sizeof(*dp->locktoken);
606	if (*(val.dptr + offset) == '\0') {	605	if (*(val.dptr + offset) == '\0') {
607	++offset;	606	++offset;
Lines 648-662 Link Here
648	/* Create and fill a dav_lock_indirect structure */	647	/* Create and fill a dav_lock_indirect structure */
649		648
650	ip = apr_pcalloc(p, sizeof(*ip));	649	ip = apr_pcalloc(p, sizeof(*ip));
651	ip->locktoken = apr_palloc(p, sizeof(*ip->locktoken));	650	ip->locktoken = apr_pmemdup(p, val.dptr + offset, sizeof(*ip->locktoken));
652	memcpy(ip->locktoken, val.dptr + offset, sizeof(*ip->locktoken));
653	offset += sizeof(*ip->locktoken);	651	offset += sizeof(*ip->locktoken);
654	memcpy(&ip->timeout, val.dptr + offset, sizeof(ip->timeout));	652	memcpy(&ip->timeout, val.dptr + offset, sizeof(ip->timeout));
655	offset += sizeof(ip->timeout);	653	offset += sizeof(ip->timeout);
656	memcpy(&ip->key.dsize, val.dptr + offset, sizeof(ip->key.dsize)); /* length of datum */	654	memcpy(&ip->key.dsize, val.dptr + offset, sizeof(ip->key.dsize)); /* length of datum */
657	offset += sizeof(ip->key.dsize);	655	offset += sizeof(ip->key.dsize);
658	ip->key.dptr = apr_palloc(p, ip->key.dsize);	656	ip->key.dptr = apr_pmemdup(p, val.dptr + offset, ip->key.dsize);
659	memcpy(ip->key.dptr, val.dptr + offset, ip->key.dsize);
660	offset += ip->key.dsize;	657	offset += ip->key.dsize;
661		658
662	if (!dav_fs_lock_expired(ip->timeout)) {	659	if (!dav_fs_lock_expired(ip->timeout)) {

Lines 603-610 Link Here

(-)modules/dav/lock/locks.c (-6 / +3 lines)
603	offset += sizeof(dp->f);	603	offset += sizeof(dp->f);
604		604
605	/* Copy the lock token. */	605	/* Copy the lock token. */
606	dp->locktoken = apr_palloc(p, sizeof(*dp->locktoken));	606	dp->locktoken = apr_pmemdup(p, val.dptr + offset, sizeof(*dp->locktoken));
607	memcpy(dp->locktoken, val.dptr + offset, sizeof(*dp->locktoken));
608	offset += sizeof(*dp->locktoken);	607	offset += sizeof(*dp->locktoken);
609		608
610	/* Do we have an owner field? */	609	/* Do we have an owner field? */
Lines 639-654 Link Here
639	/* Create and fill a dav_lock_indirect structure */	638	/* Create and fill a dav_lock_indirect structure */
640		639
641	ip = apr_pcalloc(p, sizeof(*ip));	640	ip = apr_pcalloc(p, sizeof(*ip));
642	ip->locktoken = apr_palloc(p, sizeof(*ip->locktoken));	641	ip->locktoken = apr_pmemdup(p, val.dptr + offset, sizeof(*ip->locktoken));
643	memcpy(ip->locktoken, val.dptr + offset, sizeof(*ip->locktoken));
644	offset += sizeof(*ip->locktoken);	642	offset += sizeof(*ip->locktoken);
645	memcpy(&ip->timeout, val.dptr + offset, sizeof(ip->timeout));	643	memcpy(&ip->timeout, val.dptr + offset, sizeof(ip->timeout));
646	offset += sizeof(ip->timeout);	644	offset += sizeof(ip->timeout);
647	/* length of datum */	645	/* length of datum */
648	ip->key.dsize = ((int ) (val.dptr + offset));	646	ip->key.dsize = ((int ) (val.dptr + offset));
649	offset += sizeof(ip->key.dsize);	647	offset += sizeof(ip->key.dsize);
650	ip->key.dptr = apr_palloc(p, ip->key.dsize);	648	ip->key.dptr = apr_pmemdup(p, val.dptr + offset, ip->key.dsize);
651	memcpy(ip->key.dptr, val.dptr + offset, ip->key.dsize);
652	offset += ip->key.dsize;	649	offset += ip->key.dsize;
653		650
654	if (!dav_generic_lock_expired(ip->timeout)) {	651	if (!dav_generic_lock_expired(ip->timeout)) {